Hacker News Reader

Comment by weird-eye-issue | Hacker News Reader

I do understand all of that, still it feels weird to me. If I'm looking up a staging domain I'm not trying to broadcast that to the world, for example

You know the Qualsys SSL Tester tool? That has a checkbox about making the result public or not and that is because by default people wouldn't expect the domain to be leaked (even though it's already public information that doesn't really matter)

View on HN

It's a fair point, and I've thought about this when making the stats public. There are plenty domain enumeration tools out there. DNS data is inherently public, so I don't think one should rely on it for their security model.

I agree with you completely. I just want to add for people that do care about domain privacy that there's many certificate provider that do publish the generated certificate over https://crt.sh/ . I did find a few staging subdomains in the past on that website.

As a side-note, as soon as I added some DNS A records pointing to a testing server, it started getting spammed by bots trying to hack into the server (accessing all sorts of random paths that might be exposed, like .env or common PHP files). Not sure what the solution to this is, apart from not adding DNS records for testing servers, maybe only allow access to the server from specific IPs? But that makes testing harder, if you send a link to someone with a dynamic IP.

I'd be surprised if it was caused by adding the DNS record, and not for example you visiting the test site. In any case, sooner or later those attacks will come, so omitting a DNS A record won't cure it.

How would me visiting the site ping the bots about its existence?

Reply on news.ycombinator.com