It would have been nice if they came up with something shorter like .lan.
Oh, that’s LAN - I thought you’d put ian and I was trying to get the joke. Stupid sans-serif fonts.
Use it anyway.
You go to networking jail for that.
Shit, let’s hope the ICANN cops don’t find me out then… I’ve been using it for years!
418
“I hereby sentence you to two years on your own VLAN with no gateway”
“Please Mr. Router, mercy!”
iptables -I APPEALS -j DROP
It should be reserved for sex toys.
Just saying.
What are you doing step-LAN?
Please don’t use the duplex again.
I saw you peeked inside my ssh key drawer last night step-LAN
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CA (SSL) Certificate Authority DNS Domain Name Service/System HTTP Hypertext Transfer Protocol, the Web HTTPS HTTP over SSL IP Internet Protocol SSL Secure Sockets Layer, for transparent encryption TLS Transport Layer Security, supersedes SSL VPN Virtual Private Network
6 acronyms in this thread; the most compressed thread commented on today has 6 acronyms.
[Thread #910 for this sub, first seen 8th Aug 2024, 09:05] [FAQ] [Full list] [Contact] [Source code]
Why do I care what ICANN says I can do on my own network? It’s my network, I do what I want.
Try using .com for your internal network and watch the problems arise. Their choice to reserve .internal helps people avoid fqdn collisions.
Well as long as the TLD isn’t used by anyone it should work internally regardless of what ICANN says, especially if I add it to etc/hosts
German router and network products company AVM learned the hard way that this is a bad idea. They use fritz.box for their router interface page and it was great until tld .box became publicly available and somebody registered fritz.box.
Having a reserved local/internal only tld is really great to prevent such issues.
Sure, you can do whatever you want. You could even use non-rfc1918 addresses and nobody can stop you. It’s just not always a great idea for your own network’s functionality and security. You can use an unregistered TLD if you want, but it’s worth knowing that when people and companies did that in the past, and the TLD was later registered, things didn’t turn out well for them. You wouldn’t expect .foo to be a TLD, right? And it wasn’t, until it was.
YouCANN do anything you want?
I will stick with .lan
Sorry. I chose .local and I’m sticking to it.
I switched from .local to .honk and I’m never looking back.
Fucking GENIUS.
I don’t get it.
I was using .local, but it ran into too many conflicts with an mDNS service I host and vice versa. I switched to .lan, but I’m certainly not going to switch to .internal unless another conflict surfaces.
I’ve also developed a host-monitoring solution that uses mDNS, so I’m not about to break my own software. 😅
.internal takes to long to type
I still haven’t heard a convincing argument to not use .local and I see no reason to stop.
My main issue was it doesn’t play well with Macs.
Mainly conflicts with mDNS. However it’s shitty IMHO that the mDNS spec snarfed a domain already in widespread use, should have used .mDNS or similar.
That I agree with. Microsoft drafted the recommendation to use it for local networks, and Apple ignored it or co-opted it for mDNS.
Browsers barf at non https now. What are we supposed to do about certificates?
@solrize @thehatfox get a free wildcard cert for your domain and use it just like any other. nothing new, nothing different. I have those running on LAN-only hosts behind a firewall and NAT with no port punching or UpNP or any ingress possible.
if you don’t want to run a private CA with automated cert distribution (also simple with ansible or a few tens of LOC in shell or python), the LetsEncrypt is trivial and costs nothing – still requires one to load the cert and key onto a server though, which is 2/3 of the work vs private CA cert management.
How do you propose to get LetsEncrypt to offer you a certificate for a domain name you do not and cannot control?
@JackbyDev Why would that be a question at all? Buy a domain name and take care of your dns records.
that’s an odd way to say that you don’t own any domains. that’s step one, but does it even need to be said?
You cannot buy .internal domains. That’s my point.
If you mean properly signed certificates (as opposed to self-signed) you’ll need a domain name, and you’ll need your LAN DNS server to resolve a made-up subdomain like
lan.domain.com. With that you can get a wildcard Let’s Encrypt certificate for*.lan.domain.comand all yourhttps://whatever.lan.domain.comURLs will work normally in any browser (for as long as you’re on the LAN).Right, main point of my comment is that .internal is harder to use that it immediately sounds. I don’t even know how to install a new CA root into Android Firefox. Maybe there is a way to do it, but it is pretty limited compared to the desktop version.
You can’t install a root CA in Firefox for android.
You have to install the cert in android and set Firefox to use the android truststore.
You have to go in Firefox settings>about Firefox and tap the Firefox logo for a few times. You then have a hidden menu where you can set Firefox to not use its internal trust store.
You then have to live with a permanent warning in androids quick setting that your traffic might be captured because of the root ca you installed.
It does work, but it sucks.
