Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Require the domain name to be a UUID or include the date or something else that makes it unsquattable.

What's the benefit of a UUID over a raw IP address?



IP addressess change. In my practice not-so-small hosting provides made a few changes in last 10 years.


Do you also expect to get a forever DNS server that will host your zone without ever getting paid?


You can change the hosting for the website.


Certificates?


> Certificates?

Not a technical requirement. Subject alternative name (SAN) certificates support IP addresses.


More clearly, "SAN certificates" aren't a thing. Since PKIX all certificates in the Web PKI were required to have the Internet's names on them as SANs. For several years now, web browsers only look at the SANs to make decisions. The Common Name from the X.500 system is only there for humans to look at, and for legacy software which still thinks that's a good idea decades after we explained why it isn't. Ideally we'd one day get rid of it (wastes bytes on the wire), but I won't hold my breath.

Unlike the Common Name, which is arbitrary human text (so e.g. " oops.example" is a valid name despite that space at the start, as are "c-programming.example\0\0\0" and "Ł0Ł.example") the SANs are defined so that it's harder to screw up and a machine can reliably just bit-for-bit compare the data. There are two main kinds: IpAddress SANs are defined for the IPv4 or IPv6 address just as bits, you can't express 200.300.400.500 as an IpAddress, whereas that's a (stupid but) valid Common Name; DnsName SANs are defined using a restricted character set and as specifically the ASCII LDH DNS hostname subset, which makes it much less tempting to try to incorrectly write a Unicode name here, what's actually required is the ASCII LDH name, ie Punycode.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: