Sorry. I chose .local and I'm sticking to it.
ICANN approves use of .internal domain for your network
Submitted 2 months ago by thehatfox@lemmy.world to selfhosted@lemmy.world
https://www.theregister.com/2024/08/08/dot_internal_ratified/
Comments
r00ty@kbin.life 2 months ago
EnderMB@lemmy.world 2 months ago
I switched from .local to .honk and I’m never looking back.
Boomkop3@reddthat.com 2 months ago
I love it
corsicanguppy@lemmy.ca 2 months ago
Fucking GENIUS.
xcjs@programming.dev 2 months ago
I was using .local, but it ran into too many conflicts with an mDNS service I host and vice versa. I switched to .lan, but I’m certainly not going to switch to .internal unless another conflict surfaces.
I’ve also developed a host-monitoring solution that uses mDNS, so I’m not about to break my own software. 😅
possiblylinux127@lemmy.zip 2 months ago
.internal takes to long to type
r00ty@kbin.life 2 months ago
Yeah, I don't really have a use at home for mDNS. None that I can think of, anyway. Pretty sure I was using it before MDNS was a thing.
chrisbit@leminal.space 2 months ago
It’s also second only to .com in terms of query volume in ICANN’s Magnitude statistics with 980 mil vs .internal’s 60 mil. Not sure if that makes it a de facto standard, but it’s close.
justme@lemmy.dbzer0.com 2 months ago
I went with .home and so far the problems are within reason
anytimesoon@feddit.uk 2 months ago
I’m using .home and have not had any issues. Would you mind sharing what problems you’ve come across so I know what to expect?
dhtseany@lemmy.ml 2 months ago
I still haven’t heard a convincing argument to not use .local and I see no reason to stop.
SirEDCaLot@lemmy.today 2 months ago
Mainly conflicts with mDNS. However it’s shitty IMHO that the mDNS spec snarfed a domain already in widespread use, should have used .mDNS or similar.
KingThrillgore@lemmy.ml 2 months ago
.local is already used by mDNS/Zeroconf.
corsicanguppy@lemmy.ca 2 months ago
Tell me you don’t share a net with Macs without using those words.
ShortFuse@lemmy.world 2 months ago
I’ve also used .local but .local could imply a local neighborhood. The word itself is based on “location”. Maybe a campus could be .local but the smaller networks would be .internal
Or, maybe they want to not confuse it with link-local or unique local addresses. Though, maybe all .internal networks should be using local addresses?
billwashere@lemmy.world 2 months ago
My main issue was it doesn’t play well with Macs.
UberMentch@lemmy.world 2 months ago
I’ve had issues with .local on my Android device. Straight up doesn’t work. I had to change to .lan
r00ty@kbin.life 2 months ago
Hmm, the only issue I had was because it was using the DoH (which I don't have a local server for). Once I disabled that, it was fine.
AnUnusualRelic@lemmy.world 2 months ago
It should be reserved for sex toys.
Just saying.
Bluefruit@lemmy.world 2 months ago
What are you doing step-LAN?
devfuuu@lemmy.world [bot] 2 months ago
Please don’t use the duplex again.
RandomLegend@lemmy.dbzer0.com 2 months ago
I saw you peeked inside my ssh key drawer last night step-LAN
Darkassassin07@lemmy.ca 2 months ago
I used to wonder why porn sites aren’t required to use ‘.cum’ instead of ‘.com’…
hperrin@lemmy.world 2 months ago
The original 3, “.cum”, “.nut”, and “.orgasm”.
TexMexBazooka@lemm.ee 2 months ago
Well did you find out?
captain_aggravated@sh.itjust.works 2 months ago
some sex toys are external
AnUnusualRelic@lemmy.world 2 months ago
Then they go on .external, obviously.
solrize@lemmy.world 2 months ago
Browsers barf at non https now. What are we supposed to do about certificates?
lemmyvore@feddit.nl 2 months ago
If you mean properly signed certificates (as opposed to self-signed) you’ll need a domain name, and you’ll need your LAN DNS server to resolve a made-up subdomain like
lan.domain.com. With that you can get a wildcard Let’s Encrypt certificate for*.lan.domain.comand all yourhttps://whatever.lan.domain.comURLs will work normally in any browser (for as long as you’re on the LAN).solrize@lemmy.world 2 months ago
Right, main point of my comment is that .internal is harder to use that it immediately sounds. I don’t even know how to install a new CA root into Android Firefox. Maybe there is a way to do it, but it is pretty limited compared to the desktop version.
BlueBockser@programming.dev 2 months ago
Nothing, this is not about that.
This change gives you the guarantee that
.internaldomains will never be registered officially, so you can use them without the risk of your stuff breaking should ICANN ever decide to make whatever TLD you’re using an official TLD.That scenario has happened in the past, for example for users of FR!TZBox routers which use
fritz.box..boxbecame available for purchase and someone boughtfritz.box, which broke browser UIs. This could’ve even been used maliciously, but thankfully it wasn’t.egonallanon@lemm.ee 2 months ago
Either ignore like I do or add a self signed cert to trusted root and use that for your services. Will work fine unless you’re letting external folks access your self hosted stuff.
winterschon@mastodon.bsd.cafe 2 months ago
@solrize @thehatfox get a free wildcard cert for your domain and use it just like any other. nothing new, nothing different. I have those running on LAN-only hosts behind a firewall and NAT with no port punching or UpNP or any ingress possible.
if you don't want to run a private CA with automated cert distribution (also simple with ansible or a few tens of LOC in shell or python), the LetsEncrypt is trivial and costs nothing -- still requires one to load the cert and key onto a server though, which is 2/3 of the work vs private CA cert management.
Findmysec@infosec.pub 2 months ago
Private CA is the only way for donations which cannot be resolved in the Internet
JackbyDev@programming.dev 2 months ago
How do you propose to get LetsEncrypt to offer you a certificate for a domain name you do not and cannot control?
rushaction@programming.dev 2 months ago
Quite literally my first thought. Great, but I can’t issue certs against that.
One of the major reasons I have a domain name is so that I can issue certs that just work against any and all devices. For resources on my network. Home or work, some thing.
To folks recommending a private CA, that’s a quick way to some serious frustration. For some arguably good reasons. On some devices I could easily add a CA to, others are annoying or downright bullshit, and yet others are pretty much impossible. Then that last set that’s the most persnickety, guests, where it’d be downright rude!
Being able to issue public certs is easily is great! I don’t use .local much because if it’s worth naming, it’s worth securing.
JackbyDev@programming.dev 2 months ago
My Asus router is actually able to get a certificate and use DDNS which is really interesting.
Railing5132@lemmy.world 2 months ago
Same thing we do with .local - “click here to proceed (unsafe)” :D
Set up my work’s network waay back on NT4. 0 as .local cuz I was learning and didn’t know any better, has been that way ever since.
exu@feditown.com 2 months ago
You can set up your own CA, sign certs and distribute the root to every one of your devices if you really wanted to.
solrize@lemmy.world 2 months ago
Yeah I know about that, I’ve done it. It’s just a PITA to do it even slightly carefully.
BestBouclettes@jlai.lu 2 months ago
That sounds like a bad idea, you would need your CA and your root certs to be completely air gapped for it to be even remotely safe.
wolo@lemmy.blahaj.zone 2 months ago
Maybe browsers could be configured to automatically accept the first certificate they see for a given .internal domain, and then raise a warning if it ever changes, probably with a special banner to teach the user what an .internal name means the first time they see it
ayyy@sh.itjust.works 2 months ago
The main reason this will never happen is that the browser vendors make massive revenue and profit margins off of The Cloud and would really prefer that the core concept of a LAN just dies so you pay your rent to them.
state_electrician@discuss.tchncs.de 2 months ago
I found options like .local and now .internal way too long for my private stuff. So I managed to get a two-letter domain from some obscure TLD and with Cloudflare as DNS I can use Caddy to get Let’s Encrypt certs for hosts that resolve to 10.0.0.0/8 IPs. Caddy has plugins for other DNS providers, if you don’t want to go with Cloudflare.
kudos@lemmy.ml 2 months ago
Might be an idea to not use any public A records and just use it for cert issuance, and Stick with private resolvers for private use.
possiblylinux127@lemmy.zip 2 months ago
Accept them
Wilzax@lemmy.world 2 months ago
Why do I care what ICANN says I can do on my own network? It’s my network, I do what I want.
friend_of_satan@lemmy.world 2 months ago
Try using .com for your internal network and watch the problems arise. Their choice to reserve .internal helps people avoid fqdn collisions.
Wilzax@lemmy.world 2 months ago
Well as long as the TLD isn’t used by anyone it should work internally regardless of what ICANN says, especially if I add it to etc/hosts
Voroxpete@sh.itjust.works 2 months ago
Certain domain names are locally routed only. So if you use internal or local as a tld, you can just assign whatever names you want and your computer won’t go looking out on the internet for them. This means you and I can both have fileserver.local as an address on our respective network without conflicting. It’s the URI equivalent of 192.168.0.0/16.
torkildr@lemmy.world 2 months ago
Interesting that you should use “.local” as an example, as that one’s extra special, aka Multicast DNS
ygpa@lemmy.world 2 months ago
YouCANN do anything you want?
charonn0@startrek.website 2 months ago
The value of the DNS is that we all use the same one. You can declare independence, but you’d lose out on that value.
KillingTimeItself@lemmy.dbzer0.com 2 months ago
the only losers in this situation are people that are squatting on my rightfully pirated domain names!
possiblylinux127@lemmy.zip 2 months ago
I will stick with .lan
EarMaster@lemmy.world 2 months ago
But what if your name is not Ian…
LrdThndr@lemmy.world 2 months ago
Tai’shar Malkier?
486@lemmy.world 2 months ago
That’s good, I never liked the clunky
.home.arpadomain.Monument@lemmy.sdf.org 2 months ago
Well, I just realized I completely goofed, because I went with .arpa instead of .home.arpa, due to what was surely not my own failings.
So I guess I’m going to be changing my home’s domain anyway.
subtext@lemmy.world 2 months ago
It was just always so annoying having to go into the iPhone keyboard punctuation twice for each domain
Itdidnttrickledown@lemmy.world 2 months ago
Thanks but I hardly needed anyone permission to not use that. .local still works just fine.
tills13@lemmy.world 2 months ago
Except when it doesn’t. It can have issues around multicast dns.
UberMentch@lemmy.world 2 months ago
I’ve had issues with .local on my android device. Straight up doesn’t work. I had to change to .lan
BCsven@lemmy.ca 2 months ago
It just means .internal won’t be relayed out on the internet, as it will be reserved for local only.
Decronym@lemmy.decronym.xyz 2 months ago
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CA (SSL) Certificate Authority SSL Secure Sockets Layer, for transparent encryption VPN Virtual Private Network
[Thread #910 for this sub, first seen 8th Aug 2024, 09:05] [FAQ] [Full list] [Contact] [Source code]
KingThrillgore@lemmy.ml 2 months ago
Took long enough
Violet_McQuasional@feddit.uk 2 months ago
Interesting. I’ve been using “.home.arpa” for a while now, since that’s one of the other often used ways.
hperrin@lemmy.world 2 months ago
Missed the opportunity for
.myshit.AlexWIWA@lemmy.ml 2 months ago
Thank god. Now iOS will finally recognize it
lambalicious@lemmy.sdf.org 2 months ago
Next up!
ICANN approves use of
.awesome-selfhosteddomain for your networktakeda@lemmy.world 2 months ago
I guess no one offered anything for .internal
ipkpjersi@lemmy.ml 2 months ago
Woohoo! We internal now! No more FQDN collisions!
zorrothefox2001@lemmy.world 2 months ago
routerlogin.net how I do not miss you
rikudou@lemmings.world 2 months ago
We use .lh, short for localhost. For local network services I use service discovery and .local. And for internal stuff we just use a subdomain of our domain.
MoonRaven@feddit.nl 2 months ago
I personally use .nexus for my network.
frog_brawler@lemmy.world 2 months ago
My network is .milkme and I have nipples… will they approve it?
cmnybo@discuss.tchncs.de 2 months ago
It would have been nice if they came up with something shorter like .lan.
Deebster@programming.dev 2 months ago
Oh, that’s LAN - I thought you’d put ian and I was trying to get the joke. Stupid sans-serif fonts.
steal_your_face@lemmy.ml 2 months ago
First pictures of him sleeping now this
LodeMike@lemmy.today 2 months ago
Use it anyway.
nethad@discuss.tchncs.de 2 months ago
You go to networking jail for that.