3 ms·
I think CNAME redirections being not supported is reasonable choice. Would make my life easier as well but it opens all kinds of bad possibilities that bad acto
by ozim 7mo ago
I think CNAME redirections being not supported is reasonable choice. Would make my life easier as well but it opens all kinds of bad possibilities that bad actors would definitely use.
- dwedge 7mo agoCan you give me an example where this is a problem? If someone can create a CNAME they can create a TXT (ignoring the possibility of an API being restricted to just one). Without CNAME redirect I wouldn't be able to automatically renew wildcard ssl for client domains with dns that has no API. Even if they do have an API, doing it this way stops me from needing to deal with two different APIs
- rdevilla 7mo agoGP comment is just vague distilled model AI slop.
- ozim 7mo agoI don’t need a crutch I am perfectly capable of writing vague slop on my own thank you.
- ozim 7mo agoPeople forget configurations and CNAME can be left when domain it was pointing to changes owner. Then someone unauthorized can make certs for not his domain.
- dwedge 7mo agoOk I asked for an example and you provided one, that's fair. It also makes the second domain a target. I had someone issue a cert on one of my subdomains because I forgot to remove DNS after cancelling a VPS, and the VPS provider didn't remove the reverse DNS so they found it. Small attack, but it happened.