Hacker News Reader

Comment by Bender | Hacker News Reader

Is that universally true on all sites that allow a user to create a sub-domain?

It certainly should be. Filtering user-registrable names that will end up in host names or URL paths is table stakes. You want to block names like www, admin, root, robots.txt, .well-known, _*, and so forth.

DNS allows any character you want, including underscores. Host names in URLs cannot contain underscores. Therefore any service that create subdomains for user would reject underscores, which is why they're considered de-facto reserved for special uses in DNS. I don't think the reserved nature is codified in any RFC.

Testing [1] Works in Firefox, Helium and Curl but I do not have Chrome or Safari to test with.

[1] - https://_test.nochan.net/

This only works because it’s a wildcard certificate. Since 2019, TLS certificates must not be issued for names containing underscores <https://cabforum.org/2018/11/12/ballot-sc012-sunset-of-under...>.

Interesting, however that goes back to my original question about platforms allowing users to create a sub-domain, as they almost always use a wildcard certificate for this purpose. [1]

I suppose the saving grace is that they can only create the _for-sale and not any of the attributes specific to the intent to sell and hopefully that is enough to prevent any shenanigans.

[1] - https://youstareintoconanssoul.ytmnd.com/

https://www.rfc-editor.org/info/rfc8552/

Reply on news.ycombinator.com