Comment by djsumdog | Hacker News Reader

Comment by djsumdog | Hacker News Reader

Parent Full thread

Not just Windows itself, but a lot of software and tooling. If I'm working on my website, I have an entry in my hosts file so battlepenguin goes to a local web server. But I have to type it in with the leading http:// and end with a slash, or else Firefox might automatically add a .com to the end and suddenly it's going to my production/live site and not my local copy.

Some issues might have to do with the way DNS is resolved by the operating system (the Start > Run \\resource example in the article) and others by the way some applications (like web browsers) do fallbacks for unknown DNS records.

Tangential: I worked at one company that had lower environments end in .dev and they started running into issues when Google purchased (and now sells) .dev domains and one of their project dependencies was hosted in an open source project repo that ended in .dev .. it had fallen out of use at the company and they just trashed the hosted zone, but I imagine at other shops, there's still domain overlap in the wild.

> or else Firefox might automatically add a .com to the end and suddenly it's going to my production/live site and not my local copy.

browser.fixup.alternate.enabled = false

alternatively:

browser.fixup.dns_first_for_single_words = true

Formerly in the industry. I remember when .dev came out and I was in shock that ICANN thought that would be a good idea. They should have known better.

.dev, .local, .home, .corp. I don’t know how many of those are tlds, as I’ve let all that knowledge leave me; but, there are some tlds that just should be permanently blocked from being real tlds.

People are idiots. The first idiot thing you can expect is that they'll deny they are idiots and will insist that you shouldn't idiot-proof things.

The second is, since they're idiots, they'll hurt themselves on the things you didn't idiot proof.

The .int Top Level Domain has existed since the 1980s. Nevertheless plenty of people decided they'd use names ending in .int for "internal" stuff. Then they were astonished that this doesn't work as expected. We even had to smack CAs for issuing certificates for such "internal" names back when they were allowed to do that (today CAs trusted in the Web PKI are not allowed to issue for names that aren't part of the Internet DNS hierarchy with a narrow exception for the .onion pseudo TLD).

> I remember when .dev came out and I was in shock that ICANN thought that would be a good idea.

RFC 2606 had .test, .example, .invalid, and .localhost clearly established as the right TLDs to use in 1999. It's not ICANN's fault that random people then decided to use domains not in that list, even after being warned that those are the only TLDs guaranteed to never be used.

The ones I'm thinking of are mostly for internal environments.

It's my understanding (could be very wrong) that ICANN did a survey of some sort to see what TLDS are currently being used by companies and was intending to not release TLDs that are in that list, for backwards compatibility, at least for some time.

And even if it isn't, ICANN should have known that some people weren't following the official rules, and should have adapted, to maintain compatibility. It's not that big of a list of TLDs they needed to avoid. Pragmatism is important, you know?

Two things:

1. Stop having a parallel internal name hierarchy. This has always been a terrible idea, and effort to try to make it work less badly is unnecessary if you instead don't do it at all. IF you're EXA Metal Pole Europe and you own example.com then put the internal stuff in internal.example.com or whatever, don't put it in a "private" TLD named .example. If it's very important to you, you can use Split Horizon DNS to prevent outsiders looking up names in internal.example.com from your DNS servers.

2. Yes, measurements were made for potential TLDs and ICANN designated some potential TLDs as "High risk" and agreed not to try to delegate them (ie sell them). .corp and .home were on that list. Nevertheless you should not use these names.

My suggestion for a tld unlikely to ever be issued in future is "icann-sucks" but it might not be appreciated by the average business.

Could someone tell me in what world this sort of assumption could have ever made sense?

Why in God’s name would you design a system that redirects your requests like that? Are the security implications not painfully, frustratingly obvious?

Imagine a world without search engines and omni bars. This newfangled world wide web thing comes along and looks like it might become popular, but it's totally new to most people, who happen to be 99% of your customers. If they type `cnn` in the bar, chances are they want to go to cnn.com, so you make it so and don't lose most of your market share.

Besides as far as painfully, frustratingly obvious security implications are concerned you have done much worse before for less end-user benefit like making your main word processing application the world's premier networked virus delivery platform.

.dev is making a lot of money for example , it is not easy to argue that they/google lose money because others didn’t read the spec.

> so you make it so and don't lose most of your market share.

lose it to whom though? other software that also doesn't behave the same way?

And, per earlier comments, this wasn't a browser thing - this is a lower level windows hostname resolver issue.

This is the doing of a company that gave us Internet Explorer 6 & Office Macros.

Microsoft prioritized user experience over security for the longest time of their existence and I think they had a little bit of success with it :)

Reply on news.ycombinator.com