8 ms·

So You Want to Define a Well-Known URI

141 points by ingve 4mo ago

jvuygbbkuurx 4mo ago
Why are they so specific? Why password-reset instead of a more generic link tree? Why discord domain verification instead of domain-verifications with a dynamic list on entries? Seems like a waste of time. I would just define my own spec outside of well known for my use case.
- reddalo 4mo ago
  Your own spec wouldn't be used by anyone else. The password-reset well-known endpoint is used by password managers to show a "Change password..." button in their interface, which magically links to the password change page described in that well-known file.
  - jvuygbbkuurx 4mo ago
    If the website implements it. What about email preferences? Removing account links? There are many use-cases you might want to redirect a user to, but having to make their own well known for it seems dumb instead of using a more generic one. I guess the more flexible it is, the harder adoption becomes as the usage within a spec might diverge, or it grows outside of the spec and becomes unofficial. So maybe password-reset is correct level of specification. Anyway discord domain verification can tell in their onboarding docs to put it anywhere. It being well known does nothing. If there was a root level domain verification, then you might as well put it under that. But otherwise why go through a process?
    - notpushkin 4mo ago
      It’s just easier for everybody to implement. Password manager opens https://<some-website>/.well-known/change-password in the user’s browser, it gets redirected to the actual page where password change form is located. You could make the password manager look it up in a link tree and then open a correct page, yes, but... > I guess the more flexible it is, the harder adoption becomes Yeah. If there is one account management related URL that password managers care about, it’s the change password page. You don’t really need to change email on your account that often, but it is probably a good idea to rotate your password once in a while. So I guess it’s a good idea to make it as easy as possible to adopt – which means just a single URL redirecting to another. > If the website implements it. That’s a good catch, though. I guess right now password managers would still have to make a “preflight” request just to see if /.well-known/change-password is implemented before showing it to the user. (But that can go away if most websites adopt it.)
      - masklinn 4mo ago
        > That’s a good catch, though. I guess right now password managers would still have to make a “preflight” request just to see if /.well-known/change-password is implemented before showing it to the user. (But that can go away if most websites adopt it.) It’s not really a catch? Like robots.txt it’s just something you probe if you have the capabilities to use it. You can just cache the info afterwards.
      - jnewton_dev 4mo ago
        [dead]
- arcfour 4mo ago
  > Why discord domain verification instead of domain-verifications with a dynamic list on entries? The TXT record itself is already a dynamic list of entries. It's far simpler and easier to iterate through the list and compare the start of each value with your search string until you find "discord domain verification" directly than it would be to do anything else. Example: ;; ANSWER SECTION: ycombinator.com. 300 IN TXT "openai-domain-verification=dv-QbhxxK0G0JK0dnyZ4YTsNAfw" ycombinator.com. 300 IN TXT "v=spf1 include:_spf.google.com include:mailgun.org a:rsweb1-36.investorflow.com include:_spf.createsend.com include:servers.mcsv.net -all" ycombinator.com. 300 IN TXT "MS=ms37374900" ycombinator.com. 300 IN TXT "anthropic-domain-verification-0qe2ww=yK576oHdDgyTcXgkPfj1KXgGt" ycombinator.com. 300 IN TXT "ZOOM_verify_2ndw8KZxSRa8PT8NmdyXvw" ycombinator.com. 300 IN TXT "google-site-verification=KsI69Y_jEVkp4eXqSQ9R9gwxjIpZznvuvrus6UolB9Y" ycombinator.com. 300 IN TXT "ca3-4861b957e83847c188e45d04ec314ee3" ycombinator.com. 300 IN TXT "apple-domain-verification=WG0sP5Alm7N6h1Te" ycombinator.com. 300 IN TXT "dropbox-domain-verification=asc63coma4mv" ycombinator.com. 300 IN TXT "google-site-verification=GJKdQskycEclAGPua3yXB9m_nVhxbrsVps_y-t9SXV0" ycombinator.com. 300 IN TXT "Wayback verify for support request 741082" ycombinator.com. 300 IN TXT "google-site-verification=rivq8jKu6AADGtbbEzJhmOpcqq08B7QxIzXxYV8DtyU" ycombinator.com. 300 IN TXT "rippling-domain-verification=a660f7a4ab77a3de"
  - sandblast 4mo ago
    "Domain-verifications" is an invitation for everyone else that might need it to use the same standard and convention. "Discord-domain-verification" is not, it's what feels like polluting the global namespace with the company name that might cease to exist in a few years. At the very least, it should be "domain-verification-discord", "-google" and so on. Maybe even "-com.discord", "-com.google"? And the first part clearly standardized and registered, instead of one entity using "domain" and another one "site".
    - arcfour 4mo ago
- notpushkin 4mo ago
  > discord domain verification That’s on Discord. They’re not in the registry: https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml https://www.iana.org/assignments/well-known-uris/well-known-... > Why password-reset instead of a more generic link tree? [edit: answered in more detail in a sibling thread https://news.ycombinator.com/item?id=48596286 https://news.ycombinator.com/item?id=48596286]
reddalo 4mo ago
I wish people would follow this, instead of coming up with new standards in the root namespace. "llms.txt" [1] comes to mind, for example. Let's stop polluting the root of a domain! [1] https://llmstxt.org/ https://llmstxt.org/
- rickette 4mo ago
  LLMs.txt is also nonsense since it isn't adopted by any of the major AI players.
  - networked 4mo ago
    Google has recently added `llms.txt` to Chrome's Lighthouse check for agentic browsing (https://searchengineland.com/google-llms-txt-chrome-lighthouse-478246 https://searchengineland.com/google-llms-txt-chrome-lighthou...), so adoption may be coming. Admittedly, I put more faith in <link rel="alternate" type="text/markdown" href="https://example.com/foo.md" title="Markdown version of the <Foo> page"> that I copied from Gwern.net. This convention is discoverable (just read the HTML) and naturally adapts to any website size and structure. I have created an `llms.txt` for my website anyhow. I use a fixed LLM prompt to generate it from the internal links in `index.md`.
    - iamacyborg 4mo ago
      Giving a markdown version of a page seems like an interesting choice instead of just embedding a schema marked up one
      - vidarh 4mo ago
        Every page on code.claude.com has a markdown version available by just appending ".md", and Claude Code knows about it. E.g: https://code.claude.com/docs/en/overview https://code.claude.com/docs/en/overview and https://code.claude.com/docs/en/overview.md https://code.claude.com/docs/en/overview.md
        deleted 4mo ago
einpoklum 4mo ago
How well-known are those URIs though? :-\
- timwis 4mo ago
  I agree. I was hoping for a few positive examples, but didn't see any. The only one I know of is the OIDC discovery endpoint.
  - asdfasdfadsfs 4mo ago
    I would say acme-challenge is one of the most used ones. How else would one get SSL certificates today
    - echoangle 4mo ago
      DNS TXT challenge for example. Also better because you can get wildcard certs.
      - sureglymop 4mo ago
        Also, DNS-PERSIST-01 seems to be coming soon for Let's Encrypt, which should allow even people that can't easily dynamically update their DNS records to get wildcard certs. I assume this might become more widely used than HTTP-01 challenges.
        inigyou 4mo ago
        I wish someone would write a blog post about the difference between DNS registrars and DNS hosts, because I've seen people assume they need to use a registrar that has an API in order to change their DNS records programmatically. I used to assume that too.
        Natfan 4mo ago
        - registrars control NS records, however these can be changed - NS records control other records - registrars can also use their own nameservers to manage your DNS
sandblast 4mo ago
No, in fact I don't. But this post wouldn't be of any help anyway. It feels like it's about nothing, there is no substance, just stating some obvious facts. Without examples that lead to some real recommendations, this whole expertise claimed by the author is of no use.
- wseqyrku 4mo ago
  The point of the post was that you need to add robots.txt (or similar) because it's a thing, and also tell us where they are.
  - Geezus_42 4mo ago
    > add a robots.txt Which bots will then ignore.
    - Ferret7446 4mo ago
      I didn't expect I'd get to use this so soon. Obligatory canned advisory: https://www.felesatra.moe/blog/2026/06/19/robots https://www.felesatra.moe/blog/2026/06/19/robots
      - Geezus_42 4mo ago
        They still ignore it and scan everything even though you have told them not to scan certain paths.
- amiga386 4mo ago
  > expertise claimed by the author The author is on record as trying to remove HTTP 418 "I'm a teapot" support from NodeJS, which resulted in backlash and Python adding support for it. https://en.wikipedia.org/wiki/Hyper_Text_Coffee_Pot_Control_Protocol#Save_418_movement https://en.wikipedia.org/wiki/Hyper_Text_Coffee_Pot_Control_...
  - AlienRobot 4mo ago
philipwhiuk 4mo ago
I'm not sure I like `https://domain.com/.well-known/robots.txt https://domain.com/.well-known/robots.txt` any better frankly
- russellbeattie 4mo ago
  Whoever decided it would be a good idea for ".well-known" to be a "hidden" directory is a complete fool. All it does is provide the opportunity for confusion, misconfiguration, skipped backups, missed git check-ins, forgotten updates and more. Literally the only people a folder like that is hidden from is the whoever is managing the web server. Sure, if everyone knows what they're doing, it's not a problem. But we all know how long that assumption lasts.
  - zamadatix 4mo ago
    I think the blog author is the one who wrote the original RFC. To be fair to him, there once was a time web servers were more commonly thought of as truly being remote directories of files you can view or link to, not just domains the browser hides the rest of, and dotfiles would commonly act like dotfiles in local file listings. Nowadays, the assumption is if you go to the base URL it should only ever serve the default page and if you try to go to a directory it should throw an error. Well, unless you're one of those ancient sites like https://ftp.mozilla.org/ https://ftp.mozilla.org/ I'm not saying it's good or bad how things turned it, but the choice of a dotfile for this sure did not pan out well as the web went the exact opposite direction it would have been relevant in.
  - 9dev 4mo ago
    The main point of consideration here probably was how to avoid conflicts with URLs of existing sites, not exactly people who aren't able to serve an endpoint with a dot within its path...
  - marcosdumay 4mo ago
    TBF, those people are already hit with problems on their apache configuration and fixed their tooling long before the lack of .well-known gives them any problem.
creatorpilot 4mo ago
[flagged]
jiggunjer 4mo ago
Title says uri but post only about urls, a type of uri
user3939382 4mo ago
I wish we had one for navigation layout of a site so browser chrome could render that in a consistent way. It would also be a boon for a11y.
momoraul 4mo ago
.well-known started tidy and quietly became the junk drawer of the web root. security.txt, ACME, app-site-association, and counting.
- delichon 4mo ago
  A junk drawer is an improvement over scattered junk.
  - chrisweekly 4mo ago
    exactly! in fact, that's most of the whole point of .well-known!
- marcosdumay 4mo ago
  What do you mean? It was explicitly designed to be a junk drawer.
  - ape4 4mo ago
    Why not call it .junk-drawer instead ;)
    - marcosdumay 4mo ago
      Well, it does live space for other drawers for other kinds of junk. This one is just for junk you already know it will be there.
  - momoraul 4mo ago
    Fair, the drawer's the good part. Beats having every spec squat its own root path.
- inigyou 4mo ago
  Isn't that the point though? Keeping all the junk in a drawer labeled as junk, instead of keeping it on the kitchen counter?
1vuio0pswjnm7 4mo ago
"This Web site requires a more modern browser to operate securely; please upgrade your browser." Alternative, no SNI required https://web.archive.org/web/20260619061625if_/https://mnot.net/blog/2026/well_known_uris https://web.archive.org/web/20260619061625if_/https://mnot.n...
- xyzzy_plugh 4mo ago
  SNI is good, though? I'm curious how you are running into this.
  - quotemstr 4mo ago
    Perhaps he's trying to drive adoption of ECH. SNI is better than nothing, but it leaves the name of the destination domain in plaintext.
- deleted 4mo ago
  [deleted]
- 1vuio0pswjnm7 4mo ago
  If one is conducting surveillance and/or censorship of www users, SNI is not good It's great
- 1vuio0pswjnm7 4mo ago
  Internet Draft: ECH Considered Harmful https://www.ietf.org/archive/id/draft-stein-tls-ech-considered-harmful-00.html https://www.ietf.org/archive/id/draft-stein-tls-ech-consider...
inigyou 4mo ago
The consideration about having more than one of them on a domain seems like something that's often overlooked.
welder 4mo ago
Does a change-password registry actually get used, even by bots? I don't see bots checking for a .well-known/change-password url on my sites. It seems a good place to put public configs, just to have a place for them, but not as a means of discovery.
- ameliaquining 4mo ago
  Some password managers, such as Chrome's, offer a "change password" button in the UI that informs the user if their password has been compromised. This is based on .well-known/change-password.
quotemstr 4mo ago
One disappointment you can't help but feel, having worked in technology a while, is about how people solve the same problems over and over in redundant and subtly incompatible ways. How do you associate metadata with a public name? A SRV record! No, a TXT record! No, a meta tag! No, data attributes! No, an X.509 attribute! No, a random file at top level! No, a well known file under some schema! No, ... It goes on forever. We're left with a mishmash of mechanisms and lowest common denominator support for them all. It would be nice if we picked an extension mechanism and maximally enhanced it rather than having everyone invent his own
devdoshi 4mo ago
I do think it is important to have autonomous discoverability with domain-anchored trust, whether through .well-known or DNS records or DNS over HTTP. It looks like cloudflare has already added a bunch of observability into their products around this area, and I am investigating too [1]. It seems like the number of services needing these, and the amount needed per org should both go up with more agentic use cases. I believe auth.md is also a recent example that uses .well-known [1] https://instagrate-me.sudoscience.dev/ https://instagrate-me.sudoscience.dev/

141 points by ingve 4mo ago

Why are they so specific? Why password-reset instead of a more generic link tree? Why discord domain verification instead of domain-verifications with a dynamic list on entries? Seems like a waste of time. I would just define my own spec outside of well known for my use case.

reddalo 4mo ago
Your own spec wouldn't be used by anyone else. The password-reset well-known endpoint is used by password managers to show a "Change password..." button in their interface, which magically links to the password change page described in that well-known file.
- jvuygbbkuurx 4mo ago
  If the website implements it. What about email preferences? Removing account links? There are many use-cases you might want to redirect a user to, but having to make their own well known for it seems dumb instead of using a more generic one. I guess the more flexible it is, the harder adoption becomes as the usage within a spec might diverge, or it grows outside of the spec and becomes unofficial. So maybe password-reset is correct level of specification. Anyway discord domain verification can tell in their onboarding docs to put it anywhere. It being well known does nothing. If there was a root level domain verification, then you might as well put it under that. But otherwise why go through a process?
  - notpushkin 4mo ago
    It’s just easier for everybody to implement. Password manager opens https://<some-website>/.well-known/change-password in the user’s browser, it gets redirected to the actual page where password change form is located. You could make the password manager look it up in a link tree and then open a correct page, yes, but... > I guess the more flexible it is, the harder adoption becomes Yeah. If there is one account management related URL that password managers care about, it’s the change password page. You don’t really need to change email on your account that often, but it is probably a good idea to rotate your password once in a while. So I guess it’s a good idea to make it as easy as possible to adopt – which means just a single URL redirecting to another. > If the website implements it. That’s a good catch, though. I guess right now password managers would still have to make a “preflight” request just to see if /.well-known/change-password is implemented before showing it to the user. (But that can go away if most websites adopt it.)
    - masklinn 4mo ago
      > That’s a good catch, though. I guess right now password managers would still have to make a “preflight” request just to see if /.well-known/change-password is implemented before showing it to the user. (But that can go away if most websites adopt it.) It’s not really a catch? Like robots.txt it’s just something you probe if you have the capabilities to use it. You can just cache the info afterwards.
    - jnewton_dev 4mo ago
      [dead]
arcfour 4mo ago
> Why discord domain verification instead of domain-verifications with a dynamic list on entries? The TXT record itself is already a dynamic list of entries. It's far simpler and easier to iterate through the list and compare the start of each value with your search string until you find "discord domain verification" directly than it would be to do anything else. Example: ;; ANSWER SECTION: ycombinator.com. 300 IN TXT "openai-domain-verification=dv-QbhxxK0G0JK0dnyZ4YTsNAfw" ycombinator.com. 300 IN TXT "v=spf1 include:_spf.google.com include:mailgun.org a:rsweb1-36.investorflow.com include:_spf.createsend.com include:servers.mcsv.net -all" ycombinator.com. 300 IN TXT "MS=ms37374900" ycombinator.com. 300 IN TXT "anthropic-domain-verification-0qe2ww=yK576oHdDgyTcXgkPfj1KXgGt" ycombinator.com. 300 IN TXT "ZOOM_verify_2ndw8KZxSRa8PT8NmdyXvw" ycombinator.com. 300 IN TXT "google-site-verification=KsI69Y_jEVkp4eXqSQ9R9gwxjIpZznvuvrus6UolB9Y" ycombinator.com. 300 IN TXT "ca3-4861b957e83847c188e45d04ec314ee3" ycombinator.com. 300 IN TXT "apple-domain-verification=WG0sP5Alm7N6h1Te" ycombinator.com. 300 IN TXT "dropbox-domain-verification=asc63coma4mv" ycombinator.com. 300 IN TXT "google-site-verification=GJKdQskycEclAGPua3yXB9m_nVhxbrsVps_y-t9SXV0" ycombinator.com. 300 IN TXT "Wayback verify for support request 741082" ycombinator.com. 300 IN TXT "google-site-verification=rivq8jKu6AADGtbbEzJhmOpcqq08B7QxIzXxYV8DtyU" ycombinator.com. 300 IN TXT "rippling-domain-verification=a660f7a4ab77a3de"
- sandblast 4mo ago
  "Domain-verifications" is an invitation for everyone else that might need it to use the same standard and convention. "Discord-domain-verification" is not, it's what feels like polluting the global namespace with the company name that might cease to exist in a few years. At the very least, it should be "domain-verification-discord", "-google" and so on. Maybe even "-com.discord", "-com.google"? And the first part clearly standardized and registered, instead of one entity using "domain" and another one "site".
  - arcfour 4mo ago
notpushkin 4mo ago
> discord domain verification That’s on Discord. They’re not in the registry: https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml https://www.iana.org/assignments/well-known-uris/well-known-... > Why password-reset instead of a more generic link tree? [edit: answered in more detail in a sibling thread https://news.ycombinator.com/item?id=48596286 https://news.ycombinator.com/item?id=48596286]

reddalo 4mo ago

I wish people would follow this, instead of coming up with new standards in the root namespace. "llms.txt" [1] comes to mind, for example. Let's stop polluting the root of a domain! [1] https://llmstxt.org/ https://llmstxt.org/

rickette 4mo ago
LLMs.txt is also nonsense since it isn't adopted by any of the major AI players.
- networked 4mo ago
  Google has recently added `llms.txt` to Chrome's Lighthouse check for agentic browsing (https://searchengineland.com/google-llms-txt-chrome-lighthouse-478246 https://searchengineland.com/google-llms-txt-chrome-lighthou...), so adoption may be coming. Admittedly, I put more faith in <link rel="alternate" type="text/markdown" href="https://example.com/foo.md" title="Markdown version of the <Foo> page"> that I copied from Gwern.net. This convention is discoverable (just read the HTML) and naturally adapts to any website size and structure. I have created an `llms.txt` for my website anyhow. I use a fixed LLM prompt to generate it from the internal links in `index.md`.
  - iamacyborg 4mo ago
    Giving a markdown version of a page seems like an interesting choice instead of just embedding a schema marked up one
    - vidarh 4mo ago
      Every page on code.claude.com has a markdown version available by just appending ".md", and Claude Code knows about it. E.g: https://code.claude.com/docs/en/overview https://code.claude.com/docs/en/overview and https://code.claude.com/docs/en/overview.md https://code.claude.com/docs/en/overview.md
      - deleted 4mo ago

einpoklum 4mo ago

How well-known are those URIs though? :-\

timwis 4mo ago
I agree. I was hoping for a few positive examples, but didn't see any. The only one I know of is the OIDC discovery endpoint.
- asdfasdfadsfs 4mo ago
  I would say acme-challenge is one of the most used ones. How else would one get SSL certificates today
  - echoangle 4mo ago
    DNS TXT challenge for example. Also better because you can get wildcard certs.
    - sureglymop 4mo ago
      Also, DNS-PERSIST-01 seems to be coming soon for Let's Encrypt, which should allow even people that can't easily dynamically update their DNS records to get wildcard certs. I assume this might become more widely used than HTTP-01 challenges.
      - inigyou 4mo ago
        I wish someone would write a blog post about the difference between DNS registrars and DNS hosts, because I've seen people assume they need to use a registrar that has an API in order to change their DNS records programmatically. I used to assume that too.
        Natfan 4mo ago
        - registrars control NS records, however these can be changed - NS records control other records - registrars can also use their own nameservers to manage your DNS

sandblast 4mo ago

No, in fact I don't. But this post wouldn't be of any help anyway. It feels like it's about nothing, there is no substance, just stating some obvious facts. Without examples that lead to some real recommendations, this whole expertise claimed by the author is of no use.

wseqyrku 4mo ago
The point of the post was that you need to add robots.txt (or similar) because it's a thing, and also tell us where they are.
- Geezus_42 4mo ago
  > add a robots.txt Which bots will then ignore.
  - Ferret7446 4mo ago
    I didn't expect I'd get to use this so soon. Obligatory canned advisory: https://www.felesatra.moe/blog/2026/06/19/robots https://www.felesatra.moe/blog/2026/06/19/robots
    - Geezus_42 4mo ago
      They still ignore it and scan everything even though you have told them not to scan certain paths.
amiga386 4mo ago
> expertise claimed by the author The author is on record as trying to remove HTTP 418 "I'm a teapot" support from NodeJS, which resulted in backlash and Python adding support for it. https://en.wikipedia.org/wiki/Hyper_Text_Coffee_Pot_Control_Protocol#Save_418_movement https://en.wikipedia.org/wiki/Hyper_Text_Coffee_Pot_Control_...
- AlienRobot 4mo ago

philipwhiuk 4mo ago

I'm not sure I like `https://domain.com/.well-known/robots.txt https://domain.com/.well-known/robots.txt` any better frankly

russellbeattie 4mo ago
Whoever decided it would be a good idea for ".well-known" to be a "hidden" directory is a complete fool. All it does is provide the opportunity for confusion, misconfiguration, skipped backups, missed git check-ins, forgotten updates and more. Literally the only people a folder like that is hidden from is the whoever is managing the web server. Sure, if everyone knows what they're doing, it's not a problem. But we all know how long that assumption lasts.
- zamadatix 4mo ago
  I think the blog author is the one who wrote the original RFC. To be fair to him, there once was a time web servers were more commonly thought of as truly being remote directories of files you can view or link to, not just domains the browser hides the rest of, and dotfiles would commonly act like dotfiles in local file listings. Nowadays, the assumption is if you go to the base URL it should only ever serve the default page and if you try to go to a directory it should throw an error. Well, unless you're one of those ancient sites like https://ftp.mozilla.org/ https://ftp.mozilla.org/ I'm not saying it's good or bad how things turned it, but the choice of a dotfile for this sure did not pan out well as the web went the exact opposite direction it would have been relevant in.
- 9dev 4mo ago
  The main point of consideration here probably was how to avoid conflicts with URLs of existing sites, not exactly people who aren't able to serve an endpoint with a dot within its path...
- marcosdumay 4mo ago
  TBF, those people are already hit with problems on their apache configuration and fixed their tooling long before the lack of .well-known gives them any problem.

creatorpilot 4mo ago

[flagged]

jiggunjer 4mo ago

Title says uri but post only about urls, a type of uri

user3939382 4mo ago

I wish we had one for navigation layout of a site so browser chrome could render that in a consistent way. It would also be a boon for a11y.

momoraul 4mo ago

.well-known started tidy and quietly became the junk drawer of the web root. security.txt, ACME, app-site-association, and counting.

delichon 4mo ago
A junk drawer is an improvement over scattered junk.
- chrisweekly 4mo ago
  exactly! in fact, that's most of the whole point of .well-known!
marcosdumay 4mo ago
What do you mean? It was explicitly designed to be a junk drawer.
- ape4 4mo ago
  Why not call it .junk-drawer instead ;)
  - marcosdumay 4mo ago
    Well, it does live space for other drawers for other kinds of junk. This one is just for junk you already know it will be there.
- momoraul 4mo ago
  Fair, the drawer's the good part. Beats having every spec squat its own root path.
inigyou 4mo ago
Isn't that the point though? Keeping all the junk in a drawer labeled as junk, instead of keeping it on the kitchen counter?

1vuio0pswjnm7 4mo ago

"This Web site requires a more modern browser to operate securely; please upgrade your browser." Alternative, no SNI required https://web.archive.org/web/20260619061625if_/https://mnot.net/blog/2026/well_known_uris https://web.archive.org/web/20260619061625if_/https://mnot.n...

xyzzy_plugh 4mo ago
SNI is good, though? I'm curious how you are running into this.
- quotemstr 4mo ago
  Perhaps he's trying to drive adoption of ECH. SNI is better than nothing, but it leaves the name of the destination domain in plaintext.
deleted 4mo ago
[deleted]
1vuio0pswjnm7 4mo ago
If one is conducting surveillance and/or censorship of www users, SNI is not good It's great
1vuio0pswjnm7 4mo ago
Internet Draft: ECH Considered Harmful https://www.ietf.org/archive/id/draft-stein-tls-ech-considered-harmful-00.html https://www.ietf.org/archive/id/draft-stein-tls-ech-consider...

inigyou 4mo ago

The consideration about having more than one of them on a domain seems like something that's often overlooked.

welder 4mo ago

Does a change-password registry actually get used, even by bots? I don't see bots checking for a .well-known/change-password url on my sites. It seems a good place to put public configs, just to have a place for them, but not as a means of discovery.

ameliaquining 4mo ago
Some password managers, such as Chrome's, offer a "change password" button in the UI that informs the user if their password has been compromised. This is based on .well-known/change-password.

quotemstr 4mo ago

One disappointment you can't help but feel, having worked in technology a while, is about how people solve the same problems over and over in redundant and subtly incompatible ways. How do you associate metadata with a public name? A SRV record! No, a TXT record! No, a meta tag! No, data attributes! No, an X.509 attribute! No, a random file at top level! No, a well known file under some schema! No, ... It goes on forever. We're left with a mishmash of mechanisms and lowest common denominator support for them all. It would be nice if we picked an extension mechanism and maximally enhanced it rather than having everyone invent his own

devdoshi 4mo ago

I do think it is important to have autonomous discoverability with domain-anchored trust, whether through .well-known or DNS records or DNS over HTTP. It looks like cloudflare has already added a bunch of observability into their products around this area, and I am investigating too [1]. It seems like the number of services needing these, and the amount needed per org should both go up with more agentic use cases. I believe auth.md is also a recent example that uses .well-known [1] https://instagrate-me.sudoscience.dev/ https://instagrate-me.sudoscience.dev/