5 ms·

How well-known are those URIs though? :-\

timwis 4mo ago
I agree. I was hoping for a few positive examples, but didn't see any. The only one I know of is the OIDC discovery endpoint.
- asdfasdfadsfs 4mo ago
  I would say acme-challenge is one of the most used ones. How else would one get SSL certificates today
  - echoangle 4mo ago
    DNS TXT challenge for example. Also better because you can get wildcard certs.
    - sureglymop 4mo ago
      Also, DNS-PERSIST-01 seems to be coming soon for Let's Encrypt, which should allow even people that can't easily dynamically update their DNS records to get wildcard certs. I assume this might become more widely used than HTTP-01 challenges.
      - inigyou 4mo ago
        I wish someone would write a blog post about the difference between DNS registrars and DNS hosts, because I've seen people assume they need to use a registrar that has an API in order to change their DNS records programmatically. I used to assume that too.
        Natfan 4mo ago
        - registrars control NS records, however these can be changed - NS records control other records - registrars can also use their own nameservers to manage your DNS
        echoangle 4mo ago
        Yeah, so basically it’s fine as long as your registrar lets you set your own NS. Are there ones where you can’t do that?
        Natfan 4mo ago
        apparently, networksolutions https://news.ycombinator.com/item?id=39673213 https://news.ycombinator.com/item?id=39673213
        sureglymop 4mo ago
        I agree that it can be confusing. I use RFC 2136 DNS UPDATE with my own DNS server. But for example, for my workplace this new challenge is convenient as they refuse to want to run their own DNS server.
    - ameliaquining 4mo ago
      The great virtue of the in-band challenge types is that web servers can just handle them out of the box, without any need for a separate setup step that depends on your stack. I think this has done a heck of a lot to increase adoption of HTTPS.
- pstoev 4mo ago
  Another one that is emerging is the A2A agent card https://a2a-protocol.org/latest/topics/agent-discovery/#1-well-known-uri https://a2a-protocol.org/latest/topics/agent-discovery/#1-we...
reddalo 4mo ago
There's an interesting list on Wikipedia: https://en.wikipedia.org/wiki/Well-known_URI#List_of_well-known_URIs https://en.wikipedia.org/wiki/Well-known_URI#List_of_well-kn...
- eschatology 4mo ago
  Not one of them links to the actual well-known resource, only pdf specifications. And several I picked randomly leads to dead ends. Here's one I could find: https://accounts.google.com/.well-known/openid-configuration https://accounts.google.com/.well-known/openid-configuration But how does one even find this?
  - masklinn 4mo ago
    well-known is for programmatic access, it either namespaces something you’re told to look for (e.g. various types of domain markers) or it lets you discover a feature / endpoint. In the latter case you just probe, for instance if you’re a password manager and you have a password for site A you hit A/.well-known/change-password and if they returns something you can surface a change password link to your user. The one you found is for OIDC provider discovery (https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig https://openid.net/specs/openid-connect-discovery-1_0.html#P...) so someone tells you they want to log in via Google, you hit that endpoint, and it lets you setup Google as an oidc provider rather without needing to hard-code providers. Even if you just want to support Google as a provider, you hit that and you get the entire configuration rather than have to hunt down the same information in the docs.
    - eschatology 4mo ago
      Thank you, that it is part of OIDC provider discovery spec explains a lot. That said, I still find it very bizzare that it's so hard to find a tangible example to see how it is in practice. The rfc has none. Another spec including the use of it has none. In the end only completed service provider/implementers show it. Before programmatic access happens, it needs to be written by a human. Yet the whole thing feels so human-unfriendly. Perhaps I am biased robots.txt sets a high bar on how easy it is to find and work with?
eschatology 4mo ago
I spent 10 minutes searching for one in the article, in the RFC, in the wikipedia page, on google, to search for a .well-known example. Couldn't find one. I did read one before while working with github oidc, and I did find it very useful. What is it with technical documentations that go deep describing what it is in plenty words but refusing to give a single example? This far from the first case I've ran into either.
- hahajk 4mo ago
  I've been setting up some federated servers (Matrix, activitypub) and I ran into .well_known/ paths in many of them. Webfinger resolver for activitypub and a more custom matrix server-to-server federation endpoint.
- deathanatos 4mo ago
  > I spent 10 minutes searching for one in the article, in the RFC, in the wikipedia page, on google, to search for a .well-known example. Couldn't find one. I don't know how that can be, since you claim to have found the RFC; the RFC straight-forwardly states, > 5. IANA Considerations > This specification updates the registration procedures for the "Well-Known URI" registry, first defined in [RFC5785]; see Section 3.1. & then of course directs IANA to establish a registry. We'd expect this section, given the very nature of the RFC is that it establishes a collection of things, so that there is an IANA considerations section should be wholly unsurprising… If you see the linked section… > The "Well-Known URIs" registry is located at <https://www.iana.org/assignments/well-known-uris/ https://www.iana.org/assignments/well-known-uris/>. And there's a link to a listing of every standardized .well-known URI there is. > What is it with technical documentations that go deep describing what it is in plenty words but refusing to give a single example? The RFC provides an example in the form of "example", but also in the form of "robots.txt" (as a "it could have used this, had this existed", but what else could it have done?).
ano-ther 4mo ago
They are collected at this registry: https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml https://www.iana.org/assignments/well-known-uris/well-known-...
- einpoklum 4mo ago
  Are they actually, though?
  - ano-ther 4mo ago
    If they adhere to the RFC, yes: https://www.rfc-editor.org/info/rfc8615/#section-3.1 https://www.rfc-editor.org/info/rfc8615/#section-3.1 And https://www.rfc-editor.org/info/rfc8615/#section-3 https://www.rfc-editor.org/info/rfc8615/#section-3 > Applications that wish to mint new well-known URIs MUST register. them, following the procedures in Section 5.1 […] Of course this is all voluntary, but why would you risk a name collision with another project if the process is quite straightforward?
Joker_vD 4mo ago
Slightly less well-known than XDG directories among the developers of Linux-targeted software, it would seem. Seriously, what an oxymoronic name. "/index.html" is a well known URL, literally: most of web-developers are aware of it. But inventing a bunch of URLs with predefined semantics and then slapping the "well-known" label on it... well, it won't magically make them actually well-known.

I agree. I was hoping for a few positive examples, but didn't see any. The only one I know of is the OIDC discovery endpoint.

asdfasdfadsfs 4mo ago
I would say acme-challenge is one of the most used ones. How else would one get SSL certificates today
- echoangle 4mo ago
  DNS TXT challenge for example. Also better because you can get wildcard certs.
  - sureglymop 4mo ago
    Also, DNS-PERSIST-01 seems to be coming soon for Let's Encrypt, which should allow even people that can't easily dynamically update their DNS records to get wildcard certs. I assume this might become more widely used than HTTP-01 challenges.
    - inigyou 4mo ago
      I wish someone would write a blog post about the difference between DNS registrars and DNS hosts, because I've seen people assume they need to use a registrar that has an API in order to change their DNS records programmatically. I used to assume that too.
      - Natfan 4mo ago
        - registrars control NS records, however these can be changed - NS records control other records - registrars can also use their own nameservers to manage your DNS
        echoangle 4mo ago
        Yeah, so basically it’s fine as long as your registrar lets you set your own NS. Are there ones where you can’t do that?
        Natfan 4mo ago
        apparently, networksolutions https://news.ycombinator.com/item?id=39673213 https://news.ycombinator.com/item?id=39673213
      - sureglymop 4mo ago
        I agree that it can be confusing. I use RFC 2136 DNS UPDATE with my own DNS server. But for example, for my workplace this new challenge is convenient as they refuse to want to run their own DNS server.
  - ameliaquining 4mo ago
    The great virtue of the in-band challenge types is that web servers can just handle them out of the box, without any need for a separate setup step that depends on your stack. I think this has done a heck of a lot to increase adoption of HTTPS.
pstoev 4mo ago
Another one that is emerging is the A2A agent card https://a2a-protocol.org/latest/topics/agent-discovery/#1-well-known-uri https://a2a-protocol.org/latest/topics/agent-discovery/#1-we...

reddalo 4mo ago

There's an interesting list on Wikipedia: https://en.wikipedia.org/wiki/Well-known_URI#List_of_well-known_URIs https://en.wikipedia.org/wiki/Well-known_URI#List_of_well-kn...

eschatology 4mo ago
Not one of them links to the actual well-known resource, only pdf specifications. And several I picked randomly leads to dead ends. Here's one I could find: https://accounts.google.com/.well-known/openid-configuration https://accounts.google.com/.well-known/openid-configuration But how does one even find this?
- masklinn 4mo ago
  well-known is for programmatic access, it either namespaces something you’re told to look for (e.g. various types of domain markers) or it lets you discover a feature / endpoint. In the latter case you just probe, for instance if you’re a password manager and you have a password for site A you hit A/.well-known/change-password and if they returns something you can surface a change password link to your user. The one you found is for OIDC provider discovery (https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig https://openid.net/specs/openid-connect-discovery-1_0.html#P...) so someone tells you they want to log in via Google, you hit that endpoint, and it lets you setup Google as an oidc provider rather without needing to hard-code providers. Even if you just want to support Google as a provider, you hit that and you get the entire configuration rather than have to hunt down the same information in the docs.
  - eschatology 4mo ago
    Thank you, that it is part of OIDC provider discovery spec explains a lot. That said, I still find it very bizzare that it's so hard to find a tangible example to see how it is in practice. The rfc has none. Another spec including the use of it has none. In the end only completed service provider/implementers show it. Before programmatic access happens, it needs to be written by a human. Yet the whole thing feels so human-unfriendly. Perhaps I am biased robots.txt sets a high bar on how easy it is to find and work with?

eschatology 4mo ago

I spent 10 minutes searching for one in the article, in the RFC, in the wikipedia page, on google, to search for a .well-known example. Couldn't find one. I did read one before while working with github oidc, and I did find it very useful. What is it with technical documentations that go deep describing what it is in plenty words but refusing to give a single example? This far from the first case I've ran into either.

hahajk 4mo ago
I've been setting up some federated servers (Matrix, activitypub) and I ran into .well_known/ paths in many of them. Webfinger resolver for activitypub and a more custom matrix server-to-server federation endpoint.
deathanatos 4mo ago
> I spent 10 minutes searching for one in the article, in the RFC, in the wikipedia page, on google, to search for a .well-known example. Couldn't find one. I don't know how that can be, since you claim to have found the RFC; the RFC straight-forwardly states, > 5. IANA Considerations > This specification updates the registration procedures for the "Well-Known URI" registry, first defined in [RFC5785]; see Section 3.1. & then of course directs IANA to establish a registry. We'd expect this section, given the very nature of the RFC is that it establishes a collection of things, so that there is an IANA considerations section should be wholly unsurprising… If you see the linked section… > The "Well-Known URIs" registry is located at <https://www.iana.org/assignments/well-known-uris/ https://www.iana.org/assignments/well-known-uris/>. And there's a link to a listing of every standardized .well-known URI there is. > What is it with technical documentations that go deep describing what it is in plenty words but refusing to give a single example? The RFC provides an example in the form of "example", but also in the form of "robots.txt" (as a "it could have used this, had this existed", but what else could it have done?).

ano-ther 4mo ago

They are collected at this registry: https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml https://www.iana.org/assignments/well-known-uris/well-known-...

einpoklum 4mo ago
Are they actually, though?
- ano-ther 4mo ago
  If they adhere to the RFC, yes: https://www.rfc-editor.org/info/rfc8615/#section-3.1 https://www.rfc-editor.org/info/rfc8615/#section-3.1 And https://www.rfc-editor.org/info/rfc8615/#section-3 https://www.rfc-editor.org/info/rfc8615/#section-3 > Applications that wish to mint new well-known URIs MUST register. them, following the procedures in Section 5.1 […] Of course this is all voluntary, but why would you risk a name collision with another project if the process is quite straightforward?

Joker_vD 4mo ago

Slightly less well-known than XDG directories among the developers of Linux-targeted software, it would seem. Seriously, what an oxymoronic name. "/index.html" is a well known URL, literally: most of web-developers are aware of it. But inventing a bunch of URLs with predefined semantics and then slapping the "well-known" label on it... well, it won't magically make them actually well-known.