News for hackers. Stuff that matters.

A comment on Document reasoning to block DNS to 127.0.0.1. Parent comment

Re:Document reasoning to block DNS to 127.0.0.1 by SahAssar on Tuesday June 20, 2023 @12:57AM (#36399898)
> Besides that, you can't get HTTPS for these domains (without the mess of a custom CA and even then you'll run into CT issues)

Of course you can, you just cant use HTTP validation for it. Use DNS validation and it works fine.

[ Parent | on HN ]
Re:Document reasoning to block DNS to 127.0.0.1 by jeroenhd on Tuesday June 20, 2023 @02:56AM (#36400602)
Not if you don't control the DNS. I don't know who controls fbi.com but I sure can't get a trusted certificate for it
[ Parent | on HN ]
Re:Document reasoning to block DNS to 127.0.0.1 by SahAssar on Tuesday June 20, 2023 @10:22AM (#36404400)
That was not the point you made in the original post. You said

> Besides that, you can't get HTTPS for these domains (without the mess of a custom CA and even then you'll run into CT issues) so development doesn't even reflect real life deployments. Secure origins matter!

So you can absolutely make development match deployments.

[ Parent | on HN ]