Vint Cerf revealed Google already uses the string, as do plenty of others
  • solrize@lemmy.worldEnglish
    413·
    1 month ago

    Browsers barf at non https now. What are we supposed to do about certificates?

    • lemmyvore@feddit.nlEnglish
      231·
      1 month ago

      If you mean properly signed certificates (as opposed to self-signed) you’ll need a domain name, and you’ll need your LAN DNS server to resolve a made-up subdomain like lan.domain.com. With that you can get a wildcard Let’s Encrypt certificate for *.lan.domain.com and all your https://whatever.lan.domain.com URLs will work normally in any browser (for as long as you’re on the LAN).

      • solrize@lemmy.worldEnglish
        19·
        1 month ago

        Right, main point of my comment is that .internal is harder to use that it immediately sounds. I don’t even know how to install a new CA root into Android Firefox. Maybe there is a way to do it, but it is pretty limited compared to the desktop version.

        • lemmyvore@feddit.nlEnglish
          6·
          1 month ago

          This is not a new problem, .internal is just a new gimmick but people have been using .lan and whatnot for ages.

          Certificates are a web-specific problem but there’s more to intranets than HTTPS. All devices on my network get a .lan name but not all of them run a web app.

        • cereals@lemmy.mlEnglish
          6·
          1 month ago

          You can’t install a root CA in Firefox for android.

          You have to install the cert in android and set Firefox to use the android truststore.

          You have to go in Firefox settings>about Firefox and tap the Firefox logo for a few times. You then have a hidden menu where you can set Firefox to not use its internal trust store.

          You then have to live with a permanent warning in androids quick setting that your traffic might be captured because of the root ca you installed.

          It does work, but it sucks.

        • Petter1@lemm.eeEnglish
          32·
          1 month ago

          You do not have to install a root CA if you use let’s encrypt, their root certificate is trusted by any system and your requested wildcard Certificate is trusted via chain of trust

          • solrize@lemmy.worldEnglish
            121·
            1 month ago

            That’s if you have a regular domain instead of.internal unless I’m mixing something. Topic of thread is .internal as if it were something new. Using a regular domain and public CA has always been possible.

        • lud@lemm.eeEnglish
          11·
          1 month ago

          They didn’t make this too be easy to use. They don’t give a shit about that. That isn’t their job in the slightest.

          They reserved a TLD, that’s all.

          You can use any TLD you want on your internal network and DNS and you have always been able to do that. It would be stupid to use an already existing domain and TLD but you absolutely can. This just changes so that it’s not stupid to use .internal

    • BlueBockser@programming.devEnglish
      18·
      1 month ago

      Nothing, this is not about that.

      This change gives you the guarantee that .internal domains will never be registered officially, so you can use them without the risk of your stuff breaking should ICANN ever decide to make whatever TLD you’re using an official TLD.

      That scenario has happened in the past, for example for users of FR!TZBox routers which use fritz.box. .box became available for purchase and someone bought fritz.box, which broke browser UIs. This could’ve even been used maliciously, but thankfully it wasn’t.

    • egonallanon@lemm.eeEnglish
      12·
      1 month ago

      Either ignore like I do or add a self signed cert to trusted root and use that for your services. Will work fine unless you’re letting external folks access your self hosted stuff.

    • rushaction@programming.devEnglish
      9·
      1 month ago

      Quite literally my first thought. Great, but I can’t issue certs against that.

      One of the major reasons I have a domain name is so that I can issue certs that just work against any and all devices. For resources on my network. Home or work, some thing.

      To folks recommending a private CA, that’s a quick way to some serious frustration. For some arguably good reasons. On some devices I could easily add a CA to, others are annoying or downright bullshit, and yet others are pretty much impossible. Then that last set that’s the most persnickety, guests, where it’d be downright rude!

      Being able to issue public certs is easily is great! I don’t use .local much because if it’s worth naming, it’s worth securing.

      • Railing5132@lemmy.worldEnglish
        1·
        1 month ago

        Same thing we do with .local - “click here to proceed (unsafe)” :D

        Set up my work’s network waay back on NT4. 0 as .local cuz I was learning and didn’t know any better, has been that way ever since.

          • JackbyDev@programming.devEnglish
            2·
            1 month ago

            So you can access your router’s config page without blasting your password in plaintext or getting certificate warnings. It’s an optional feature.

    • state_electrician@discuss.tchncs.deEnglish
      4·
      1 month ago

      I found options like .local and now .internal way too long for my private stuff. So I managed to get a two-letter domain from some obscure TLD and with Cloudflare as DNS I can use Caddy to get Let’s Encrypt certs for hosts that resolve to 10.0.0.0/8 IPs. Caddy has plugins for other DNS providers, if you don’t want to go with Cloudflare.

      • kudos@lemmy.mlEnglish
        2·
        1 month ago

        Might be an idea to not use any public A records and just use it for cert issuance, and Stick with private resolvers for private use.

        • state_electrician@discuss.tchncs.deEnglish
          2·
          1 month ago

          It’s a domain with hosts that all resolve to private IP addresses. I don’t care if someone manages to see hosts like vaultwarden, cloud, docs or photos through enumeration if they all resolve to 10.0.0.0/8 addresses. Setting up a private resolver and private PKI is just too much of a bother.

  • Wilzax@lemmy.worldEnglish
    356·
    1 month ago

    Why do I care what ICANN says I can do on my own network? It’s my network, I do what I want.

      • Wilzax@lemmy.worldEnglish
        44·
        1 month ago

        Well as long as the TLD isn’t used by anyone it should work internally regardless of what ICANN says, especially if I add it to etc/hosts

        • friend_of_satan@lemmy.worldEnglish
          14·
          1 month ago

          Sure, you can do whatever you want. You could even use non-rfc1918 addresses and nobody can stop you. It’s just not always a great idea for your own network’s functionality and security. You can use an unregistered TLD if you want, but it’s worth knowing that when people and companies did that in the past, and the TLD was later registered, things didn’t turn out well for them. You wouldn’t expect .foo to be a TLD, right? And it wasn’t, until it was.

          • Wilzax@lemmy.worldEnglish
            5·
            1 month ago

            Ah good point. I guess a future-proofed guarantee that the domain will never be used externally would be easier to use than trying to somehow configure my DNS to never update specific addresses.

        • DarkMetatron@feddit.orgEnglish
          8·
          1 month ago

          German router and network products company AVM learned the hard way that this is a bad idea. They use fritz.box for their router interface page and it was great until tld .box became publicly available and somebody registered fritz.box.

          Having a reserved local/internal only tld is really great to prevent such issues.

          • aesthelete@lemmy.worldEnglish
            3·
            1 month ago

            I agree that this is a good idea, but I wanted to add that if someone owns a domain already, they can also use that internally without issue.

            If you own a domain and use Let’s Encrypt for a star cert, you can have nice, well secured internal applications on your network with trusted certificates.

            • witten@lemmy.worldEnglish
              3·
              1 month ago

              You don’t even need a star cert… The DNS challenge works for that use case as well.

            • DarkMetatron@feddit.orgEnglish
              2·
              1 month ago

              That is great when using only RFC 1918 IPv4 addresses in the network, but as soon as IPv6 is added to the mix all those internal only network resources can becomes easy publicly available and announced. Yes, this can be prevented with firewalling but it should be considered.

    • Voroxpete@sh.itjust.worksEnglish
      15·
      1 month ago

      Certain domain names are locally routed only. So if you use internal or local as a tld, you can just assign whatever names you want and your computer won’t go looking out on the internet for them. This means you and I can both have fileserver.local as an address on our respective network without conflicting. It’s the URI equivalent of 192.168.0.0/16.

    • Melllvar@startrek.websiteEnglish
      7·
      1 month ago

      The value of the DNS is that we all use the same one. You can declare independence, but you’d lose out on that value.

    • Monument@lemmy.sdf.orgEnglish
      3·
      1 month ago

      Well, I just realized I completely goofed, because I went with .arpa instead of .home.arpa, due to what was surely not my own failings.

      So I guess I’m going to be changing my home’s domain anyway.

    • subtext@lemmy.worldEnglish
      1·
      1 month ago

      It was just always so annoying having to go into the iPhone keyboard punctuation twice for each domain