6 ms·

Looks to be cname forwarding. > $ dig captcha.nsa.gov > ;; ANSWER SECTION: > captcha.nsa.gov. 13246 IN CNAME www.nsa.gov.edgekey.net. > www.nsa.gov.edgekey.

• snazz 7y ago
  Can anyone just do that to any domain? My website is hosted at GitHub Pages and requires a CNAME file in the repo root as well as the DNS entry at Cloudflare.
  • milankragujevic 7y ago
    Yes, they are not using a CNAME (whereby the original server serves the page, just on a different domain), they appear to be using a reverse proxy. You can find more info about how that works here: https://en.wikipedia.org/wiki/Reverse_proxy https://en.wikipedia.org/wiki/Reverse_proxy
    • snazz 7y ago
      That makes a lot more sense.
    • tpmx 7y ago
      That's copyright and trademark infringement.
      • milankragujevic 7y ago
        That is not a technical limitation but a legal one.
        • tpmx 7y ago
          Yes. The NSA is is breaking the law here.
          • jaywalk 7y ago
            You have no way of knowing that. They could have an agreement with Google to allow this.
            • milankragujevic 7y ago
              Agreed. The copyright holder / trademark owner must be the party that wants to limit distribution, not the government or some unrelated third party. i.e. if I see you producing fake Coca Cola drinks, I can't sue you for infringing on The Coca Cola Company's trademark. They would have to sue you. Same applies for the government. And of course, if NSA does have an agreement with Google to reverse proxy https://google.com/ https://google.com/, them doing exactly that would be perfectly legal. I presume they have SOME sort of agreement, and aren't just doing this behind Google's back, as the website is on HN's first page in the first 5 places for an hour already, and Google hasn't banned access. Try getting even 50 Google queries with a reverse proxy, and you will see what I mean -- they will show you a progressively more difficult ReCAPTCHA until a certain treshold, after which the CAPTCHA is unsolvable and is there only to waste your time. This hasn't happened to HN readers [yet].
              • tpmx 7y ago
                Meanwhile I presume they misconfigured a service meant for doing captcha checks using Google. What's more likely? Why are you so aggressively.. eh.. okay, not going to write that.
          • rabuse 7y ago
            They most certainly have an agreement with Google here.
            • ryanlol 7y ago
              Why?
  • notatoad 7y ago
    you can do it to any domain that isn't checking the hostname header. Most sites check that the hostname header matches the sites actual domain (like is specified in the CNAME file on github pages) that's definitely not what's happening here though, most obviously because it has an SSL certificate. If it were just being CNAMEd over to google, the SSL would be invalid. NSA has to be catching the request to terminate the SSL, and then proxying it back to google.
• ThreeFx 7y ago
  Pretty sure Akamai does not front Google, they are more than large (and competent) enough to do that themselves.