My domain got abused on GitHub Pages
meertens.dev
My domain got abused on GitHub Pages
1–10 of 21 posts
Re: My domain got abused on GitHub Pages
#2Seems like GitHub could solve this by making users verify they own a domain name by adding a value to a txt record rather than just seeing the domain points to github and letting any repo use it.
Re: My domain got abused on GitHub Pages
#3Seems like GitHub could solve this by making users verify they own a domain name by adding a value to a txt record rather than just seeing the domain points to github and letting any repo use it.
You actually can do that. https://github.com/settings/pages
Re: My domain got abused on GitHub Pages
#4[dead]
Re: My domain got abused on GitHub Pages
#5Seems like GitHub could solve this by making users verify they own a domain name by adding a value to a txt record rather than just seeing the domain points to github and letting any repo use it.
You actually can do that. https://github.com/settings/pages
Thank you; just did that for my domain I use with GH Pages. They should really mention that in the setup instructions.
Re: My domain got abused on GitHub Pages
#6>how long it’s been abused?
I would say probably 10 years, I remember reading about the CNAME github issue around 2015 or so, as before that most used to use jekyll with gh pages, was very popular among indie developers
Re: My domain got abused on GitHub Pages
#7You told your NS to forward any request to GitHub, a platform you don't own.
I think this is the expected outcome.
It's good you noticed and shared your findings, but to me this "works as intended"
Re: My domain got abused on GitHub Pages
#8Seems like GitHub could solve this by making users verify they own a domain name by adding a value to a txt record rather than just seeing the domain points to github and letting any repo use it.
I’ve set up two static pages with custom domains using GH Pages in the past couple of months, and both times I had to go digging in the docs before I found the verification page as part of trying to figure out why https wasn’t working. Fucking inexplicably poor UX design from GH. If I add a custom domain, just ask me to verify it.
Re: My domain got abused on GitHub Pages
#9You wildcarded any traffic to github.com and thought, "eh, they probably check" and are wondering who is at fault? It's you.
You didn't think through the consequences, and you could learn a bit more about DNS.
Re: My domain got abused on GitHub Pages
#10You told your NS to forward any request to GitHub, a platform you don't own. I think this is the expected outcome. It's good you noticed and shared your findings, but to me this "works as intended"
Please don’t scold people on HN. That’s not the style of discussion we’re trying for here.