81–90 of 105 posts
Earlier quoted context omitted.
I would say acme-challenge is one of the most used ones. How else would one get SSL certificates today
DNS TXT challenge for example. Also better because you can get wildcard certs.
Does a change-password registry actually get used, even by bots? I don't see bots checking for a .well-known/change-password url on my sites. It seems a good place to put public configs, just to have a place for them, but not as a means of discovery.
Earlier quoted context omitted.
The domains with large numbers of TXT records are also used in DNS DDoS amplification attacks. Spoofed UDP requests to domains that have a large number of TXT records are used to slam other sites. In the past I would transparently strip the TXT records when I ran public DNS recursive resolvers nobody noticed except the botters but some here may be activated . Some domains with a lot of dangling records: for i in $(ec…
Whee, my chance to be the useless use of cat asshole. Why the echo? "for" should handle a list of terms just fine. Pedantic assholery aside, genuine question. Is this some sort of shell expansion injection countermeasure of which I am unfamiliar? And for the record I quite enjoy employing the useless use of cat. It turns pumping a file into a pipeline from a screwball shell meta command into a command isometric to an…
Would it be mean if I said I do that to expose cat rectum? I used to cat to tac to cat but that was too on the nose. Another fun one is mixed case HtMl elements. I miss that old dokimos site from 2001.
Here's [1] something to play with. not my repo
Earlier quoted context omitted.
Also, DNS-PERSIST-01 seems to be coming soon for Let's Encrypt, which should allow even people that can't easily dynamically update their DNS records to get wildcard certs. I assume this might become more widely used than HTTP-01 challenges.
I wish someone would write a blog post about the difference between DNS registrars and DNS hosts, because I've seen people assume they need to use a registrar that has an API in order to change their DNS records programmatically. I used to assume that too.
How do you associate metadata with a public name? A SRV record! No, a TXT record! No, a meta tag! No, data attributes! No, an X.509 attribute! No, a random file at top level! No, a well known file under some schema! No, ...
It goes on forever. We're left with a mishmash of mechanisms and lowest common denominator support for them all.
It would be nice if we picked an extension mechanism and maximally enhanced it rather than having everyone invent his own
Earlier quoted context omitted.
I wish someone would write a blog post about the difference between DNS registrars and DNS hosts, because I've seen people assume they need to use a registrar that has an API in order to change their DNS records programmatically. I used to assume that too.
- registrars control NS records, however these can be changed - NS records control other records - registrars can also use their own nameservers to manage your DNS
"This Web site requires a more modern browser to operate securely; please upgrade your browser." Alternative, no SNI required https://web.archive.org/web/20260619061625if_/https://mnot.n...
SNI is good, though? I'm curious how you are running into this.
Why are they so specific? Why password-reset instead of a more generic link tree? Why discord domain verification instead of domain-verifications with a dynamic list on entries? Seems like a waste of time. I would just define my own spec outside of well known for my use case.
> Why discord domain verification instead of domain-verifications with a dynamic list on entries? The TXT record itself is already a dynamic list of entries. It's far simpler and easier to iterate through the list and compare the start of each value with your search string until you find "discord domain verification" directly than it would be to do anything else. Example: ;; ANSWER SECTION: ycombinator.com. 300 IN TX…
Earlier quoted context omitted.
Having all those TXT records at the domain apex like that makes the TXT query reply huge , which affects, for instance, every mail recipient who merely wants to check the SPF record. This is a bad pattern to follow.
The better pattern is to use an underscore prefix like _discord-verification.domain.com If your site allows user-created subdomains it shouldn't allow leading underscore. This is reserved somehow.
Earlier quoted context omitted.
They are collected at this registry: https://www.iana.org/assignments/well-known-uris/well-known-...
Are they actually, though?
And https://www.rfc-editor.org/info/rfc8615/#section-3
> Applications that wish to mint new well-known URIs MUST register. them, following the procedures in Section 5.1 […]
Of course this is all voluntary, but why would you risk a name collision with another project if the process is quite straightforward?