undefined | Better HN

0 pointsshakna4y ago0 comments

The difference being, example.com is run by IANA [0] and guaranteed by them, whereas neverssl is just a kind-hearted soul, and may one day resolve to something else.

[0] https://www.iana.org/domains/reserved

0 comments

6 comments · 3 top-level

aleksi4y ago· 3 in thread

That page says that example.com is registered by IANA. It makes no promises about it being plaintext HTTP only or even that HTTP service is available.

shaknaOP4y ago

Only somewhat.

> 2. Application software SHOULD NOT recognize example names as special and SHOULD use example names as they would other domain names.

> 3. Name resolution APIs and libraries SHOULD NOT recognize example names as special and SHOULD NOT treat them differently. Name resolution APIs SHOULD send queries for example names to their configured caching DNS server(s).

> 6. DNS server operators SHOULD be aware that example names are reserved for use in documentation.

You are guaranteed to be able to try and resolve the domain, which should generally be enough for the crappy man-in-the-middle systems to work.

However, example.com should never suddenly start serving you a cryptominer, etc. Which is the larger concern.

innocenat4y ago

> You are guaranteed to be able to try and resolve the domain, which should generally be enough for the crappy man-in-the-middle systems to work.

I have never seen any captive portal work at DNS level though (and that by itself sounds problematic). They works at HTTP level. So if one day example.com start using HSTS then it will also be a problem, in addition to nowadays browser defaulting to HTTPS so you have to type http://example.com yourself.

neverssl.com guarantees all of that, at least as long as it's there.

2 more replies

roywiggins4y ago

Yeah, but neverssl.com could expire and start serving porn (or whatever), but we can be pretty sure example.com won't.

jen729w4y ago

The other difference being that neverssl.com does a bit more as it immediately redirects you to a unique subdomain, ensuring that any caching that your browser is trying is subverted.

Sure, it might go away one day. Until it does, it’s the best solution to this problem.

3np4y ago

I’ve had WiFi captive portals that somehow don’t redirect neverssl.com but do for other http/80 domains. Truly bewildering - I don’t understand how it could happen by mistake, nor why anyone would do that on purpose.

j / k navigate · click thread line to collapse