6 ms·

.app, .dev, .prod, and .zip all had substantial volume of problematic traffic that was discovered during the Controlled Interruption period (which occurs prior

.app, .dev, .prod, and .zip all had substantial volume of problematic traffic that was discovered during the Controlled Interruption period (which occurs prior to launch and consists of a wildcard DNS entry placed on the entire TLD). You would not believe some of the brokenness that was happening there. .zip may need some explanation -- apparently there are lots of library API calls out there that take a path string as input and try to load it as either a local or remote file. You can see where this is going. https://www.icann.org/en/system/files/files/name-collision-framework-30jul14-en.pdf https://www.icann.org/en/system/files/files/name-collision-f...

monadic2 6y ago
Ruby's `open` accepts urls. I can't say I've ever used this functionality.
- dogma1138 6y ago
  Ask your red team about that ;)
- diamondo25 6y ago
  PHP's file_get_contents supports it as well.
- cyberbanjo 6y ago
  Clojure a slurp too.. never been bitten, I thought it was useful.
- ben0x539 6y ago
  I've only ever used it for that! For files there's `File.open`! ;)
- abiogenesis 6y ago
  I don't know Ruby enough to comment on that but I would guess it requires a scheme as well.
giantrobot 6y ago
I've personally run into the .zip problem thanks to browser's omni address/search/chocolate bars. I intend to search for a zip file whose name I know but the browser "helpfully" realizes the term includes no spaces and ends in dotsomething and attempts to treat it as a URL. A simple workaround is to add a preceding space or something like inurl: but that's isn't an automatic behavior so whoever owns mlpdwarfporn.zip is getting a lot of unintentional hits.
- jdxcode 6y ago
  if we could go back I wonder if it would be better if we had required a leading dot in domain names ".google.com"
  - giantrobot 6y ago
    I think that ends up as user unfriendly as requiring the dot after the TLD. I don't read up on all the gTLDs so I didn't realize zip was one for the longest time. I think ICANN just went nuts with TLDs, especially ones like .app and .zip that have long-standing associations with ubiquitous file extensions. That combined with the "smart bar" just leads to trouble.
  - Ekaros 6y ago
    Or if browsers weren't trying to be too smart enough and use the same box for both searching and addresses. Trips me with .py files all time time.
    - BiteCode_dev 6y ago
      After ".py", use " ?" (the space is important) to force the search in firefox.
      - oauea 6y ago
        Or just start the query with `?` Typing `?bla.py` in the omnibar will perform a search for `bla.py` on both Firefox and Chrome
captn3m0 6y ago
ICANN should never have assigned .zip, there's just too much potential for abuse, confusion giving away a common extension as a TLD.
- jedberg 6y ago
  But it made them so much money!!
- CydeWeys 6y ago
  There's a lot of overlap between file extensions and TLDs though. .py, .sh, and .app are some more examples (but a fully exhaustive list would be in the dozens if not hundreds). At some point you have to just treat them as the separate namespaces that they actually are (and not somehow try to block a TLD from being used as a file extension, or vice-versa). Besides, accidentally resolving a file extension to a TLD is only one of many possible different serious errors that can result from exposing an API that can load files locally or remotely, and thus make network calls that you might not be expecting. Fundamentally you need to fix that API either way.
  - schwartzworld 6y ago
    not to mention .com
    - CydeWeys 6y ago
      Geez, that's by far the best example and it didn't even occur to me. And it's an executable file type. Good call.
- johnzim 6y ago
  We just never should have allowed filename extensions to have semantic power. Resource forks are far more elegant and you could do simple look ahead checks to verify types etc.
  - bigiain 6y ago
miki123211 6y ago
My college's online system for everything is called edukacja.cl. A lot of people type that into the address bar, expecting to be redirected to the login page. Fortunately, the person who bought that domain didn't misuse it. I can imagine someone putting a fake login page there, and getting access to a lot of sensitive student details.

monadic2 6y ago

Ruby's `open` accepts urls. I can't say I've ever used this functionality.

dogma1138 6y ago
Ask your red team about that ;)
diamondo25 6y ago
PHP's file_get_contents supports it as well.
cyberbanjo 6y ago
Clojure a slurp too.. never been bitten, I thought it was useful.
ben0x539 6y ago
I've only ever used it for that! For files there's `File.open`! ;)
abiogenesis 6y ago
I don't know Ruby enough to comment on that but I would guess it requires a scheme as well.

giantrobot 6y ago

I've personally run into the .zip problem thanks to browser's omni address/search/chocolate bars. I intend to search for a zip file whose name I know but the browser "helpfully" realizes the term includes no spaces and ends in dotsomething and attempts to treat it as a URL. A simple workaround is to add a preceding space or something like inurl: but that's isn't an automatic behavior so whoever owns mlpdwarfporn.zip is getting a lot of unintentional hits.

jdxcode 6y ago
if we could go back I wonder if it would be better if we had required a leading dot in domain names ".google.com"
- giantrobot 6y ago
  I think that ends up as user unfriendly as requiring the dot after the TLD. I don't read up on all the gTLDs so I didn't realize zip was one for the longest time. I think ICANN just went nuts with TLDs, especially ones like .app and .zip that have long-standing associations with ubiquitous file extensions. That combined with the "smart bar" just leads to trouble.
- Ekaros 6y ago
  Or if browsers weren't trying to be too smart enough and use the same box for both searching and addresses. Trips me with .py files all time time.
  - BiteCode_dev 6y ago
    After ".py", use " ?" (the space is important) to force the search in firefox.
    - oauea 6y ago
      Or just start the query with `?` Typing `?bla.py` in the omnibar will perform a search for `bla.py` on both Firefox and Chrome

captn3m0 6y ago

ICANN should never have assigned .zip, there's just too much potential for abuse, confusion giving away a common extension as a TLD.

jedberg 6y ago
But it made them so much money!!
CydeWeys 6y ago
There's a lot of overlap between file extensions and TLDs though. .py, .sh, and .app are some more examples (but a fully exhaustive list would be in the dozens if not hundreds). At some point you have to just treat them as the separate namespaces that they actually are (and not somehow try to block a TLD from being used as a file extension, or vice-versa). Besides, accidentally resolving a file extension to a TLD is only one of many possible different serious errors that can result from exposing an API that can load files locally or remotely, and thus make network calls that you might not be expecting. Fundamentally you need to fix that API either way.
- schwartzworld 6y ago
  not to mention .com
  - CydeWeys 6y ago
    Geez, that's by far the best example and it didn't even occur to me. And it's an executable file type. Good call.
johnzim 6y ago
We just never should have allowed filename extensions to have semantic power. Resource forks are far more elegant and you could do simple look ahead checks to verify types etc.
- bigiain 6y ago

miki123211 6y ago

My college's online system for everything is called edukacja.cl. A lot of people type that into the address bar, expecting to be redirected to the login page. Fortunately, the person who bought that domain didn't misuse it. I can imagine someone putting a fake login page there, and getting access to a lot of sensitive student details.