6 ms·

> Please also reserve 'lan' since so many of us running from .local which Apple decided to takeover screwed over. It is the IETF that instructed/approved IANA

> Please also reserve 'lan' since so many of us running from .local which Apple decided to takeover screwed over. It is the IETF that instructed/approved IANA to reserve .local: * https://datatracker.ietf.org/doc/html/rfc6761 https://datatracker.ietf.org/doc/html/rfc6761 * https://datatracker.ietf.org/doc/html/rfc6762 https://datatracker.ietf.org/doc/html/rfc6762 * https://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml https://www.iana.org/assignments/special-use-domain-names/sp... Registering your own domain can cost as little as US$20/year: if you don't want conflicts get one and stop kludging together solutions.

teaearlgraycold 3y ago
Domains can be far less than $20/year
AnthonyMouse 3y ago
> Registering your own domain can cost as little as US$20/year: if you don't want conflicts get one and stop kludging together solutions. That's how you get conflicts. Somebody forgets to renew the domain or thinks there's nothing there because it doesn't resolve from the public internet and now you've got a conflict with the squatter who registers it 17 seconds later and/or whoever they sell it to. This also works poorly for small and medium organizations where the cost isn't the price, it's the paperwork. They can be small enough to care about money but large enough to require purchasing approval, and then the IT person is going to make up an internal name rather than engage the bureaucracy to buy one. And since that's going to happen anyway there might as well be a standard way to support it.
- throw0101d 3y ago
  > That's how you get conflicts. No, it is how to avoid conflicts: by publicly claiming a namespace. > Somebody forgets to renew the domain or thinks there's nothing there because it doesn't resolve from the public internet and now you've got a conflict with the squatter who registers it 17 seconds later and/or whoever they sell it to. So you have the option of: theoretically losing the name space and causing conflicts because of incompetence, or the guaranteed chance of strange behaviour due to incompetence of choosing a kludgey solution. > This also works poorly for small and medium organizations […] But even an organization of a modicum of size needs to register a domain for being able to use e-mail. Maybe if you're a sole proprietor you'll use your gmail.com or outlook.com address for business, but once you have even a handful of employees you'll want to give each of them a 'business e-mail' at your company's name. And once you have a company-name e-mail domain/address congratulations, you can now use the same domain for IT namespacing purposes. And if you forget to renew you have larger problems than potentially broken internal/IT DNS: someone else changes the MX records and your company's e-mail is sent somewhere else, and you can't send out.
  - AnthonyMouse 3y ago
    > No, it is how to avoid conflicts: by publicly claiming a namespace. Which is what this is doing, by publicly claiming a namespace for anyone's internal use. Since it's internal use and there is no public use, there can't be a public conflict. > theoretically losing the name space and causing conflicts because of incompetence This is not theoretical. It's a major part of the squatter's business model. People don't renew their domains and then get extorted to buy them back. Happens all the time, and is significantly more likely to happen for an internal domain that has no DNS records with the registrar and doesn't appear to be in use. > But even an organization of a modicum of size needs to register a domain for being able to use e-mail. Which will be a different domain, often administered by different people, because it's being used for the company's public infrastructure rather than its internal network.
    - throw0101d 3y ago
      > Which will be a different domain, often administered by different people, because it's being used for the company's public infrastructure rather than its internal network. Wat? I've worked at 3-IT-person academic departments, 30-person start-ups, and 3000-person publicly traded corporations, and I've always seen the same domain used internally and externally. The only exception is where I'm currently at, where the dumbasses who were here previously (and set things up initially) decided to use .local—instead of the sane thing, which would have been to peal off a sub-domain of the public domain we already have. I'd like to know which illegal substance they were using when that decision was made.
      - AnthonyMouse 3y ago
        It's common for the people administering a company's public website and mail servers to be different people than the ones administering desktops and printers and Active Directory. And the last of those is a major contributor to this since it wants to take over the domain it's on. You can solve this by delegating a subdomain to it, but now your internal use domain is longer, and there are security implications to this because now unrelated internal systems may e.g. have access to cookies set for the public website. Or have the ability to issue dynamic DNS updates, so an attacker who compromises a random low-level internal system can point a name inside the company's public domain to their own servers and even potentially have a TLS certificate issued to it via ACME, even if the public infrastructure hasn't been compromised.
- iscoelho 3y ago
  I would argue that this shows weaponized incompetence from IT and is indicative of larger organizational issues.
  - AnthonyMouse 3y ago
    Designing systems that only work for organizations that are competent and efficient is going to develop a conflict with reality.
    - iscoelho 3y ago
      If you can't trust a team to set a calendar reminder / create a ticket to renew a domain once a year ... what exactly can you trust them with? The only excuse I would understand is turn-over. Otherwise, I would say that the organization in question has to get more comfortable with firing their employees.
      - AnthonyMouse 3y ago
        In general domains are set to auto-renew. The problem isn't remembering to do it. It's generally one of two things. First, the payment method on file with the registrar became invalid. Often because of turnover as you say -- the old IT manager's company credit card got turned off and the payment failed emails went to their email address, also turned off. Sometimes for other reasons, e.g. the credit card company changed the card number because of a data breach and then the non-payment notification got caught in a spam filter. Second, there's somebody whose job it is to check which of the company's 5000 domain names are still being used. They find one with no public DNS records, or old ones that point to nothing. They call up the web server team and the email team and ask what it is, they've never heard of it because it's not them using it. So they cancel the domain -- and the company doesn't even notice at first because the internal systems carry on using the name as ever, until somebody else registers it and starts using it.
        iscoelho 3y ago
        I understand why this is a common issue, but I also believe that this is indicative of organizational dysfunction. It takes a few seconds to document what a domain is used for / what department is using it. If you have 5,000 domains, you're already doing this. As well, at that scale you're likely using an enterprise domain registrar, so there is absolutely zero possibility of a domain expiring. (If you're not ... phew) Many other industries with zero tolerance for failure are able to successfully implement multi-layered approaches for anticipating and eliminating issues. Yet, IT manages to find excuses to explain why a $10 domain can't be reliably renewed. That's wild. That's embarrassing.
- zzyzxd 3y ago
  > Somebody forgets to renew the domain or thinks there's nothing there because it doesn't resolve from the public internet Not sure about others, but I am not gonna trust that person to manage my .local network regardless. > This also works poorly for small and medium organizations where the cost isn't the price, it's the paperwork. I had been in that position to chase an approval of $20 domain name purchase. Totally worth it. Much less headache than managing a bunch of made up domains and their weird internal name server configs.
  - AnthonyMouse 3y ago
    > Not sure about others, but I am not gonna trust that person to manage my .local network regardless. "Corporate bureaucracies are infallible" is an extremely unrealistic assumption. > Much less headache than managing a bunch of made up domains and their weird internal name server configs. How is an internal domain weirder to configure or less made up than a public one?
    - zzyzxd 3y ago
      I get what you are saying. But managing a .local domain is way harder to get right (Your internal CA, certificate house keeping on all kinds of devices and software running on them, your internal websites talking to an external IdP, VPN and DNS...). Especially when dealing with corporate bureaucracies -- If you don't have skilled engineers to manage .local, then just purchase a real domain and get public CA signed certificates. There will be fewer things that can go wrong.
denkmoon 3y ago
Why shouldn't we have a short TLD reserved for private use, non-delegated, for $0/year? .lan is short and convenient, there is no good case for using it in any other context. .lan is used defacto as a private TLD. ICANN should reflect this reality by codifying it in an RFC.

teaearlgraycold 3y ago

Domains can be far less than $20/year

AnthonyMouse 3y ago

> Registering your own domain can cost as little as US$20/year: if you don't want conflicts get one and stop kludging together solutions. That's how you get conflicts. Somebody forgets to renew the domain or thinks there's nothing there because it doesn't resolve from the public internet and now you've got a conflict with the squatter who registers it 17 seconds later and/or whoever they sell it to. This also works poorly for small and medium organizations where the cost isn't the price, it's the paperwork. They can be small enough to care about money but large enough to require purchasing approval, and then the IT person is going to make up an internal name rather than engage the bureaucracy to buy one. And since that's going to happen anyway there might as well be a standard way to support it.

throw0101d 3y ago
> That's how you get conflicts. No, it is how to avoid conflicts: by publicly claiming a namespace. > Somebody forgets to renew the domain or thinks there's nothing there because it doesn't resolve from the public internet and now you've got a conflict with the squatter who registers it 17 seconds later and/or whoever they sell it to. So you have the option of: theoretically losing the name space and causing conflicts because of incompetence, or the guaranteed chance of strange behaviour due to incompetence of choosing a kludgey solution. > This also works poorly for small and medium organizations […] But even an organization of a modicum of size needs to register a domain for being able to use e-mail. Maybe if you're a sole proprietor you'll use your gmail.com or outlook.com address for business, but once you have even a handful of employees you'll want to give each of them a 'business e-mail' at your company's name. And once you have a company-name e-mail domain/address congratulations, you can now use the same domain for IT namespacing purposes. And if you forget to renew you have larger problems than potentially broken internal/IT DNS: someone else changes the MX records and your company's e-mail is sent somewhere else, and you can't send out.
- AnthonyMouse 3y ago
  > No, it is how to avoid conflicts: by publicly claiming a namespace. Which is what this is doing, by publicly claiming a namespace for anyone's internal use. Since it's internal use and there is no public use, there can't be a public conflict. > theoretically losing the name space and causing conflicts because of incompetence This is not theoretical. It's a major part of the squatter's business model. People don't renew their domains and then get extorted to buy them back. Happens all the time, and is significantly more likely to happen for an internal domain that has no DNS records with the registrar and doesn't appear to be in use. > But even an organization of a modicum of size needs to register a domain for being able to use e-mail. Which will be a different domain, often administered by different people, because it's being used for the company's public infrastructure rather than its internal network.
  - throw0101d 3y ago
    > Which will be a different domain, often administered by different people, because it's being used for the company's public infrastructure rather than its internal network. Wat? I've worked at 3-IT-person academic departments, 30-person start-ups, and 3000-person publicly traded corporations, and I've always seen the same domain used internally and externally. The only exception is where I'm currently at, where the dumbasses who were here previously (and set things up initially) decided to use .local—instead of the sane thing, which would have been to peal off a sub-domain of the public domain we already have. I'd like to know which illegal substance they were using when that decision was made.
    - AnthonyMouse 3y ago
      It's common for the people administering a company's public website and mail servers to be different people than the ones administering desktops and printers and Active Directory. And the last of those is a major contributor to this since it wants to take over the domain it's on. You can solve this by delegating a subdomain to it, but now your internal use domain is longer, and there are security implications to this because now unrelated internal systems may e.g. have access to cookies set for the public website. Or have the ability to issue dynamic DNS updates, so an attacker who compromises a random low-level internal system can point a name inside the company's public domain to their own servers and even potentially have a TLS certificate issued to it via ACME, even if the public infrastructure hasn't been compromised.
iscoelho 3y ago
I would argue that this shows weaponized incompetence from IT and is indicative of larger organizational issues.
- AnthonyMouse 3y ago
  Designing systems that only work for organizations that are competent and efficient is going to develop a conflict with reality.
  - iscoelho 3y ago
    If you can't trust a team to set a calendar reminder / create a ticket to renew a domain once a year ... what exactly can you trust them with? The only excuse I would understand is turn-over. Otherwise, I would say that the organization in question has to get more comfortable with firing their employees.
    - AnthonyMouse 3y ago
      In general domains are set to auto-renew. The problem isn't remembering to do it. It's generally one of two things. First, the payment method on file with the registrar became invalid. Often because of turnover as you say -- the old IT manager's company credit card got turned off and the payment failed emails went to their email address, also turned off. Sometimes for other reasons, e.g. the credit card company changed the card number because of a data breach and then the non-payment notification got caught in a spam filter. Second, there's somebody whose job it is to check which of the company's 5000 domain names are still being used. They find one with no public DNS records, or old ones that point to nothing. They call up the web server team and the email team and ask what it is, they've never heard of it because it's not them using it. So they cancel the domain -- and the company doesn't even notice at first because the internal systems carry on using the name as ever, until somebody else registers it and starts using it.
      - iscoelho 3y ago
        I understand why this is a common issue, but I also believe that this is indicative of organizational dysfunction. It takes a few seconds to document what a domain is used for / what department is using it. If you have 5,000 domains, you're already doing this. As well, at that scale you're likely using an enterprise domain registrar, so there is absolutely zero possibility of a domain expiring. (If you're not ... phew) Many other industries with zero tolerance for failure are able to successfully implement multi-layered approaches for anticipating and eliminating issues. Yet, IT manages to find excuses to explain why a $10 domain can't be reliably renewed. That's wild. That's embarrassing.
zzyzxd 3y ago
> Somebody forgets to renew the domain or thinks there's nothing there because it doesn't resolve from the public internet Not sure about others, but I am not gonna trust that person to manage my .local network regardless. > This also works poorly for small and medium organizations where the cost isn't the price, it's the paperwork. I had been in that position to chase an approval of $20 domain name purchase. Totally worth it. Much less headache than managing a bunch of made up domains and their weird internal name server configs.
- AnthonyMouse 3y ago
  > Not sure about others, but I am not gonna trust that person to manage my .local network regardless. "Corporate bureaucracies are infallible" is an extremely unrealistic assumption. > Much less headache than managing a bunch of made up domains and their weird internal name server configs. How is an internal domain weirder to configure or less made up than a public one?
  - zzyzxd 3y ago
    I get what you are saying. But managing a .local domain is way harder to get right (Your internal CA, certificate house keeping on all kinds of devices and software running on them, your internal websites talking to an external IdP, VPN and DNS...). Especially when dealing with corporate bureaucracies -- If you don't have skilled engineers to manage .local, then just purchase a real domain and get public CA signed certificates. There will be fewer things that can go wrong.

denkmoon 3y ago

Why shouldn't we have a short TLD reserved for private use, non-delegated, for $0/year? .lan is short and convenient, there is no good case for using it in any other context. .lan is used defacto as a private TLD. ICANN should reflect this reality by codifying it in an RFC.