5 ms·

Sounds like it could be intentional. — We bought .dev, now what we do with all those people in the wild misusing it? — Well, most of them misuse it with our b

by owl57 6y ago

Sounds like it could be intentional. — We bought .dev, now what we do with all those people in the wild misusing it? — Well, most of them misuse it with our browser, let's break at least their hacks early and loudly.

CydeWeys 6y ago
It was unintentional. Source: The horse's mouth. I'm the guy who came up with the idea of launching .dev and .app as HTTPS-only TLDs, and I'm the one who had them added to the HSTS preload list.
- jbrooksuk 6y ago
  Out of interest, how did this happen without any investigation into possible consequences etc? It’s a huge change that surely warranted special attention before making it happen?
  - CydeWeys 6y ago
    It's not a huge change though. .dev was a new, never-launched TLD, so there were no existing real domain names to break with the addition of HSTS preloading. Established best practice for decades at that point was already to always use real domain names (or subdomains thereof) or specifically reserved test domains/TLDs (see RFC 2606, published in 1999) for testing/development/local networking purposes. So yes, we didn't anticipate how many people weren't following the best practices, but that would have been hard to determine prior to doing the thing anyway. There were also lots of people who had the mindset of "We won't change anything until it stops working", so in some sense a lot of it was unavoidable. See e.g.: https://github.com/laravel/valet/issues/204 https://github.com/laravel/valet/issues/204 https://github.com/laravel/valet/issues/294 https://github.com/laravel/valet/issues/294 https://github.com/laravel/valet/issues/431 https://github.com/laravel/valet/issues/431 (note that Laravel users were responsible for a non-trivial fraction of the total problems experienced, and that we only discovered all this post-HSTS-preloading). The problem was repeatedly pointed out and the maintainers refused to fix it until it actually broke. So, inevitably, it broke, and then they fixed it.
    - oauea 6y ago
      Were you somehow unaware of the many, many, many people who used .dev in their local environments? You must've had some idea, since the initial plan was to use the .dev TLD for exactly that within Google. I've always hated Google for egoistically claiming this tld, and ICANN for letting them.
      - evolve2k 6y ago
        Basecamp’s Pow project comes to mind. It enables zero config local development configuration, whereby at the time it would make your locally running dev server available on .dev So instead of having to spin up a local server and then visiting say 127.0.0.1:3000, I could instead just visit myappname.dev and it would show me what would previously show on localhost or it would spin up a server first for that app then show it to me. They switched to .test in response to google’s change. Official site: https://pow.cx https://pow.cx Thread on change from .dev to .test https://github.com/basecamp/pow/issues/386 https://github.com/basecamp/pow/issues/386
        colejohnson66 6y ago
        I just got an “untrusted connection” warning visiting pow.cx
        evolve2k 6y ago
        Oh woops just habit to set https now. Page is from an earlier time when we didn’t mind static sites not being https. Visit http://pow.cx http://pow.cx
      - ChickeNES 6y ago
        This attitude is the reason I refuse to use Chrome and only recommend the alternatives.
      - CydeWeys 6y ago
        Yes. Not nearly as many people were using .dev in local environments as you seem to think. We didn't know anyone, and by the very nature of them being fake and locally-configured-only it's not something you can easily find out about. And no, our intention was not to use .dev for fake domain names. Also, just because someone is using a fake domain doesn't preclude that from being created as a real domain name farther down the line. That's why you shouldn't use fake domain names. This problem has been known since at least the 90s and is not a good habit to get into. Them now being real makes them actually more useful (and not reliant on potentially unsynced local-only config).
  - ludamad 6y ago
    I don't think fresh launches, even with bold new parameters, are always considered 'huge changes' in that sense. The fact that it could break local environment's was probably not even documented in those specific environments
    - nitrogen 6y ago
      There was a time when the creation of a new TLD was unthinkable, so it seemed safe to use a domain syntax internally that was never going to become a public TLD. Then the TLD money grab happened and what was assumed to be safely isolated wilderness was sold out from under everyone.
      - CydeWeys 6y ago
        There never was such a time, and IANA never said "We won't make any more". TLDs have been continually created for at least the past two decades. Look up the history of e.g. .biz, .info, .museum, .aero, .mobi, .cat, .asia, all the various ccTLDs that are created as new countries form (.ss), etc. And none of that is even counting the new gTLD expansion round that kicked off in 2012.
- akritrime 6y ago
  How do we know you are the right horse? Sorry, just watched `/the social dilemma` and now I am skeptical of all information on the internet.
  - CydeWeys 6y ago
    If you give me your email I can send you a message from my _lastname_@ work address, which you can then match up with published media I've done under my name, e.g. https://www.youtube.com/watch?v=kBkX30Cj7Bw https://www.youtube.com/watch?v=kBkX30Cj7Bw and https://security.googleblog.com/2017/09/broadening-hsts-to-secure-more-of-web.html https://security.googleblog.com/2017/09/broadening-hsts-to-s... Or you can look at the matching username on GitHub ( https://github.com/CydeWeys https://github.com/CydeWeys ) and see that I'm a member of the Google org and owner of the Nomulus repo ( https://github.com/google/nomulus/graphs/contributors https://github.com/google/nomulus/graphs/contributors ), the software running our TLD registry and which was announced here: https://opensource.googleblog.com/2016/10/introducing-nomulus-open-source.html https://opensource.googleblog.com/2016/10/introducing-nomulu... Or I could just dig out my GPG key and sign a message. So I respect your healthy skepticism, but I promise I'm really me, and not just someone pretending to be me! And I'll also note that, in all my time on HN, I've never once seen someone pretending to be anyone they weren't, at least not on seasoned accounts like mine. You can go back through my 5 years of comments on here, and every time I say I'm a specific person out there in the real world, it's always the same consistent person.
    - akritrime 6y ago
      I actually confirmed your GitHub before I made the previous comment. It was just a frivolous reply that I found funny but HN didn't. Tough crowd. But I really, really appreciate your reply, thanks for taking your time to prove your identity. Hopefully I didn't waste too much of your Sunday morning.
      - CydeWeys 6y ago
        My experience here is that humor (especially deadpan) tends to land very poorly on HN, both because people are never contextually expecting it and because they tend to downvote it when they do recognize it, as they dislike perceived low effort comments that they don't feel are meaningfully contributing to the discussion (i.e. adding noise, not signal). HN may as well put "Don't try to be funny" in the FAQ, because it almost never works out.
- hmcamp 6y ago
  @Cydeweys, I respect this level of candidness

by owl57 6y ago

CydeWeys 6y ago

It was unintentional. Source: The horse's mouth. I'm the guy who came up with the idea of launching .dev and .app as HTTPS-only TLDs, and I'm the one who had them added to the HSTS preload list.

jbrooksuk 6y ago
Out of interest, how did this happen without any investigation into possible consequences etc? It’s a huge change that surely warranted special attention before making it happen?
- CydeWeys 6y ago
  It's not a huge change though. .dev was a new, never-launched TLD, so there were no existing real domain names to break with the addition of HSTS preloading. Established best practice for decades at that point was already to always use real domain names (or subdomains thereof) or specifically reserved test domains/TLDs (see RFC 2606, published in 1999) for testing/development/local networking purposes. So yes, we didn't anticipate how many people weren't following the best practices, but that would have been hard to determine prior to doing the thing anyway. There were also lots of people who had the mindset of "We won't change anything until it stops working", so in some sense a lot of it was unavoidable. See e.g.: https://github.com/laravel/valet/issues/204 https://github.com/laravel/valet/issues/204 https://github.com/laravel/valet/issues/294 https://github.com/laravel/valet/issues/294 https://github.com/laravel/valet/issues/431 https://github.com/laravel/valet/issues/431 (note that Laravel users were responsible for a non-trivial fraction of the total problems experienced, and that we only discovered all this post-HSTS-preloading). The problem was repeatedly pointed out and the maintainers refused to fix it until it actually broke. So, inevitably, it broke, and then they fixed it.
  - oauea 6y ago
    Were you somehow unaware of the many, many, many people who used .dev in their local environments? You must've had some idea, since the initial plan was to use the .dev TLD for exactly that within Google. I've always hated Google for egoistically claiming this tld, and ICANN for letting them.
    - evolve2k 6y ago
      Basecamp’s Pow project comes to mind. It enables zero config local development configuration, whereby at the time it would make your locally running dev server available on .dev So instead of having to spin up a local server and then visiting say 127.0.0.1:3000, I could instead just visit myappname.dev and it would show me what would previously show on localhost or it would spin up a server first for that app then show it to me. They switched to .test in response to google’s change. Official site: https://pow.cx https://pow.cx Thread on change from .dev to .test https://github.com/basecamp/pow/issues/386 https://github.com/basecamp/pow/issues/386
      - colejohnson66 6y ago
        I just got an “untrusted connection” warning visiting pow.cx
        evolve2k 6y ago
        Oh woops just habit to set https now. Page is from an earlier time when we didn’t mind static sites not being https. Visit http://pow.cx http://pow.cx
    - ChickeNES 6y ago
      This attitude is the reason I refuse to use Chrome and only recommend the alternatives.
    - CydeWeys 6y ago
      Yes. Not nearly as many people were using .dev in local environments as you seem to think. We didn't know anyone, and by the very nature of them being fake and locally-configured-only it's not something you can easily find out about. And no, our intention was not to use .dev for fake domain names. Also, just because someone is using a fake domain doesn't preclude that from being created as a real domain name farther down the line. That's why you shouldn't use fake domain names. This problem has been known since at least the 90s and is not a good habit to get into. Them now being real makes them actually more useful (and not reliant on potentially unsynced local-only config).
- ludamad 6y ago
  I don't think fresh launches, even with bold new parameters, are always considered 'huge changes' in that sense. The fact that it could break local environment's was probably not even documented in those specific environments
  - nitrogen 6y ago
    There was a time when the creation of a new TLD was unthinkable, so it seemed safe to use a domain syntax internally that was never going to become a public TLD. Then the TLD money grab happened and what was assumed to be safely isolated wilderness was sold out from under everyone.
    - CydeWeys 6y ago
      There never was such a time, and IANA never said "We won't make any more". TLDs have been continually created for at least the past two decades. Look up the history of e.g. .biz, .info, .museum, .aero, .mobi, .cat, .asia, all the various ccTLDs that are created as new countries form (.ss), etc. And none of that is even counting the new gTLD expansion round that kicked off in 2012.
akritrime 6y ago
How do we know you are the right horse? Sorry, just watched `/the social dilemma` and now I am skeptical of all information on the internet.
- CydeWeys 6y ago
  If you give me your email I can send you a message from my _lastname_@ work address, which you can then match up with published media I've done under my name, e.g. https://www.youtube.com/watch?v=kBkX30Cj7Bw https://www.youtube.com/watch?v=kBkX30Cj7Bw and https://security.googleblog.com/2017/09/broadening-hsts-to-secure-more-of-web.html https://security.googleblog.com/2017/09/broadening-hsts-to-s... Or you can look at the matching username on GitHub ( https://github.com/CydeWeys https://github.com/CydeWeys ) and see that I'm a member of the Google org and owner of the Nomulus repo ( https://github.com/google/nomulus/graphs/contributors https://github.com/google/nomulus/graphs/contributors ), the software running our TLD registry and which was announced here: https://opensource.googleblog.com/2016/10/introducing-nomulus-open-source.html https://opensource.googleblog.com/2016/10/introducing-nomulu... Or I could just dig out my GPG key and sign a message. So I respect your healthy skepticism, but I promise I'm really me, and not just someone pretending to be me! And I'll also note that, in all my time on HN, I've never once seen someone pretending to be anyone they weren't, at least not on seasoned accounts like mine. You can go back through my 5 years of comments on here, and every time I say I'm a specific person out there in the real world, it's always the same consistent person.
  - akritrime 6y ago
    I actually confirmed your GitHub before I made the previous comment. It was just a frivolous reply that I found funny but HN didn't. Tough crowd. But I really, really appreciate your reply, thanks for taking your time to prove your identity. Hopefully I didn't waste too much of your Sunday morning.
    - CydeWeys 6y ago
      My experience here is that humor (especially deadpan) tends to land very poorly on HN, both because people are never contextually expecting it and because they tend to downvote it when they do recognize it, as they dislike perceived low effort comments that they don't feel are meaningfully contributing to the discussion (i.e. adding noise, not signal). HN may as well put "Don't try to be funny" in the FAQ, because it almost never works out.
hmcamp 6y ago
@Cydeweys, I respect this level of candidness