3 ms·
What's with domains such as blubb.mysystem.local or foo.invalid? .invalid and .local are reserved domains and guaranteed to never be in use on the public inter
by kuschku 7y ago
What's with domains such as blubb.mysystem.local or foo.invalid?
.invalid and .local are reserved domains and guaranteed to never be in use on the public internet - yet I can't get certificates for them
- zurn 7y agoIf you could get certificates for them, so could anyone else including your adversaries, since there is no system of ownership for them. It would be like issuing certs for https://192.168.1.1 https://192.168.1.1
- kuschku 7y agoActually that's why browsers already treat http://127.0.0.1/ http://127.0.0.1/ and certain other local IPs as if it was via https. For all local IP and domain space - that is 192.168/16, 10/8 and so on - it should automatically treat them as if they were safe anyway.
- zurn 7y agoThey're likely be part of a cafe/hotel/guest wlan or a poorly managed "intranet" full of vulnerable stuff that needs to be shielded from CSRF. That's in addition to having ambiguous addresses. So should definitely be treated as less safe.