5 ms·
"We'll build our own validation instead of using one of the existing standards that make perfect sense." is not just "a single bug". It's a flaw in architecture
by bisby 3y ago
"We'll build our own validation instead of using one of the existing standards that make perfect sense." is not just "a single bug". It's a flaw in architecture.
A PR of "Change external domain validation to use .well-known (or DNS01, etc)" is not a "bugfix"
- mtae 3y agookay so clearly you don't know what you're talking about because they do use existing standards/DNS as the primary way to validate domain ownership. It's free to not say anything and read the comments first before going off about something!
- i_am_jl 3y ago>okay so clearly you don't know what you're talking about because they do use existing standards/DNS as the primary way to validate domain ownership. I'm not going to speak for the commenter you're replying to, but I don't think anyone here is talking about the standards-compliant, DNS-based domain verification system. I think we're all talking about the non-standards-compliant, /xrpc/-path verification.
- account42 3y agoWith any kind of authentication when you have an insecure method it does not mather whether you also have a more secure method - your authentication is only as good as the weakest alternative.