elliottinvent
Joined 9 years ago
Karma
330
Submissions
193
Member since
Nov 25
Recent submissions
Comment · 3 years ago
I'm working on a couple of projects that are along these lines:
- Domain Verification Protocol [1][2] – proving authority over a domain. This is an application of our broader technology (still in development) where the domain can represent any thing (not just a company, e.g. an asset).
- NUM [3][4] a way to store structured data in DNS so that the domain name is the unique key to make a telephone call, GPS locate, make a payment, etc
The usual response to concepts for storing anything in DNS is MITM attacks but these can be mitigated. See DNSSEC, DNS over HTTPs, DNS over TLS.
Email in my profile, you're welcome to reach out to discuss.
1. https://www.domainverification.org
Comment · 3 years ago
Wait til you see the Twitter account:
Comment · 3 years ago
> all it does is do simple things by adding attributes to html elements
It’s extending html to make the most of http by adding some simple attributes.
Like all great things - the building blocks are simple, but the possibilities of what you can build with them is vast.
I think this is really well dealt with in the “opportunities” to extend html in this chapter of the Hypermedia Systems book: https://hypermedia.systems/extending-html-as-hypermedia/
Comment · 3 years ago
Very active, helpful community on Discord [1] and a #htmx-2-dev channel for discussion on this very topic
Comment · 3 years ago
Admittedly I didn’t get that [1] far, thanks for pointing it out. I read the first half but he lost me at conversational dynamics (I mainly come here for the comments).
The battery analogy was a good way for me to understand my own experience and seemed like progress from the traditional definitions of introvert and extrovert.
1. “Balance not batteries” https://www.vipshek.com/blog/interaction#balance-not-batteri...
Comment · 3 years ago
It was recently explained to me:
Introverts charge their battery in solitude and discharge it socialising. Extroverts the opposite.
Comment · 3 years ago
If only all properties were pitched expertly by the vendor, like the “never ending property” [1]
With high end 70s chintz and cheese production values.
1. https://m.youtube.com/watch?v=kynbFDou6GI&feature=youtu.be&c...
Comment · 3 years ago
Thanks for the heads up and I'm sorry about that, I can't seem to recreate it in Firefox at the moment but I'll get to the bottom of it. Are you in automatic/dark/light mode? Your Firefox version would be a big help too if you were happy to share that.
In the meantime, you can see the spec here: https://gitlab.com/NUMTechnology/Domain-Verification/docs/-/...
Comment · 3 years ago
Thanks for the heads up, home page or any page in particular?
It’s ok for me but I’ll check the logs.
It’s just a basic fly.io setup at the moment but it should be more than capable of dealing with the traffic - just html (and htmx) front end and Sinatra back end.
It stood up pretty well to the traffic last time.
Comment · 3 years ago
Oh and to prevent what happened last time (the post getting flagged as an overheated discussion), I'm going to close the laptop and come back to this in a few hours! So if you ask a question, I'm not ignoring you – I'll respond later.
Comment · 3 years ago
Thanks for this really interesting feedback – especially that the subdomain method could create more opportunities for cache poisoning.
Interested to explore how a cache poisoning attack might be easier on a Domain Verification protocol TXT record compared to a DNS-01 TXT record.
Given the scenario: an attacker is attempting to claim a domain (example.com) with service provider (SP1) who uses a DNS revolver (DR1) I don’t immediately see how the subdomain approach makes a cache poisoning attack easier.
Couldn’t the attacker similarly keep asking DR1 for <rand>._acme-challenge.example.com and spam back NS delegation answers for _acme-challenge.example.com, with the goal that upon cache poisoning success, they could fraudulently claim example.com with SP1?
I may have overlooked something here, if so please explain.
With either method, DNSSEC would definitely seem the solution as you’ve suggested.
Comment · 3 years ago
Interesting idea.
If I understand correctly, let’s say a popular CDN was no longer maintained and the domain expired, eg popularcdn.com - you’re looking for a way to use a dns record lookup to verify that the domain (and cdn) is still controlled by who you think it is?
I guess for scripts this can be dealt with using integrity hashes but that’s version specific. So this would be a security check at a domain level?
I guess the hard part would be that any CDN hijacker could copy the DNS TXT record when they hijack it.
Comment · 3 years ago
Comment · 3 years ago
If you’re doing more than domain verification, there are a couple of other options you might want to consider [1][2].
Both are run by really good guys that’ll answer any questions you’ve got.
1. https://www.num.uk