Crappy Design

3211 readers

1 users here now

Noticed that theres no equivalent to r/crappydesign here yet so i made one

founded 2 years ago

MODERATORS

yoshipunk123456@sh.itjust.works

134

Well then... I guess that leaves me no choice? (lemmy.world)

submitted 1 year ago by LunchEnjoyer@lemmy.world to c/crappydesign@sh.itjust.works

8 comments fedilink hide all child comments

Context: A local movie app have this warning to me as I have this domain blocked with NextDNS 👌

you are viewing a single comment's thread
view the rest of the comments

[–] 0x0@lemmy.dbzer0.com 1 points 1 year ago (1 children)

You're probably right. Rather than responding with NXDOMAIN, they're probably synthesizing A or AAAA records that point to their own server. IMO, this is super weird behavior in the era of HTTPS. I'm also pretty sure there's an IETF RFC that says recursive resolvers "MUST NOT" synthesize address records, but I can't seem to dig it up on my phone (pun intended ;).

[–] PoolloverNathan@programming.dev 1 points 9 months ago (1 children)

It's an option, default off. If you enable it it prompts you to install the CA for the block page.

[–] 0x0@lemmy.dbzer0.com 1 points 9 months ago

They ask you to install a root CA? That would enable your DNS provider to MITM your TLS traffic. Yikes.