4 ms·

Are you seriously proposing that I expose my printers to the public Internet just so that they can use HTTPS on a local LAN? If I must choose between the possi

by avian 8y ago

Are you seriously proposing that I expose my printers to the public Internet just so that they can use HTTPS on a local LAN? If I must choose between the possibility that an attacker with local access might snoop/change my printed documents, and a possibility that my printer will become part of the next botnet through some firmware exploit, I'll definitely choose the former.

fulafel 8y ago
Addressability != reachability. This is how the internet used to work before people got stockholm syndrome with NAT :) Letsencrypt doesn't require you to run a public facing web server on that domain, you can use DNS challenge validation where you prove control by putting a TXT record in your domain.
moviuro 8y ago
printer-level0.printers.coorp IN A 10.10.10.10 Not a problem in any sane DNS, not a problem for your issuer (who doesn't care about the IP) - though it could leak data outside. So to fix it, you could just solve the challenge in outside-facing DNS and only resolve the IP address if the request came from inside the corporate LAN. Also, my school has so many IPs that they do give public IPv4 addresses to all machines, printers, etc. but block access with a firewall.
dspillett 8y ago
> Are you seriously proposing that I expose my printers to the public Internet Adding a name->address mapping for a private address doesn't magically make the private address globally routable. You being able to see that my.internal.web.server.domain.tld maps to 192.168.43.123 doesn't mean that you can see that web server from your location. Even if it was actually a directly routable address rather then one sat behind NAT it wouldn't be accessibly unless I'd expressly added a rule for that in my firewall to override the default "no access from outside unless some other rule has stepped in" rule. And this isn't a DNS issue either: even without the name that address would still be exposed with a bad firewall setup.

by avian 8y ago

fulafel 8y ago

Addressability != reachability. This is how the internet used to work before people got stockholm syndrome with NAT :) Letsencrypt doesn't require you to run a public facing web server on that domain, you can use DNS challenge validation where you prove control by putting a TXT record in your domain.

moviuro 8y ago

printer-level0.printers.coorp IN A 10.10.10.10 Not a problem in any sane DNS, not a problem for your issuer (who doesn't care about the IP) - though it could leak data outside. So to fix it, you could just solve the challenge in outside-facing DNS and only resolve the IP address if the request came from inside the corporate LAN. Also, my school has so many IPs that they do give public IPv4 addresses to all machines, printers, etc. but block access with a firewall.

dspillett 8y ago

> Are you seriously proposing that I expose my printers to the public Internet Adding a name->address mapping for a private address doesn't magically make the private address globally routable. You being able to see that my.internal.web.server.domain.tld maps to 192.168.43.123 doesn't mean that you can see that web server from your location. Even if it was actually a directly routable address rather then one sat behind NAT it wouldn't be accessibly unless I'd expressly added a rule for that in my firewall to override the default "no access from outside unless some other rule has stepped in" rule. And this isn't a DNS issue either: even without the name that address would still be exposed with a bad firewall setup.