11 ms·
I'd need to self-sign my certificates, right? So any guests in my house (assuming a modern browser) would be presented with a big ugly security warning after na
by titanomachy 2y ago
I'd need to self-sign my certificates, right? So any guests in my house (assuming a modern browser) would be presented with a big ugly security warning after navigating to a local home.arpa site?
I pay $10/year for a custom domain on my country's TLD and host any local stuff on that, so I can use proper CA-signed certificates which are trusted by default. But I could see this being useful if I was only using my own clients.
- hackcasual 2y agoThere's a ton of gTLDs too, I just grabbed a cheap one and ACME-fied all my lan services
- titanomachy 2y agoAre there any that actually stay cheap, though? Any time I've bought one they've cranked the price after a year.
- deathanatos 2y ago… .net? (<$15/y for the registration.)
- throawayonthe 2y ago[dead]
- piperswe 2y agoThe following TLDs are $3.98/yr (not an initial discount, that's just the price) with Cloudflare Registrar according to https://old.reddit.com/r/webdev/comments/17lpxa6/cloudflare_domain_registrar_pricing_table/ https://old.reddit.com/r/webdev/comments/17lpxa6/cloudflare_...: - .bid - .download - .date - .loan - .men - .party - .stream - .trade - .win You could probably get away with using a few of these for a home network, though some would be kinda strange (.men? .loan?)
- Cyphase 2y agoLOcal Area Network? Low Orbit Area Network?
- dspillett 2y agoFor a small network; a router, a single server hosting stuff, an AP, and whatever wireless clients: Low On Actual Network.
- page_fault 2y agoIt's a lottery with these novelty TLDs. If you use them, setup your configuration such that you can move to another TLD easily. .nets and .coms increase in price too, but they don't tend to jump by 100% in a single year like these novelty ones, which were created purely to make money for the registry. e.g. https://tld-list.com/blog/tld-wholesale-price-increase-2023 https://tld-list.com/blog/tld-wholesale-price-increase-2023 TLD Old New Percent Date .reviews $17.00 $40.00 135.29% 2023-10-04 .furniture $38.00 $80.00 110.53% 2023-10-04 .faith $4.98 $9.98 100.40% 2023-09-04 .racing $4.98 $9.98 100.40% 2023-09-04 .review $4.98 $9.98 100.40% 2023-09-04 .science $4.98 $9.98 100.40% 2023-09-04
- davchana 2y agoNumerical 6 to 9 digit .xyz domains are 0.99 cents a year, $10 for 10 years.
- DavideNL 2y ago…or alternatively simply buy a domain for 5 or 10 years.
- Tepix 2y agoNot all TLDs will let you do that.
- venusenvy47 2y agoThat's what I did with a couple .uk domains from Cloudflare. I bought ten years at $4.30 per year so I don't have to worry about renewal price increases for a long time. I also liked that it was suck a short TLD and not from some sketchy country.
- justsomehnguy 2y ago> they've cranked the price after a year. Define 'cranked'. I spend way more in a bar in one night than on my domains yearly, so I always find 'oh I need one super-duper cheap, below $2/y otherwise it's way too much' comments a bit.. too frugal.
- titanomachy 2y agoIt’s more the principle of the thing… if I buy a domain for $3 and it’s $30 next year, I’m just going to switch my stuff over to .com or .net where the price is predictable.
- FinnKuhn 2y agoI also spend more in a bar in one night than on charging my phone for whole year. If the cost to charge it went up by 10x I would still be displeased though.
- justsomehnguy 2y ago> If the cost to charge it went up by 10x I would still be displeased though. Sure anyone would be, but... maybe don't choose .furniture[0] as the TLD for your own small private LAN DNS and don't have the unpleasant surprises? The prices for the registrations (and renew) are going up steadily (just like everything else? inflation is a thing), but there is always an option to get the information about the renewal price upfront and maybe even use the multi-year sale. Just looked in Dynadot's CSV, there are ~100 TLDs with sub $10 renewals and additional ~100 with < $15. Also dug my records[1], privacy is baked in now, so the total effective rise is $1 for `.one` and... -$2 for `.com`. [0] https://news.ycombinator.com/item?id=40571805 https://news.ycombinator.com/item?id=40571805 [1] date created: 2015/08/20 <placeholder>.com - domain renewal 1 year ($10.99) <placeholder>.com - domain privacy 1 year ($3.00) PAYMENT final cost: $13.99 date created: 2016/07/21 <placeholder>.one - domain renewal 1 year ($10.99) <placeholder>.one - domain privacy 1 year ($3.00) PAYMENT final cost: $13.99 Date created: 2023/09/08 <placeholder>.com - Domain Renewal 1 year ($11.99) $11.99 Date created: 2023/10/16 <placeholder>.one - Domain Renewal 1 year ($14.99) $14.99
- jimbobthrowawy 2y agoI did this for a while back when freenom existed. Then, I moved and learned that I was exceptionally lucky to have working loopback NAT in my previous house, and would have to split off a local.<domain> entry for clients on the internal network. No idea why most ISPs don't have routers that work like that. I haven't bothered doing DNS auth to get certs since I started using paid domains.
- boopdewoop 2y agoYou.BEAUTY - https://data.iana.org/TLD/tlds-alpha-by-domain.txt https://data.iana.org/TLD/tlds-alpha-by-domain.txt
- INTPenis 2y agoI use it for all my devices. But obviously if you want to host a service with TLS, even an internal one, use a real domain. .home.arpa is only the device hostname, not the service name.
- 2Gkashmiri 2y agoi still dont understand why 192.168.20.1 should show as insecure. or abc.local that points to 192.168.0.22. why should i need a certficate for that and what "security" is there to begin with? if a threat actor is in my lan, what hope do i have of https?
- batch12 2y agoTwo security concepts come to mind: defense in depth and assume breach. A hacked device on your lan doesnt have to equal complete compromise of your betwork. Giving up at the perimeter is one option, sure. Another is to design a network to be as resilient as possible to attack and compromise by layering defensive controls and assuming some can be bypassed. Then develop detective/preventative controls to respond when they are. Edit: specifically, encrypting http traffic will help reduce the risk of the threat actor acquiring new credentials (since we don't reuse those) and using them to pivot to other resources.
- klabb3 2y agoLet’s see.. I assume the warning serves two purposes: 1. You may be talking to someone other than you think. This only makes sense with registered domain names. 2. Your data can be eavesdropped or modified by someone in the middle. This would be quite rare within a LAN. Encryption itself might make sense sometimes but standard TLS is a really poor fit because there is no proper CA for the domain names. The main issue though is people don’t want IP addresses, they want names. If a special domain (like .home or .local) will only ever query local DNS servers returning local IP addrs, it would be roughly as safe as using IP addresses directly(?). In either case, when the user intentionally wants to speak over LAN (either IP or known home domain) the warning is unhelpful. For instance, configuring a router.
- 2Gkashmiri 2y agowhat about 12.0.0.1 cases?
- shawabawa3 2y ago> Your data can be eavesdropped or modified by someone in the middle. This would be quite rare within a LAN Literally every single public wifi network, which is a significant percentage of all internet traffic (including basically everyone working from a wework for example), is vulnerable to eavesdropping/mitm
- mminer237 2y agoCan't you just not use a certificate? It's not on the HSTS preload list.
- titanomachy 2y agoTrue, can host HTTP-only but that still surfaces a warning on modern browsers.
- mminer237 2y agoI get a small icon in the the URL bar indicating it, but nothing that the average person would even notice.