Hacker News Reader

Comment by acranox | Hacker News Reader

This gets covered in one of my favorite conference talks. "Defcon 21 - DNS May Be Hazardous to Your Health" https://www.youtube.com/watch?v=9Sgaq6OYLX8&t=900s (skip to 15:00 if you just want the answer to your question. but the rest of the talk is brilliant)

But basically when the computer can't resolve ".corp" it assumes it isn't an FQDN and starts adding other stuff to try and get an FQDN that does resolve.

View on HN

> when the computer

Meaning browsers? The answer there is stop doing stupid things with the URL. When I type “localhost” into Firefox I’m not expecting a google search.

If libc does that then that’s surprising and probably also wrong.

It’s the resolver search feature for making unqualified domain names easier to use. The security problems and safe implementation advice were documented over 26 years ago https://tools.ietf.org/html/rfc1535 so Microsoft does not really have a good excuse for getting it so wrong.

This goes way back before browsers combined the address bar and the search bar. Back then when you typed a bare word into the browser, the browser would try to be helpful and add suffixes like ".com" to try to make it work.

It has nothing to do with the URL. This is lower-level resolution of hostnames. Lookup “search domains”. DHCP can hand it out as an option, it can be set with policy, etc etc

I'm pretty sure both the Win32 libc and applications do this. Try typing "http://example" into Firefox. You'll get example.com.

Win32 socket API doesn't do it. Python wraps it more or less directly, and:

   Python 3.8.1 (tags/v3.8.1:1b293b6, Dec 18 2019, 23:11:46) [MSC v.1916 64 bit (AMD64)] on win32
   Type "help", "copyright", "credits" or "license" for more information.
   >>> import socket
   >>> socket.gethostbyname("example")
   Traceback (most recent call last):
     File "<stdin>", line 1, in <module>
   socket.gaierror: [Errno 11001] getaddrinfo failed
   >>> socket.gethostbyname("example.com")
   '93.184.216.34'

mh, can't reproduce on Windows 10 and Firefox 73 get a "Server not found" page as expected

It's application dependent behavior, AFAIK. Windows internals / APIs add .com by default, I believe. You probably hate this behavior like I do, and at some point in the past set "browser.fixup.alternate.enabled" to false in Firefox's about:config.

Win 10 and Firefox 72.0.2 here.

New Private Window -> http://example -> http://www.example.com/

>Meaning browsers? The answer there is stop doing stupid things with the URL. When I type “localhost” into Firefox I’m not expecting a google search.

We could go back to the days of manually typing "http://www.google.com/index.html" every single time instead of "google.com" but I don't think many would thank you.

It's never been the browser sticking index.html on the end, that's 100% the server since time eternal.

It's the same reason you can't navigate to a bunch of TLDs even though the owners have configured it to serve something.

Reply on news.ycombinator.com