Hacker News Reader

I'm not saying your wrong, but frankly, it's 2021, and it should be a lot easier than this to set up hosts internally for home use. We've largely had the internet broadly for the last 25 years, and the average person should not have to be an expert on wildcard certs/DNS/zeroconf if they want to just have a server running locally.

In fact, that's part of the reason things have gone to the cloud, because what should be local internet style appliances (think of a media server that you just plug in and works with your stereo/tv) can't find each other easily -- all because you can't resolve a freakin name on the local DNS without setting up bonjour or your own DNS server.

You could just create your own cert and add it to all of your devices, I suppose

That doesn't work for certain devices, TV's/IoT devices, etc.

Give your local box a static IP from a LAN range, give it a name in .local or .lan domain, and you're likely fine.

The more interesting stuff begins when you want several boxes, and also your laptops, phones, tablets, etc to form a reasonable LAN, while accessing the internet. Bonus points for remote access to your LAN from outside it using your laptop or phone. Etc, etc.

Why is a local domain useful? I mean, what's wrong with your local machines having only a hostname with no domain at all?

I haven't seen many real world software supports lookup remote with a hostname, probably windows itself is the only one that I have seen? Meanwhile, url is almost the universal way for lookup remote machine (besides, of course, IP).

That's what mDNS (multicast-DNS) is for (mentioned in the article as the reason to never use .local as a DNS TLD because that conflicts with mDNS). The old Windows hostname lookup is predecessor of modern mDNS, but surprisingly Windows was one of the slowest to adopt modern mDNS. (In part because Microsoft backed a competitor named PNRP: they thought it would be great to have a Distributed Hash Table [DHT] as the data store for hostname lookup rather than just relying on pure "dumb" multicast shouting for anyone on the local segment who can here it. It wasn't a bad idea but managing DHTs is complex and mDNS was a simpler standard.)

At this point almost every major OS (including Windows 10 after the right feature update) mDNS mostly just works out of the box: ask for somehostname.local and if a system responds "oh, that's my hostname" things mostly just work. (mDNS was once called "Bonjour" if that helps connect the dots on what it is and how long many OSes have supported it.)

So don't use .local for DNS and mDNS works fine in so many cases these days you don't really need set a DNS for your local systems anyway. (Though if you do want a setup, I think this article is correct and home.arpa is the safest option available. .lan is also a bad idea because it isn't RFC protected and could be bought by someone as gTLD just as Google bought .dev.)

No domain at all means it’s possibly publicly resolvable. You don’t want to name your internal webserver just “ws” because this resolves to 64.70.19.33.

If you want to protect a webserver inside your home (which seems like a good idea in 2021), you're going to need SSL -- and that requires a domain.

Self signed ssl certs were kinda a solution to this -- and then were largely rejected as being absolutely "insecure" because they, well, were absolutely insecure.

No, things have gone to the cloud because it's a source of recurring revenue.

Is it damn hard to have a cable modem + router box and a WiFi access point in your home? Likely it's a no-brainer; each of them is at least as complex as a DNS server. Incentives matter.

DNS was not the reason for the cloud. The devices you talk of exist and DNS is not an issue. Some central discovery server can point you in the right direction if you do not want to set up your own dns. The problem is these products suck really bad. The hardware makers do not get top grade software developers and they do not support their devices for long enough so you get the recent issue with the home cloud nas product that exposed everyones data to the internet and an attacker remotely wiped them all.

I would much rather pay google $1/month to hold my data fairly securely than have to trust WD/Seagate/whoever to secure it.

And for IoT bits the problem is solved, Apple Home allows local only IoT devices and if you have an ipad or apple tv in your network you can always reach your iot devices without having to care about DNS. You might complain that this is a centralized cloud service but thats not far off what DNS is. You have to ask someone where your network is.

> Honestly, just spend the five bucks a year and reserve a real domain name with auto renew.

It really doesn't make much sense to propose as a solution to a potential configuration problem subscribing to a service with the goal of never using it.

It wouldn't be far-fetched to suggest reserving a subdomain of a domain you already own and use for that specific purpose, but paying for a subscription just to configure your internal DNS doesn't sound reasonable at all.

Mixing LAN and Internet scopes makes me uneasy. In my LANs the local domain is <location_name>.local, because .local is one of the reserved top domain names, and it shouldn't be resolvable outside the LAN.

https://tools.ietf.org/id/draft-chapin-rfc2606bis-00.html#rf...

Read the article. Don’t use .local (except for mDNS.)

Now it's evident I answered reflexively without reading the article. I like the concept of <server>.<location>.local/localdomain so host names never collided when you connected through VPN from one to another. That can still be done with <server>.<location>.home.arpa, but it feels ugly. I guess I'll get used to it.

> Don’t use .local (except for mDNS.)

Going forward, I agree. However for many years, the recommendation from large providers (including Microsoft) WAS to use .local

I've got .local as my internal network. For some people, it's not a trivial job to re-domain everything.

If your L2 DNS (hostnames, typically auto-generated) doesn't match your L3 DNS (handpicked) you're going to eventually have a Bad Time.

Microsoft had .corp as a placeholder for years, intending admins to input their own domains. (Which many promptly never did.) However, I'm not aware of them ever recommending or using .local for anything.

SBS (Small Business Server) pushed .local for YEARS.

They don't give a reason. I don't believe the author. I think it will not only technically work fine, but it's a good idea and better than using what the author suggests.

They do give a reason: mDNS is a standard that was assigned .local. mDNS is useful for a number of reasons. (One of its original codenames was "Bonjour" if that helps connect the dots on how old mDNS is at this point.)

It's not worth the effort to break mDNS because lots of apps can use mDNS, it's a useful standard. In fact, in many LANs today (on modern operating systems inc. relatively recent versions of Windows 10 as Microsoft was one of the last to adopt mDNS) mDNS does almost everything people would want DNS to do in LAN scope anyway and you could get away with not assigning any local DNS and just using mDNS services.

This would still forward your unresolved to public DNS, exposing your internal infra, which as I understand it is one of the things this article is looking at preventing

'exposing your internal infra'

I've worked in gov places where they care about this detail. It's quite a sad 'security by hiding' mentality.

Oh no someone knows my current IP is 192.168.0.100 <scared/>

It is part of a bigger strategy called 'security in depth'. At least that is how I understand it.

I'm pretty sure some people would be interested if they figured out you have a subdomain named say, name-your-password-manager.example.com. Motivated attackers could then attempt to exploit your password manager through websites you're likely to visit.

> If you pick the right registrar, you can easily get your hands on a wildcard DNS cert as well through Let's Encrypt.

I, sadly, went for Namecheap, and they don't integrate with let's encrypt :(

I know I could use the http challenge solver, but I would have to expose a publicly-available endpoint and I would prefer to avoid that !

You can change your DNS provider without changing the registrar.

Lots of DNS servers won’t let you resolve to local IPs. Google’s public DNS does. So I do that but I have to set all my machines to use those DNS.

five bucks for the first year, then considerably more to renew