3 ms·

We use chrome for internal apps. Forcing you to use 8.8.8.8 means our users have to remember ip addresses instead of http://nameofapplication/ http://nameofappl

by st0p 15y ago

We use chrome for internal apps. Forcing you to use 8.8.8.8 means our users have to remember ip addresses instead of http://nameofapplication/ http://nameofapplication/ Not a problem for me, but I'm sure a lot of people would complain.

justincormack 15y ago
Put your internal apps on real IP addresses with real DNS and just firewall them?
- st0p 15y ago
  So instead of having these machines in our serverroom inside our office, we'd have to pay for using them in a data center and register URL's, only because some ISP's use an insane way to handle NXDOMAIN? There are many valid reasons to "go into the cloud", but this is not one of them.
  - justincormack 15y ago
    You can assign real ip addresses to machines in your server room, give them dns, and firewall them externally. Just ask your isp for some addresses. There is no reason why this is any different from using nat in security, but you can use real dns. You can use ipv6 if you can't get ipv4 addresses.
    - jmathai 15y ago
      Or, the browser can just not default to name servers it deems best for everyone and work how it's always worked: well. This just seems like adding duck tape to a self-inflicted problem.
      - lmm 15y ago
        Non-publicly-routable addresses are a hack that will cause you nothing but trouble, and are going away with IPv6, so you might as well move away from them now. (Not that having chrome use 8.8.8.8 is a good idea either. As is often the case with hacks, either on its own works fine but the two interact poorly.)
        jmathai 15y ago
        Not sure I agree that non-publicly-routable addresses are a hack. The ability to run your own DNS server and having a firewall are pretty elegant components of most networks. That being said, it very well maybe time to find a better alternative :).
        lmm 15y ago
        Firewalls have their place but should not be conflated with routing; the two are separate, and treating them as the same can lead to confusion and broken security. As for DNS, it has a very elegant hierarchical delegation system, such that organizations can control their own while also ensuring that all the world's DNS servers give consistent answers (and if you need short names for your internal systems on your own network, that's what search paths are for).

by st0p 15y ago

justincormack 15y ago

Put your internal apps on real IP addresses with real DNS and just firewall them?

st0p 15y ago
So instead of having these machines in our serverroom inside our office, we'd have to pay for using them in a data center and register URL's, only because some ISP's use an insane way to handle NXDOMAIN? There are many valid reasons to "go into the cloud", but this is not one of them.
- justincormack 15y ago
  You can assign real ip addresses to machines in your server room, give them dns, and firewall them externally. Just ask your isp for some addresses. There is no reason why this is any different from using nat in security, but you can use real dns. You can use ipv6 if you can't get ipv4 addresses.
  - jmathai 15y ago
    Or, the browser can just not default to name servers it deems best for everyone and work how it's always worked: well. This just seems like adding duck tape to a self-inflicted problem.
    - lmm 15y ago
      Non-publicly-routable addresses are a hack that will cause you nothing but trouble, and are going away with IPv6, so you might as well move away from them now. (Not that having chrome use 8.8.8.8 is a good idea either. As is often the case with hacks, either on its own works fine but the two interact poorly.)
      - jmathai 15y ago
        Not sure I agree that non-publicly-routable addresses are a hack. The ability to run your own DNS server and having a firewall are pretty elegant components of most networks. That being said, it very well maybe time to find a better alternative :).
        lmm 15y ago
        Firewalls have their place but should not be conflated with routing; the two are separate, and treating them as the same can lead to confusion and broken security. As for DNS, it has a very elegant hierarchical delegation system, such that organizations can control their own while also ensuring that all the world's DNS servers give consistent answers (and if you need short names for your internal systems on your own network, that's what search paths are for).