Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So You Want to Define a Well-Known URI

mnot.net

Post reply on HN
Print view View original

71–80 of 105 posts

Re: So You Want to Define a Well-Known URI

#71

Post by deathanatos »

eschatology wrote: post #10
einpoklum wrote: post #5

How well-known are those URIs though? :-\

I spent 10 minutes searching for one in the article, in the RFC, in the wikipedia page, on google, to search for a .well-known example. Couldn't find one. I did read one before while working with github oidc, and I did find it very useful. What is it with technical documentations that go deep describing what it is in plenty words but refusing to give a single example? This far from the first case I've ran into either…

> I spent 10 minutes searching for one in the article, in the RFC, in the wikipedia page, on google, to search for a .well-known example. Couldn't find one.

I don't know how that can be, since you claim to have found the RFC; the RFC straight-forwardly states,

> 5. IANA Considerations

> This specification updates the registration procedures for the "Well-Known URI" registry, first defined in [RFC5785]; see Section 3.1.

& then of course directs IANA to establish a registry. We'd expect this section, given the very nature of the RFC is that it establishes a collection of things, so that there is an IANA considerations section should be wholly unsurprising…

If you see the linked section…

> The "Well-Known URIs" registry is located at https://www.iana.org/assignments/well-known-uris/>.

And there's a link to a listing of every standardized .well-known URI there is.

> What is it with technical documentations that go deep describing what it is in plenty words but refusing to give a single example?

The RFC provides an example in the form of "example", but also in the form of "robots.txt" (as a "it could have used this, had this existed", but what else could it have done?).

Re: So You Want to Define a Well-Known URI

#73

Post by Joker_vD »

einpoklum wrote: post #5

How well-known are those URIs though? :-\

Slightly less well-known than XDG directories among the developers of Linux-targeted software, it would seem.

Seriously, what an oxymoronic name. "/index.html" is a well known URL, literally: most of web-developers are aware of it. But inventing a bunch of URLs with predefined semantics and then slapping the "well-known" label on it... well, it won't magically make them actually well-known.

Re: So You Want to Define a Well-Known URI

#74

Post by Bender »

teddyh wrote: post #45
arcfour wrote: post #8

Earlier quoted context omitted.

> Why discord domain verification instead of domain-verifications with a dynamic list on entries? The TXT record itself is already a dynamic list of entries. It's far simpler and easier to iterate through the list and compare the start of each value with your search string until you find "discord domain verification" directly than it would be to do anything else. Example: ;; ANSWER SECTION: ycombinator.com. 300 IN TX…

Having all those TXT records at the domain apex like that makes the TXT query reply huge , which affects, for instance, every mail recipient who merely wants to check the SPF record. This is a bad pattern to follow.

The domains with large numbers of TXT records are also used in DNS DDoS amplification attacks. Spoofed UDP requests to domains that have a large number of TXT records are used to slam other sites. In the past I would transparently strip the TXT records when I ran public DNS recursive resolvers nobody noticed except the botters but some here may be activated. Some domains with a lot of dangling records:

    for i in $(echo "ycombinator.com 500px.com box.com ebay.com google.com hm.com lenovo.com nordstrom.com realtor.com tmz.com wired.com");do echo -en "${i}:  ";dig +short +nocookie -t TXT "${i}"|wc -l;done|sort -rn -k2
    nordstrom.com:  39
    lenovo.com:  38
    realtor.com:  36
    ebay.com:  36
    hm.com:  34
    box.com:  28
    wired.com:  27
    tmz.com:  22
    500px.com:  17
    ycombinator.com:  13
    google.com:  13
Ebay used to be in first place, not sure what changed.

In unbound.conf:

    local-zone: ycombinator.com typetransparent
    local-data: 'ycombinator.com. TXT "[ddos redacted]"'
after the changes:

    dig +short +nocookie -t txt ycombinator.com
    "[ddos redacted]"

Re: So You Want to Define a Well-Known URI

#76

Post by mceachen »

vidarh wrote: post #37
iamacyborg wrote: post #33

Earlier quoted context omitted.

Giving a markdown version of a page seems like an interesting choice instead of just embedding a schema marked up one

Every page on code.claude.com has a markdown version available by just appending ".md", and Claude Code knows about it. E.g: https://code.claude.com/docs/en/overview and https://code.claude.com/docs/en/overview.md

Here's how to do it with more recent versions of Hugo:

https://photostructure.com/coding/hugo-markdown-output/

(It includes the grandparent's head link suggestion, but it's not just "change .html to .md" because I'm old skool and as a wee nerd was told that URLs ending in .html or .php or whatever we're frowned on, so the above link's markdown is available by appending /index.md )

Re: So You Want to Define a Well-Known URI

#77

Post by marcosdumay »

ape4 wrote: post #70
marcosdumay wrote: post #63

Earlier quoted context omitted.

What do you mean? It was explicitly designed to be a junk drawer.

Why not call it .junk-drawer instead ;)

Well, it does live space for other drawers for other kinds of junk. This one is just for junk you already know it will be there.

Re: So You Want to Define a Well-Known URI

#78

Post by dspillett »

reddalo wrote: post #52
dspillett wrote: post #32

Earlier quoted context omitted.

The same could be said of robots.txt And anything else that might tell them not to access something.

robots.txt predates the modern web though

My point was that llms.txt not working is no different from them ignoring everything else that came before and probably everything that is yet to come.

If they want it, they will take it, polite directives in text files will have no effect.

Re: So You Want to Define a Well-Known URI

#79

Post by somat »

Bender wrote: post #74
teddyh wrote: post #45

Earlier quoted context omitted.

Having all those TXT records at the domain apex like that makes the TXT query reply huge , which affects, for instance, every mail recipient who merely wants to check the SPF record. This is a bad pattern to follow.

The domains with large numbers of TXT records are also used in DNS DDoS amplification attacks. Spoofed UDP requests to domains that have a large number of TXT records are used to slam other sites. In the past I would transparently strip the TXT records when I ran public DNS recursive resolvers nobody noticed except the botters but some here may be activated . Some domains with a lot of dangling records: for i in $(ec…

Whee, my chance to be the useless use of cat asshole.

Why the echo? "for" should handle a list of terms just fine.

Pedantic assholery aside, genuine question. Is this some sort of shell expansion injection countermeasure of which I am unfamiliar?

And for the record I quite enjoy employing the useless use of cat. It turns pumping a file into a pipeline from a screwball shell meta command into a command isometric to any other command. I sort of wish tee had a "suppress stdout flag" so it could be used more naturally as cat's counterpart.

Re: So You Want to Define a Well-Known URI

#80

Post by welder »

Does a change-password registry actually get used, even by bots? I don't see bots checking for a .well-known/change-password url on my sites. It seems a good place to put public configs, just to have a place for them, but not as a means of discovery.
Post reply on HN