upvote

points

by arcfour11 hours ago |
comments
upvoteby teddyh8 hours ago|
next
[-]
Having all those TXT records at the domain apex like that makes the TXT query reply huge, which affects, for instance, every mail recipient who merely wants to check the SPF record. This is a bad pattern to follow.
reply
upvoteby Bender4 hours ago|
parent|
next
[-]
The domains with large numbers of TXT records are also used in DNS DDoS amplification attacks. Spoofed UDP requests to domains that have a large number of TXT records are used to slam other sites. In the past I would transparently strip the TXT records when I ran public DNS recursive resolvers nobody noticed except the botters but some here may be activated. Some domains with a lot of dangling records:

    for i in $(echo "ycombinator.com 500px.com box.com ebay.com google.com hm.com lenovo.com nordstrom.com realtor.com tmz.com wired.com");do echo -en "${i}:  ";dig +short +nocookie -t TXT "${i}"|wc -l;done|sort -rn -k2
    nordstrom.com:  39
    lenovo.com:  38
    realtor.com:  36
    ebay.com:  36
    hm.com:  34
    box.com:  28
    wired.com:  27
    tmz.com:  22
    500px.com:  17
    ycombinator.com:  13
    google.com:  13
Ebay used to be in first place, not sure what changed.

In unbound.conf:

    local-zone: ycombinator.com typetransparent
    local-data: 'ycombinator.com. TXT "[ddos redacted]"'
after the changes:

    dig +short +nocookie -t txt ycombinator.com
    "[ddos redacted]"
reply
upvoteby somat3 hours ago|
parent|
[-]
Whee, my chance to be the useless use of cat asshole.

Why the echo? "for" should handle a list of terms just fine.

Pedantic assholery aside, genuine question. Is this some sort of shell expansion injection countermeasure of which I am unfamiliar?

And for the record I quite enjoy employing the useless use of cat. It turns pumping a file into a pipeline from a screwball shell meta command into a command isometric to any other command. I sort of wish tee had a "suppress stdout flag" so it could be used more naturally as cat's counterpart.

reply
upvoteby Bender2 hours ago|
parent|
[-]
Whee, my chance to be the useless use of cat asshole.

Would it be mean if I said I do that to expose cat rectum? I used to cat to tac to cat but that was too on the nose. Another fun one is mixed case HtMl elements. I miss that old dokimos site from 2001.

Here's [1] something to play with. not my repo

[1] - https://github.com/bashfuscator/bashfuscator

reply
upvoteby inigyou4 hours ago|
parent|
prev|
[-]
The better pattern is to use an underscore prefix like _discord-verification.domain.com

If your site allows user-created subdomains it shouldn't allow leading underscore. This is reserved somehow.

reply
upvoteby quotemstr2 hours ago|
parent|
[-]
Why would you want a new prefix over using record types as they were meant to be used?
reply
upvoteby sandblast11 hours ago|
prev|
next
[-]
"Domain-verifications" is an invitation for everyone else that might need it to use the same standard and convention. "Discord-domain-verification" is not, it's what feels like polluting the global namespace with the company name that might cease to exist in a few years.

At the very least, it should be "domain-verification-discord", "-google" and so on. Maybe even "-com.discord", "-com.google"? And the first part clearly standardized and registered, instead of one entity using "domain" and another one "site".

reply
upvoteby arcfour11 hours ago|
parent|
[-]
Why?
reply
upvoteby zamadatix9 hours ago|
parent|
next
[-]
Why reinvent the wheel differently 50,000 times instead? I'll usually even prefer a badly designed, but standard, format/encoding over a NIH one from each company - it's just less friction in the end. Heck - include a common format for the value too, then it opens up doors to automating generation with new sites & automatically validating this config for any site following the common format.
reply
upvoteby 9 hours ago|
parent|
prev|
next
[-]
deleted
reply
upvoteby 9 hours ago|
parent|
prev|
[-]
deleted
reply
upvoteby bombcar8 hours ago|
prev|
next
[-]
Domain verifications leak information that they shouldn't - it should be "random key.domain.com in TXT randomkey"
reply
upvoteby 11 hours ago|
prev|
next
[-]
deleted
reply
upvoteby quotemstr2 hours ago|
prev|
[-]
Literally the inner platform effect. We have multiple kinds of DNS record. Let's use them instead of creating a key value store inside a key value store.
reply