It would have been nice if they came up with something shorter like .lan.
Oh, that’s LAN - I thought you’d put ian and I was trying to get the joke. Stupid sans-serif fonts.
First pictures of him sleeping now he has a TLD
Use it anyway.
You go to networking jail for that.
Shit, let’s hope the ICANN cops don’t find me out then… I’ve been using it for years!
“I hereby sentence you to two years on your own VLAN with no gateway”
“Please Mr. Router, mercy!”
iptables -I APPEALS -j DROP
418
Error 418
Lowercase .lan uppercase .LAN…
Straight to jail
Sorry. I chose .local and I’m sticking to it.
I switched from .local to .honk and I’m never looking back.
I love it
Fucking GENIUS.
I don’t get it.
I was using .local, but it ran into too many conflicts with an mDNS service I host and vice versa. I switched to .lan, but I’m certainly not going to switch to .internal unless another conflict surfaces.
I’ve also developed a host-monitoring solution that uses mDNS, so I’m not about to break my own software. 😅
.internal takes to long to type
Yeah, that’s why I started using .lan.
Yeah, I don’t really have a use at home for mDNS. None that I can think of, anyway. Pretty sure I was using it before MDNS was a thing.
Accessing printers? Resolving hostnames of internal hosts? I can’t imagine having a lan without mDNS
Oh. Internal hosts, I just setup on my own DNS… No need for that. Printer, can’t say I’ve ever had a problem.
It’s also second only to .com in terms of query volume in ICANN’s Magnitude statistics with 980 mil vs .internal’s 60 mil. Not sure if that makes it a de facto standard, but it’s close.
I went with .home and so far the problems are within reason
I’m using .home and have not had any issues. Would you mind sharing what problems you’ve come across so I know what to expect?
The main problem I have is waking up in the middle of the night worrying that ICANN pulled some more stupid corrupt bullshit that only makes networking worse and breaks my config.
Just look elsewhere in this thread: someone thinks that using .honk as a joke is safe. But what about .horse? .baby? .barefoot? .cool? (I stopped scrolling through the list at this point but you can see how arbitrary and idiotic things have become.)
I still haven’t heard a convincing argument to not use .local and I see no reason to stop.
Mainly conflicts with mDNS. However it’s shitty IMHO that the mDNS spec snarfed a domain already in widespread use, should have used .mDNS or similar.
That I agree with. Microsoft drafted the recommendation to use it for local networks, and Apple ignored it or co-opted it for mDNS.
.local is already used by mDNS/Zeroconf.
You mean mDNS/Zeroconf are using a tld that was already being used.
Tell me you don’t share a net with Macs without using those words.
Macs aren’t the only thing that use mDNS, either. I have a host monitoring solution that I wrote that uses it.
Even on windows sometimes depending on the target host, I’ve had to type host.local. (Final dot to do exact match) instead of host.local
This didn’t seem to affect other domains. I’m assuming it was due to special handling of .local
mDNS hasn’t been a just-Apple thing for decades. Do you still call it Ren-dess-voos like the Gaston character in Beauty and the Beast?
I’ve also used .local but .local could imply a local neighborhood. The word itself is based on “location”. Maybe a campus could be .local but the smaller networks would be .internal
Or, maybe they want to not confuse it with link-local or unique local addresses. Though, maybe all .internal networks should be using local (private) addresses?
My main issue was it doesn’t play well with Macs.
I’ve had issues with .local on my Android device. Straight up doesn’t work. I had to change to .lan
Hmm, the only issue I had was because it was using the DoH (which I don’t have a local server for). Once I disabled that, it was fine.
It should be reserved for sex toys.
Just saying.
What are you doing step-LAN?
Please don’t use the duplex again.
I saw you peeked inside my ssh key drawer last night step-LAN
I used to wonder why porn sites aren’t required to use ‘.cum’ instead of ‘.com’…
The original 3, “.cum”, “.nut”, and “.orgasm”.
Ah yes, the golden
showerage of the web.
Well did you find out?
some sex toys are external
Then they go on .external, obviously.
Its just a redirect loop from .internal to .external and back.
man mount
Browsers barf at non https now. What are we supposed to do about certificates?
If you mean properly signed certificates (as opposed to self-signed) you’ll need a domain name, and you’ll need your LAN DNS server to resolve a made-up subdomain like
lan.domain.com. With that you can get a wildcard Let’s Encrypt certificate for*.lan.domain.comand all yourhttps://whatever.lan.domain.comURLs will work normally in any browser (for as long as you’re on the LAN).Right, main point of my comment is that .internal is harder to use that it immediately sounds. I don’t even know how to install a new CA root into Android Firefox. Maybe there is a way to do it, but it is pretty limited compared to the desktop version.
You can’t install a root CA in Firefox for android.
You have to install the cert in android and set Firefox to use the android truststore.
You have to go in Firefox settings>about Firefox and tap the Firefox logo for a few times. You then have a hidden menu where you can set Firefox to not use its internal trust store.
You then have to live with a permanent warning in androids quick setting that your traffic might be captured because of the root ca you installed.
It does work, but it sucks.
This is not a new problem, .internal is just a new gimmick but people have been using .lan and whatnot for ages.
Certificates are a web-specific problem but there’s more to intranets than HTTPS. All devices on my network get a .lan name but not all of them run a web app.
You do not have to install a root CA if you use let’s encrypt, their root certificate is trusted by any system and your requested wildcard Certificate is trusted via chain of trust
That’s if you have a regular domain instead of.internal unless I’m mixing something. Topic of thread is .internal as if it were something new. Using a regular domain and public CA has always been possible.
They didn’t make this too be easy to use. They don’t give a shit about that. That isn’t their job in the slightest.
They reserved a TLD, that’s all.
You can use any TLD you want on your internal network and DNS and you have always been able to do that. It would be stupid to use an already existing domain and TLD but you absolutely can. This just changes so that it’s not stupid to use .internal
No one is saying it is their job.
Merely that using a TLD like .internal requires some consideration regarding ssl certificates.
But why are people even discussing that?
This is about an ICANN decision. TLS has nothing to do with that. Also you don’t really need TLS for self hosting. You can if you want though.
Because people can discuss whatever they like?
If you don’t like it just down vote it.
People can talk about whatever they want whenever they want. The discussion naturally went to the challenges of getting non-self-signed certificates for this new TLD. That’s all.
Nothing, this is not about that.
This change gives you the guarantee that
.internaldomains will never be registered officially, so you can use them without the risk of your stuff breaking should ICANN ever decide to make whatever TLD you’re using an official TLD.That scenario has happened in the past, for example for users of FR!TZBox routers which use
fritz.box..boxbecame available for purchase and someone boughtfritz.box, which broke browser UIs. This could’ve even been used maliciously, but thankfully it wasn’t.Either ignore like I do or add a self signed cert to trusted root and use that for your services. Will work fine unless you’re letting external folks access your self hosted stuff.
deleted by creator
Private CA is the only way for domains which cannot be resolved on the Internet
How do you propose to get LetsEncrypt to offer you a certificate for a domain name you do not and cannot control?
@JackbyDev Why would that be a question at all? Buy a domain name and take care of your dns records.
that’s an odd way to say that you don’t own any domains. that’s step one, but does it even need to be said?
You cannot buy .internal domains. That’s my point.
Quite literally my first thought. Great, but I can’t issue certs against that.
One of the major reasons I have a domain name is so that I can issue certs that just work against any and all devices. For resources on my network. Home or work, some thing.
To folks recommending a private CA, that’s a quick way to some serious frustration. For some arguably good reasons. On some devices I could easily add a CA to, others are annoying or downright bullshit, and yet others are pretty much impossible. Then that last set that’s the most persnickety, guests, where it’d be downright rude!
Being able to issue public certs is easily is great! I don’t use .local much because if it’s worth naming, it’s worth securing.
My Asus router is actually able to get a certificate and use DDNS which is really interesting.
Makes ya wonder what else it’s doing that for…
So you can access your router’s config page without blasting your password in plaintext or getting certificate warnings. It’s an optional feature.
Same thing we do with .local - “click here to proceed (unsafe)” :D
Set up my work’s network waay back on NT4. 0 as .local cuz I was learning and didn’t know any better, has been that way ever since.
You can set up your own CA, sign certs and distribute the root to every one of your devices if you really wanted to.
Yeah I know about that, I’ve done it. It’s just a PITA to do it even slightly carefully.
