6 ms·
Hostnames and usernames to reserve
- shurcooL 11y agoThe article looks great and makes many good points, but I'll pick on one: why disallow upper case letters from usernames?
- singold 11y agoProbably to avoid that if i have the singold user,someone takes the Singold user to impersonate me, just my guess
- ams6110 11y agoEmail addresses and domain names are case-ignoring so you should never allow usernames that differ only in case. Allowing only lower case is an easy way to do this.
- chrismorgan 11y agoThe username part of an email address can actually be case sensitive, and this has been known to cause problems with some systems (e.g. https://airmail.tenderapp.com/help/discussions/287/113-case-sensitive-email-addresses-being-sent-out-as-all-lowercase https://airmail.tenderapp.com/help/discussions/287/113-case-...).
- protomyth 11y agoYes, and its a pain in the butt error to track down. I was helping a friend with an old postfix / cyrus server with some custom software and case sensitivity was the final cause of bad mail delivery. Gotta love the combo of a bad config and an old mainframe app sending in all uppercase.
- nitrogen 11y agoSo instead of converting to lowercase, store them with case preserved but do a case insensitive uniqueness check (and probably allow any case for login).
- protomyth 11y agoor just force all lowercase and keep the support burden lower and save yourself a ton of trouble when dealing with foreign systems. Add a rule on incoming e-mail to convert all addresses for the local domain to lowercase to complete the package.
- nitrogen 11y agoIt probably depends on whether we're talking about making your own users, like the original link, or allowing users to interface with other systems, like entering an email address.
- edgarbob 11y agoYes, this seems to be the right behavior for case-insensitive things like DNS names as well. If a user inputs one, preserve the case when you store it, but do case-insensitive comparisons.
- gpvos 11y agoThe local part of an email address is not required to be case-insensitive, except for the Postmaster address. RFC 822: "The domain-dependent string is uninterpreted, except by the final sub-domain; the rest of the mail service merely transmits it as a literal string." However, there are too many services smashing the case of the local part to either lower or upper case that case-sensitive names have become nigh impossible to use.
- J_Darnley 11y agoCongratulations for using example.com as it is meant to be used.
- zimbatm 11y agoWhen github used to host "pages" under github.com I remember registering "blog.github.com" (and reporting obviously). If you take the social-engineering into account the list should be made long: login, support, status, help, ... Just to say, the list could be made much longer (eg: login)
- zackboe 11y agoSeems PayPal also missed this memo: https://www.paypal.me/support https://www.paypal.me/support https://www.paypal.me/download https://www.paypal.me/download https://www.paypal.me/signup https://www.paypal.me/signup
- zachrose 11y agoHere are some that I've reserved for my own web app, now inclusive of RFC 2142: https://gist.github.com/zachrose/30862a11857a31242d60 https://gist.github.com/zachrose/30862a11857a31242d60
- beneater 11y agoSee also https://www.ietf.org/rfc/rfc2142.txt https://www.ietf.org/rfc/rfc2142.txt
- jakobdabo 11y agoThanks, this was very informative. I wonder how the pull requests for the public suffix domains are being checked. Can somebody use it as an attack surface by adding the victim's domain in that list and effectively blocking their website from setting cookies?
- jnky 11y agoI would suggest adding "autodiscover" to the list of disallowed hosts. It is used by Microsoft Outlook and Exchange ActiveSync clients (e.g. in smartphones) to automatically detect the correct server settings.
- ecesena 11y agoAlso, you should include the name of your service itself, especially if users can produce content. Edit: for similar reasons to blog./login./support. etc. (just read other comments)
- protomyth 11y agohelpdesk is a pretty good choice to reserve just to keep people from doing some foolish things.
- dmd 11y agoA popular MS Exchange cloud provider is http://webmail.domainlocalhost.com http://webmail.domainlocalhost.com Seriously. domainlocalhost.com.
- jonasvp 11y agoWell, that would have been helpful when I announced http://www.browser-details.com http://www.browser-details.com on HN - it allows you to reserve a subdomain and it never even occurred to me that I'd have to restrict them (apart from the obvious regex). So a thoughtful HNer taught me a lesson and reserved "www". Took me a second to figure out why the site didn't behave as expected...
- supper 11y agoI have handled this by only allowing more-than-one-word names to be use as subdomains, and made a slug out out of it, like so: My Name => my-name.site.com Is there any gotcha's here for me?
- _theskumar 11y agoFaced with similar issues, I maintain a python library called python-usernames[1] with list of closed to 400 reserved words[2]. Publishing this as a library helps a lot collecting the wordlist over time and be able to use the same list in all my projects. [1] https://github.com/theskumar/python-usernames https://github.com/theskumar/python-usernames [2] https://github.com/theskumar/python-usernames/blob/master/usernames/reserved_words.py#L4 https://github.com/theskumar/python-usernames/blob/master/us...
- zimbatm 11y agoJust compiled the list and added a few others: https://zimbatm.github.io/hostnames-and-usernames-to-reserve/ https://zimbatm.github.io/hostnames-and-usernames-to-reserve... Feel free to use for your next PaaS !