I'm not a security expert, so my answers are not going to be exhaustive and may be incorrect. The bottom line is that trusting someone else with the DNS records for a development server is pointless and comes with some risk. Use it yourself if you want, but there's no reason other people should trust their security to a stranger who may have poor security practices (insecure password for registrar's website, for example).
I mentioned that public DNS is for networking only to point out that there's a mismatch here between the problem and the solution, but there are still attack vectors here.
One vector would be your ability to intercept anything that's being sent to the development server by a browser or IDE, which could include debug information, API keys, fragments of the stack, or even chunks of source code. It depends on the tools the developer is using.
> How would I get the IP of your development server other than 127.0.0.1?
The client IP. Many default configurations of local servers will use or bridge port 80, which means external requests will be routed to the local development server. The client IP, as well as permissive firewall settings, would allow an attacker to access the development server.
> When you request local.computer, it's not sending me your IP, it's requesting one.
With a very low TTL, you could still get the client IP pretty reliably. This is how DNS rebinding attacks work.
I mentioned that public DNS is for networking only to point out that there's a mismatch here between the problem and the solution, but there are still attack vectors here.
One vector would be your ability to intercept anything that's being sent to the development server by a browser or IDE, which could include debug information, API keys, fragments of the stack, or even chunks of source code. It depends on the tools the developer is using.
> How would I get the IP of your development server other than 127.0.0.1?
The client IP. Many default configurations of local servers will use or bridge port 80, which means external requests will be routed to the local development server. The client IP, as well as permissive firewall settings, would allow an attacker to access the development server.
> When you request local.computer, it's not sending me your IP, it's requesting one.
With a very low TTL, you could still get the client IP pretty reliably. This is how DNS rebinding attacks work.