Jan Schaumann

Perhaps worth editing the DNS section in light of RFC 9460 ... depending on the presence and contents of the HTTPS RR, a browser might not even use TCP. Here's a good blog post surveying the contents of the HTTPS RR a few years ago. https://www.netmeister.org/blog/https-rrs.html

As others have said, DNS is distributed/hierarchical/delegated. But if you wanted to try... First, grab the root zone file which points to all the TLD nameservers: https://www.internic.net/domain/root.zone Next, get zone files for the TLDs themselves. Not every TLD makes that freely or easily available, but https://github.com/jschauma/tld-zoneinfo is an excellent resource. The author of the above repo runs https://netmeister.org/tldstats/ which will give you an idea of scale; they're able to get 98.89% of all TLDs. (Correction: zone files for ccTLDs are mostly unavailable. That 98.89% is only domain count coverage, not zone file coverage.)

I checked the original list [1] and it's a fun read; however the following is absolutely true in my experience: > 30. Software with version numbers ending in '.0' are buggy and you should wait until the next release. [1] https://www.netmeister.org/blog/cs-falsehoods.html

That's an excellent question! When I was writing that I was pretty deep in DNS code and standards I think I just understood that as a rule of DNS. Or at the least, I believed I understood. Looking back a decade later I can't find any standard which supports my statement. However lots of other secondary sources seem to agree with me. "In these situations, the client needs to re-transmit over TCP for which the size limit is 64000 bytes" [0] "The first response via UDP is, no surprise, truncated, so we retry via TCP. But now the DNS result delivered via TCP is also truncated! That is, the DNS server has determined that the result will not fit into the maximum response size. Why is that? "Our payload is 4096 * 16 = 65536 bytes RDATA, which should fit into the DNS packet, which uses a two byte RDLENGTH field. But we also need to again account for the overhead noted above: 12 bytes DNS header, 36 bytes for the query, 11 bytes additional records, and 16 bytes for each A record, yielding (4096 * 16) + 12 + 36 + 11 = 65595 bytes in total. And the maximum size of an IP packet is 16 bit (via the IPv4 total length / IPv6 payload length). And that is now our limiting factor: 65536 bytes for DNS overhead + payload." My best guess is that DNS just makes the assumption that everything needs to fit in a single IP packet and it doesn't care if it is UDP or TCP. It is worth investigating if you have spare time. [0]:…

> making this is a valid URL: https://!$%:)(*&^@www.netmeister.org/blog/urls.html Uh, no. "%:)" is not <"%" HEXDIG HEXDIG> nor is % allowed outside of that. (Although your browser will likely accept it) > This includes spaces, and the following two URLs lead to the same file located in a directory that's named " ": > https://www.netmeister.org/blog/urls/ /f > https://www.netmeister.org/blog/urls/%20/f > Your client may automatically percent-encode the space, but e.g., curl(1) lets you send the raw space: Uh, no. Just because one of your clients is wrong and some servers allow it doesn't mean it's allowed by the spec. In fact, the HTTP/1.1 RFC defers to RFC2396 for the meaning of <abs_path>: <path_segments> which begin with a /. What is <path_segments>? A bunch of slash-delimited <segment>s. What is <segment>? A bunch of <pchar> and maybe a semicolon. What is <pchar>? <unreserved>, <escaped>, or some special characters (not including space). What is <unreserved>? Letters, digits, and some special characters (not including space). What is <escaped>? <"%" hex hex>. Most HTTP clients and servers are pretty forgiving about what they accept, because other people do broken stuff, like sending them literal spaces. But that doesn't mean it's "allowed", that doesn't mean every server allows it, and that doesn't mean it's a good idea. > That is, if your web server supports (and has enabled) user directories, and you submit a request for "~username": [it does stuff] Uh, no.…

The rules of email validation are not remotely well defined! Syntactic email validation is an impossibly hard problem. https://www.netmeister.org/blog/email.html IMO the industry consensus is never to "validate" email addresses syntactically, but simply to ensure that the email address contains at least one @ and to verify the email address by emailing it an activation code. Proofs would not have uncovered these failures. The proofs would have proved that they rejected your email address as invalid, and the developers would have patted themselves on the back for a job well done.

Like, in: example.com/secret-id-48723487345 I hope the last bit is not leaked somehow (?) Btw, we need a "falsehoods programmers believe about URLs" ... Although there is: https://www.netmeister.org/blog/urls.html

It seems ridiculous to apply form validation to a name, given the complexity of charsets involved. I don't even validate email addresses. I remember [this](https://www.netmeister.org/blog/email.html) wonderful explainer of why your email validation regex is wrong.

> Wouldn’t it be simpler and more consistent to have a first parse the IP into an internal format then perform all logic on that? So not speaking about this library specifically but yes, separating the address parsing part (https://www.netmeister.org/blog/inet_aton.html is a fun read) from the "is this address considered private?" part should make things much simpler. Vast majority of related code in this space that I've seen works like that. I'm actually struggling to come up with counterexamples.

The link referenced in the script shared might be a better starting place: https://www.netmeister.org/blog/keychain-passwords.html

Another similar article with a bit more details: https://www.netmeister.org/blog/dns-size.html

https://www.netmeister.org/blog/mktemp.html New title: "Remove File Upon Receipt of Certain Signals" trap "rm -f file; exit 0" 0 trap "rm -f file; exit 1" HUP INT QUIT PIPE TERM 2>/dev/null|| trap "rm -f file; exit 1" 1 2 3 13 15

Email address validation is non trivial: https://www.netmeister.org/blog/email.html The only reliable method is to send an email with a token to the address.

The full list: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#d… I recall (All) DNS Resource Records listed [1], which is another treasure of historical tidbits. [1] https://www.netmeister.org/blog/dns-rrs.html

The one about CS students is very poignant https://www.netmeister.org/blog/cs-falsehoods.html

Blog author’s latest post makes copious use of formatting and colors: https://www.netmeister.org/blog/debugging-certificate-errors.html Not saying that is wrong. Just maybe their views have evolved since 2015.

And even though that sounds reasonable, it is still wrong. Technically, you do not even need the dot, if you add an MX record to a whole TLD or have some other funky DNS setup. Source: https://www.netmeister.org/blog/email.html

I found this quite amusing as it seems as if Google is trying to impersonate Cloudflare's 1.1.1.1, whereas 010.010.010.010 is indeed the octal representation of 8.8.8.8. Credit: IPv4 addresses are silly, inet_aton(3) doubly so. https://www.netmeister.org/blog/inet_aton.html

You can also use the macOS Keychain directly from the command line. This isn't the guide I originally used but gives you an idea: https://www.netmeister.org/blog/keychain-passwords.html

quite funny reading HN articles sometimes. So... I read https://www.netmeister.org/blog/cs-falsehoods.html which came from https://news.ycombinator.com/item?id=21500672 in the top HN articles at the moment Item 27 of that list made me laugh when I read this article :)

As a co-founder of a fintech company, I absolutely 100% agree with this. When the company was 1 person, sure, you can revel in how you implemented some cool data structure or algorithm. But once you scale, none of that really matters anymore. Organization is more important to get people to work together, understand each other's code and generally just execute the product.... Also, this recent article from HN is a good pairing with OP's: https://www.netmeister.org/blog/cs-falsehoods.html

Yeah, "what if the file system was a database?" was a very common line of thought in the late '80s/early '90s -- see BFS, WinFS/Cairo, Apple's "soups" for the Newton PDA (https://en.wikipedia.org/wiki/Soup_(Apple)), Palm OS' virtual file system (https://www.netmeister.org/palm/PalmMisc/PalmMisc.html#1.7), et al.

See https://www.netmeister.org/blog/sharing-secrets-using-ssh-keys.html and https://github.com/jschauma/jass

Completing the holy trinity of bearded computer pioneers looking appalled at the modern age: https://www.netmeister.org/blog/images/dijkstra-quick-n-dirty.jpg

Also: <https://www.netmeister.org/blog/https-rrs.html>

Blog post: https://www.netmeister.org/blog/urls.html

Well... There's a more serious first start browser comparison by netmeister.org [0] which shows that 4 downloads are made. I downloaded and extracted the files. They look like helpers or partials for Brave internal extensions. All of them include manifest files with their names: - 1_0_14: "Brave HTTPS Everywhere Updater extension". Contains a 1MB ZIPped database of https domains. - 1_0_21: "Brave NTP sponsored images component". Contains three photos (to display in their new tab probably). - 1_0_22: "Brave Local Data Files Updater extension". Seems to contain whitelists and blacklists for extensions, autoplay, referers, trackers, etc. - 1_0_498: "Brave Ad Block Updater extension". Contains a 2.4 MB filter list for their adblocker implementation. Nothing seems to be harmful at all. This mechanism is used by almost all Chrome/Chromium based browsers to update their internal extensions and components. But, if the poster cares about backdoors... Well, every major browser out there has features that could be used to backdoor their users like Firefox Telemetry Experiments (which download xpi files) and Chrome Components. They also can change properties at will unless its disabled (via flags, about:config, recompiling, etc). Note: I'm a Vivaldi and Chromium user. I only use Brave with iOS which is kind of a different beast (since everything has to be implemented on top of iOS provided WebKit) since it somehow blocks ads better than stock Safari with AdGuard filters. For…

I just tested this with dnsmasq[1] and can confirm it works. It's good to know that there is a method but it looks a bit strange imo (see this article[2]): >> Now this seems a bit weird: DoH to a public resolver seemed intended to defeat an untrusted local resolver, but an untrusted local resolver can disable the use of DoH to the public resolver in this fashion. In fact, if you have content filtering in place on your DNS resolver, Firefox will also use that as a metric to decide whether or not to enable DoH to the default public resolver. >> In other words: if the browser detects that one of the things that DoH would help protect against (censorship / content filtering) is in place, then it will not enable DoH. ?? Well, for you as the network provider, that's good news -- you remain in charge, as so often, it boils down to having to trust the things you have to trust -- if you (the end user) don't trust your network provider, you can't use their services to bootstrap a trusted environment. [1] just add the line for the canary to /etc/dnsmasq.conf: address=/use-application-dns.net/ [2] https://www.netmeister.org/blog/doh-dot-dnssec.html

Well, essentially, all of the traditional text-only clients do (such as Mutt, which is what I use), I think Thunderbird does as well, beyond that, no clue, but there probably are others. Traditionally, if you chose to reply to an email, the mail client would put the mail you were responding to into your editor, with > marks in front of every line. The only socially acceptable way[1] to write your answer was to insert your responses in between those quoted lines, without > marks, and to delete everything of the original mail that was irrelevant to establish the context for the reply. That's how easy it is. Usually, a good mail client would also color quoted lines so that it's easy to see and read only the response lines in a received email, so you'd only have to read the quoted text if you weren't sure about the context. Clueless developers and users around the turn of the millenium then somehow didn't understand the purpose of providing you with a quoted version of the email you replied to, and started putting the reply above the quoted mail, thus ending up sending a copy of the mail they just received back to the person they received it from ... and nobody seemed to notice how idiotic an idea that actually is, and so it became sortof the new norm in large parts of the internet to attach large blobs of completely useless and often close to unreadable text to every mail, up to the point where some people even invented justifications for the behaviour that mostly tend to…

> Although there is: https://www.netmeister.org/blog/urls.html I think the section named "Pathname" is wrong. It describes the path of an URL as if every server was Apache serving static files with its default configuration. It should describe how the path is converted into a HTTP request. For instance, the article states that "all of these go to the same place : https://example.org https://example.org/ https://example.org// https://example.org//////////////////". That's wrong. A web client send a distinct HTTP request for each case, e.g starting with `GET // HTTP/1.1`. So the server will receive distinct paths. The assertion of "going to the same place" makes no sense in the general case.