News for hackers. Stuff that matters.
Re:[email protected] by davemtl on Sunday September 27, 2020 @10:10AM (#24606720)
Indeed. I've owned `invaliddomain.com` for almost 20 years. You'll be surprised how many use it for testing. One morning I woke up to 30,000 e-mails from Sony Japan with PDFs attached of scanned hand-written part orders. Something similar with Boeing sending me backup notifications. I notified each of these companies about their configuration through their official channels, only to be told "no, it's your server doing this" then usually followed up with an e-mail a few weeks later along the lines of "sorry, our bad". So, if you're testing something and using a test domain, use the IANA reserved domains, please. Theses were the days when I was running my own servers. I don't see it as often now as my e-mail is now hosted.
Re:[email protected] by CydeWeys on Sunday September 27, 2020 @10:40AM (#24606977)
.app, .dev, .prod, and .zip all had substantial volume of problematic traffic that was discovered during the Controlled Interruption period (which occurs prior to launch and consists of a wildcard DNS entry placed on the entire TLD). You would not believe some of the brokenness that was happening there. .zip may need some explanation -- apparently there are lots of library API calls out there that take a path string as input and try to load it as either a local or remote file. You can see where this is going.

https://www.icann.org/en/system/files/files/name-collision-f...

Re:[email protected] by captn3m0 on Sunday September 27, 2020 @01:16PM (#24608213)
ICANN should never have assigned .zip, there's just too much potential for abuse, confusion giving away a common extension as a TLD.
Re:[email protected] by CydeWeys on Sunday September 27, 2020 @02:21PM (#24608886)
There's a lot of overlap between file extensions and TLDs though. .py, .sh, and .app are some more examples (but a fully exhaustive list would be in the dozens if not hundreds). At some point you have to just treat them as the separate namespaces that they actually are (and not somehow try to block a TLD from being used as a file extension, or vice-versa).

Besides, accidentally resolving a file extension to a TLD is only one of many possible different serious errors that can result from exposing an API that can load files locally or remotely, and thus make network calls that you might not be expecting. Fundamentally you need to fix that API either way.

Re:[email protected] by schwartzworld on Sunday September 27, 2020 @04:04PM (#24609738)
not to mention .com
Re:[email protected] by CydeWeys on Sunday September 27, 2020 @06:18PM (#24610599)
Geez, that's by far the best example and it didn't even occur to me. And it's an executable file type. Good call.
Re:[email protected] by jrockway on Sunday September 27, 2020 @03:03PM (#24609265)
I think it's okay. They are different namespaces and people should fix their bugs. It would be like skipping the street number "911 Foo St." because "911" is the emergency phone number and 911 Foo St. is just a regular house. I'm sorry if someone is confused but they shouldn't be confused. They're totally different things.

The biggest mistake we made with DNS was the "shortcut" of implicitly adding the root domain to random strings treated as domain names (turning "example.com." into "example.com"). The file "foo.zip" and the website "foo.zip" wouldn't even be ambiguous if we called the website "foo.zip.". "ndots" also causes operators of DNS servers a lot of pain -- some malfunctioning program tries to resolve "example.invalid" in a tight loop and it balloons to asking for "example.invalid.", "example.invalid.local.", "example.invalid.cluster.local.", "example.invalid.svc.cluster.local.", and then DNS blows up, breaking everything.

Re:[email protected] by markdown on Sunday September 27, 2020 @05:14PM (#24610173)
> It would be like skipping the street number "911 Foo St." because "911" is the emergency phone number and 911 Foo St. is just a regular house. I'm sorry if someone is confused but they shouldn't be confused. They're totally different things.

Floor 13.

Re:[email protected] by johnzim on Sunday September 27, 2020 @02:41PM (#24609085)
We just never should have allowed filename extensions to have semantic power. Resource forks are far more elegant and you could do simple look ahead checks to verify types etc.
Re:[email protected] by bigiain on Sunday September 27, 2020 @10:32PM (#24612384)
Back in '81 when MS-DOS came out and ascribed "magical power" fo files ending in ".com", DNS didn't exist (except possibly as experiments stuff between a handful of university or military mainframes). It was also an era where the vast majority of users of those .com files were doing so off 5 1/4" floppies (or possibly even 8" floppies), and the very idea of adding "resource forks" to your on-disk data would have been ridiculed as an outrageously profligate waste of extremely valuable disk storage resources.

It's easy to say "we should never have" in retrospect. But you're basically accusing programmers back in the late 70s of having insufficient foresight to see problems that would make their decisions seem bad almost half a decade later.

We also should never have let companies sell cigarettes. Or burn fossil fuels. Or start social networks.

Re:[email protected] by chipotle_coyote on Sunday September 27, 2020 @11:52PM (#24612798)
The magical power of extensions actually predates MS-DOS -- both CP/M and TRSDOS did the same thing in the late 70s, and I'm pretty sure both of those were inspired by mainframe operating systems. (I was a TRS-80 kid, and didn't know until much later why our equivalent of batch files had the extension "JCL".)

Having said that, though, we could at least wish that some variant of the Mac's old idea of separate creator and document codes stored as metadata had caught on. Sure, it'd have been a few more bytes per directory entry (to be specific, five more bytes!), but it was a lot more flexible -- and if more operating systems had been built with that "document types are metadata" idea, that metadata could have been replaced with MIME types later on, like it was on BeOS.

Re:[email protected] by johnzim on Tuesday September 29, 2020 @01:03AM (#24624311)
> But you're basically accusing programmers back in the late 70s of having insufficient foresight to see problems that would make their decisions seem bad almost half a decade later.

The URL standard was published in 1994.

Sure, in a vacuum you could read view my comment as meaning in all time, but given that the parent comment is discussing ICANN domains and my comment was relevant to that, I think it’s a little uncharitable to do so.

Re:[email protected] by jedberg on Sunday September 27, 2020 @01:32PM (#24608396)
But it made them so much money!!
Re:[email protected] by endgame on Sunday September 27, 2020 @06:43PM (#24610773)
ICANN should never have done gTLDs at all.
Re:[email protected] by giantrobot on Sunday September 27, 2020 @01:03PM (#24608108)
I've personally run into the .zip problem thanks to browser's omni address/search/chocolate bars. I intend to search for a zip file whose name I know but the browser "helpfully" realizes the term includes no spaces and ends in dotsomething and attempts to treat it as a URL.

A simple workaround is to add a preceding space or something like inurl: but that's isn't an automatic behavior so whoever owns mlpdwarfporn.zip is getting a lot of unintentional hits.

Re:[email protected] by jdxcode on Sunday September 27, 2020 @01:18PM (#24608239)
if we could go back I wonder if it would be better if we had required a leading dot in domain names ".google.com"
Re:[email protected] by Ekaros on Sunday September 27, 2020 @01:45PM (#24608524)
Or if browsers weren't trying to be too smart enough and use the same box for both searching and addresses. Trips me with .py files all time time.
Re:[email protected] by vbezhenar on Sunday September 27, 2020 @03:50PM (#24609606)
Press Ctrl+K and browser will be forced to search.
Re:[email protected] by BiteCode_dev on Sunday September 27, 2020 @02:12PM (#24608774)
After ".py", use " ?" (the space is important) to force the search in firefox.
Re:[email protected] by kbenson on Sunday September 27, 2020 @02:44PM (#24609109)
Using a question make in front of the term is traditionally how some browsers trigger search. They usually have a jeybconbe to add it automatically.

For example, in firefox and chrome ctrl-l will clear the URL bar and put the cursor and focus there to take you to the location you enter, and ctrl-k will do similar but pre-fill the location bar with a preceding '?' so a search is triggered on the input.

These shortcuts have existed for quite a while. They used to just focus the respective separate input boxes, when it wasn't all done through one.

Re:[email protected] by dTal on Sunday September 27, 2020 @03:47PM (#24609583)
What's a "jeybconbe"? It's a googlewhack for this thread.
Re:[email protected] by bigiain on Sunday September 27, 2020 @10:36PM (#24612396)
And six hours later, as I read this thread, nobody has registered the domain still! ;-)
Re:[email protected] by Aearnus on Sunday September 27, 2020 @03:58PM (#24609673)
My best guess is that it looks like a typo for "keycombo".
Re:[email protected] by kbenson on Sunday September 27, 2020 @08:14PM (#24611460)
Yes, thanks. Switched to a new keyboard on my phone, and I'm getting some different typos now. Not necessarily more, I always seem to have a lot that slip through, just different...
Re:[email protected] by oauea on Sunday September 27, 2020 @02:44PM (#24609107)
Or just start the query with `?`

Typing `?bla.py` in the omnibar will perform a search for `bla.py` on both Firefox and Chrome

Re:[email protected] by giantrobot on Sunday September 27, 2020 @01:40PM (#24608461)
I think that ends up as user unfriendly as requiring the dot after the TLD. I don't read up on all the gTLDs so I didn't realize zip was one for the longest time. I think ICANN just went nuts with TLDs, especially ones like .app and .zip that have long-standing associations with ubiquitous file extensions. That combined with the "smart bar" just leads to trouble.
Re:[email protected] by basch on Sunday September 27, 2020 @01:48PM (#24608544)
or go back to left to right reading.

http//com.google.www.

vs

http//com.google.www./file.zip

Re:[email protected] by CydeWeys on Sunday September 27, 2020 @02:15PM (#24608810)
This is the real answer here. It's widely believed that domains working the opposite way of filesystem hierarchies and even URL paths was a huge design mistake. Think of how many billions of dollars have been lost over the years from account compromises resulting from people not correctly distinguishing yourbank.com/account/foobar from yourbank.com-account.info/foobar.
Re:[email protected] by dan-robertson on Sunday September 27, 2020 @02:41PM (#24609087)
1. The reason for the change is generally thought to be email: you read least specific to most specific from left to right, like non-American dates, e.g [email protected]

2. also I think ! was used rather than . for some networks at some times. Certainly I’ve heard this anecdote from some early users of the internet (or maybe other computer networks)

3. Traditionally the dot is the zero-level or extra-top level domain, a bit like / for root in the Unix file system. Indeed if you use dig you may be familiar that it writes domains like “www.google.com.” My web browser only partly seems to accept this format.

Re:[email protected] by JoshTriplett on Sunday September 27, 2020 @03:23PM (#24609415)
> 2. also I think ! was used rather than . for some networks at some times. Certainly I’ve heard this anecdote from some early users of the internet (or maybe other computer networks)

https://en.wikipedia.org/wiki/UUCP#Bang_path

! was used for manual routing from the source to the destination, when messages were copied from server to server via UUCP. People would write paths like ...!ucbvax!deptserver!myname , which means "you probably know how to get messages to ucbvax; from there, here's how to reach me".

Re:[email protected] by ayewo on Monday September 28, 2020 @05:06AM (#24614575)
And here's an example of an old business card using that format for an email address:

https://en.wikipedia.org/wiki/UUCP#/media/File:UUCP_Email_Ad...

Re:[email protected] by elygre on Sunday September 27, 2020 @05:59PM (#24610468)
...!mcsun!nuug!fics!el here :-). Of course, those were actual routes, rather than just reverse hierarchies.
Re:[email protected] by CydeWeys on Sunday September 27, 2020 @05:10PM (#24610152)
Interesting, and makes sense, seeing as how the Web didn't yet exist when domain names were first invented, but email did. It does make sense that they were thus represented in a manner catering to that use case. In hindsight I guess we'd prefer if emails were backwards too, e.g. com.gmail@cydeweys
Re:[email protected] by m0dest on Monday September 28, 2020 @05:11AM (#24614603)
This is ironically what’s become popular for service-specific usernames (“on twitter @dan” and “on instagram @danny”). It’s arguably more useful than the email notation because prefixing with the @ is a clear sign that a username is coming next.
Re:[email protected] by still_grokking on Sunday September 27, 2020 @06:03PM (#24610495)
Only that the @ ("at") reads terribly than.

So com.gmail/cydeweys maybe?

Or it could be just an object in a global namespace (accesses through a protocol specific facade). So com.gmail.cydeweys

Re:[email protected] by CydeWeys on Sunday September 27, 2020 @06:09PM (#24610526)
You could easily just use a different symbol, or pronounce it differently. We think it makes sense the way it is now, but that's only because we've all collectively gotten used to the meaning it has in email addresses. If it had had a different meaning all along then that would make sense to us.

com.gmail.cydeweys doesn't really work because you need some way to distinguish that as an email address and not just a subdomain on com.gmail. So it really does need a different delimiter, like how you need a different delimiter in URLs when it switches from the domain to the path (and then also to the querystring and fragment).

Re:[email protected] by cestith on Monday September 28, 2020 @10:27AM (#24616933)
'@' was used to mean 'at' or 'each' for a long time before email addresses. Often in pricing. '12 @ $3' means twelve units priced at $3 each. It's referred to sometimes as 'commercial at', including its Unicode name.

https://en.wikipedia.org/wiki/At_sign

It was used as 'at' in computing in Algol 68 where it was a shorthand for a keyword 'at'. It has a different application as 'at' in Dyalog APL.

Re:[email protected] by CydeWeys on Monday September 28, 2020 @01:57PM (#24619431)
It wasn't remotely as familiar to a broad audience back then as it is now, though. Considering that people accept its non-idiomatic use for website user names even now (which is the same as what I'm proposing no less), I don't think this would be a problem.
Re:[email protected] by cestith on Wednesday October 07, 2020 @10:25AM (#24708549)
Using your example with left-to-right domains and needing a delimiter, one could build a URL structure for mail that changes the protocol but not the path.

https://com.google. for the main page

https://com.google.mail for gmail

https://com.google.mail/localpart for one's own gmail account

mail://com.gmail/localpart to send mail to what is currently [email protected]

Alternately, we could continue to use '@' and put the localpart first. The URL method of specifying a username or username and password does this for HTTP/HTTPS.

http://username:[email protected]/login

And currently we use mailto:[email protected] but we could use mailsend:[email protected] instead.

Re:[email protected] by basch on Monday September 28, 2020 @12:34PM (#24618453)
I would prefer it to read more like UUCP routing. com.twitter@dan

The other nice thing about this system, is that you can drop the domain when the communication is internal.

And if you really wanted to, you could force the communication protocol xmpp//com.twitter@dan vs smtp//com.twitter@dan

Re:[email protected] by bigiain on Sunday September 27, 2020 @10:40PM (#24612430)
Then of course the web would similarly use

http://[email protected]

Re:[email protected] by CydeWeys on Monday September 28, 2020 @07:59AM (#24615670)
The domain name should definitely still be first. And there are benefits to using a different syntax for domain names than for email addresses, so you can differentiate the two when they're presented out of context (e.g. on a business card or ad).
Re:[email protected] by bigiain on Monday September 28, 2020 @08:28PM (#24622826)
I was mostly just making a joke about the suggestion that email addresses should look like "com.gmail/cydeweys" from upthread...

But I could _kinda_ of make an argument for it. When I open my browser, I want to go to "the homepage of the company running New Your Times, so [email protected] - or perhaps the menu from French Laundry - [email protected]

Re:[email protected] by kuschku on Monday September 28, 2020 @04:49AM (#24614468)
> 3. Traditionally the dot is the zero-level or extra-top level domain, a bit like / for root in the Unix file system. Indeed if you use dig you may be familiar that it writes domains like “www.google.com.” My web browser only partly seems to accept this format.

The browser actually handles it just fine, but some webservers refuse to handle it, despite it being a spec. Most famously Traefik and Caddy as webservers refuse to support these, just because their devs don’t understand the spec and think they know better (what a surprise, both are written in go after all)

This actually causes quite a bit of trouble when you have internal systems resolving pretty much everything as local domain first, and some external webservers don’t support the spec. Most famously, caddyserver.com. itself is broken

Re:[email protected] by tsimionescu on Sunday September 27, 2020 @03:55PM (#24609651)
Or just required the use of the true FQDN - "google.com."
Re:[email protected] by jdxcode on Sunday September 27, 2020 @07:14PM (#24611015)
that's what I meant actually—I just forgot it was trailing
Re:[email protected] by miki123211 on Monday September 28, 2020 @06:20AM (#24615067)
My college's online system for everything is called edukacja.cl. A lot of people type that into the address bar, expecting to be redirected to the login page. Fortunately, the person who bought that domain didn't misuse it. I can imagine someone putting a fake login page there, and getting access to a lot of sensitive student details.
Re:[email protected] by monadic2 on Sunday September 27, 2020 @12:31PM (#24607854)
Ruby's `open` accepts urls. I can't say I've ever used this functionality.
Re:[email protected] by dogma1138 on Sunday September 27, 2020 @12:59PM (#24608075)
Ask your red team about that ;)
Re:[email protected] by diamondo25 on Sunday September 27, 2020 @02:10PM (#24608754)
PHP's file_get_contents supports it as well.
Re:[email protected] by abiogenesis on Monday September 28, 2020 @01:14AM (#24613194)
I don't know Ruby enough to comment on that but I would guess it requires a scheme as well.
Re:[email protected] by ben0x539 on Sunday September 27, 2020 @11:14PM (#24612620)
I've only ever used it for that! For files there's `File.open`! ;)
Re:[email protected] by cyberbanjo on Sunday September 27, 2020 @09:16PM (#24611881)
Clojure a slurp too.. never been bitten, I thought it was useful.
Re:[email protected] by Jon_Lowtek on Sunday September 27, 2020 @11:58AM (#24607604)
> "no, it's your server doing this"

at that point i expected the story to go "and then they sued me for stealing their documents"

Re:[email protected] by xmprt on Monday September 28, 2020 @12:02AM (#24612846)
He orchestrated a man in the middle attack by being in the middle of the engineers and their incompetence.
Re:[email protected] by Wistar on Sunday September 27, 2020 @11:13AM (#24607223)
I owned forexample.com for 15 years or so and saw all kinds of mail but the most persistent was a record company owner who, from time-to-time, wrote semi-deranged angry emails demanding that I turn the domain over to him. I always had grand plans for the domain but never acted and, a couple years ago, I forgot to renew and the domain is now in someone else's hands. I don't miss it, especially the record company guy.
Re:[email protected] by nullsense on Sunday September 27, 2020 @04:02PM (#24609714)
I wish there were a site that all this stuff could be posted so we can all share in the fun. Always entertaining hearing about this stuff.
Re:[email protected] by m463 on Sunday September 27, 2020 @08:54PM (#24611697)
https://thedailywtf.com/ is pretty close

When I read reddit (before it jumped the shark imo) there was something similar in a non-tech way called /r/idontworkherelady

Re:[email protected] by nullsense on Sunday September 27, 2020 @09:26PM (#24611951)
I've run out of funnies to find in the codebase I work on. This looks like a fresh supply of much much more. Much appreciated.
Re:[email protected] by BerislavLopac on Sunday September 27, 2020 @02:20PM (#24608880)
I remember reading - long time ago - a story of a developer who used http://xxx as a placeholder for unknown domains, until at some point the browsers started resolved single-word links into www.<word>.com... :-o
Re:[email protected] by bigiain on Sunday September 27, 2020 @10:56PM (#24612523)
Back in the days before I'd ever heard of multicast DNS or zeroconf networking, I had a local dns server set up with all our subdomain.ourdomain.com duplicated as subdomain.ourdomain.local and pointing to our local dev/staging versions of our websites. It worked wonderfully, until I think MacOS 10.2 arrived (so, like 20 years ago almost) which had mDNS support for the first time and "broke" it all on me...

I switched to using subdomain.ourdomain.staging instead and got on with life. I wonder if anyone's gonna have to deal with the fallout of that decision when someone oneway pays ICANN enough money to own the .staging TLD?

(I wonder how much "interesting" stuff would land in your mail/web/ssh/whatever log files, if you registered .staging and .dev and just logged everything that came past (or intentionally/actively honey potted everything there?)

Re:[email protected] by marcthe12 on Monday September 28, 2020 @07:22AM (#24615432)
Use Lan. Reserved so no issues
Re:[email protected] by xmprt on Monday September 28, 2020 @12:09AM (#24612867)
I was about 5 seconds away from clicking this link on my work laptop until I realized what it would redirect to. For others like me, it's very NSFW
Re:[email protected] by BerislavLopac on Monday September 28, 2020 @03:38AM (#24614007)
It doesn't seem that the browsers still to the expansion things; I've tried it, and am just getting the "We’re having trouble finding that site." error message, or similar. But for some time that expansion was real.
Re:[email protected] by chrismeller on Sunday September 27, 2020 @10:20AM (#24606824)
Haha. That’s actually surprising, I mean that one takes some work to even type. I’ve mentioned previously on HN that I own doesnthaveone.com, which is constantly bombarded with random crap. I wish I had some big public customer data to see what other fake ones show up.
Re:[email protected] by anonytrary on Sunday September 27, 2020 @03:07PM (#24609290)
On the other hand, you knew what you were getting into when you decided to be the owner of a meme domain! People should use properly reserved domains, but I can't really blame them for accidentally using meme domains.
Re:[email protected] by FlingPoo on Sunday September 27, 2020 @11:01AM (#24607124)
I registered non-existent-domain.com many years ago when I saw it referenced in some article as a place-holder domain name.
Re:[email protected] by retox on Sunday September 27, 2020 @04:30PM (#24609916)
I had my.homepage.com for a while back in the early 2000s, unfortunately I wasn't allowed to monetize it, but looking at the referral logs was always interesting.
Re:[email protected] by tus88 on Sunday September 27, 2020 @02:05PM (#24608711)
Why would you tell them and bring an end to the lolz?
Re:[email protected] by colejohnson66 on Sunday September 27, 2020 @05:37PM (#24610329)
Because, technically, opening those emails when they contain confidential information could be construed as a violation of the CFAA (it’s very broad).
Re:[email protected] by bigiain on Sunday September 27, 2020 @11:01PM (#24612551)
Indeed it's probably broad enough that you could likely find an ambulance chaser who'd go after people who _send_ you those emails "in excess of their authorized access" to your mail server.

You could weaponise this the same way companies use defensive patents... "Sure, I opened one of your emails, but you've connected to my mail server without authorisation <checks logs> 27,943 time so far this month. Go on, lawyer up. Bring it on!"

Re:[email protected] by tus88 on Monday September 28, 2020 @03:18PM (#24620278)
This.