full-disclosure - example.{com,org,net}

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

From: full-disclosure at ifokr.org (Brian Hatch)
Subject: example.{com,org,net}

> LOL, oops.  Someone pointed out to me a while back that RFC 2606 reserves 
> "example.com" "example.org" and "example.net" for this kind of purpose.

I've been using example.{com,org,net} for years.  However 3 years
ago I noticed that they'd set up actual A records for the
www.example.{com,org,net} hostnames.  (Previously, the domains
were registered, but no nameservers actually served data for them.)
www is currently a Red Hat box on a network owned by IANA itself,
and all it does is tell you that you probably came from some
documentation and refers you to the RFC.

This is pretty silly in my estimation.  First, it only works if you
go to /, where it should work for any URL you attempted.  (After all,
folks write exploits/docs that may point to
http://www.example.com/SomethingMoreGoesHere/ )

Secondly it puts a machine out on the net that was supposed to never
exist, so now all those kiddies will be spewing packets at IANA's
example box.

--
Brian Hatch                  "We all know Linux is
   Systems and                great... it does
   Security Engineer          infinite loops in
http://www.ifokr.org/bri/     5 seconds."
                              --Linus Torvalds
Every message PGP signed
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030602/e5014a76/attachment.bin