Post AX1MLWQraN1Sclq8O0 by Zerglingman@freespeechextremist.com
(DIR) More posts by Zerglingman@freespeechextremist.com
(DIR) Post #AX14esB1AMguOHVQ24 by sindarina@ngmx.com
2023-06-24T08:16:40Z
7 likes, 21 repeats
Since I keep seeing developers use ‘pretty’ IP addresses like ’1.2.3.4’ in example configurations; a reminder that you MUST NOT use publicly routable addresses that you do not control in your code.Instead, use one of the available 'TEST-NET' IPv4 or IPv6 ranges documented in RFC 6890;192.0.2.0/24198.51.100.0/24203.0.113.0/24❌ 1.2.3.4✅ 192.0.2.4and for IPv6;✅ 2001:db8::/32Pass it on to all of your fellow developers, documentation writers, and so forth.Full RFC for special purpose addresses;https://datatracker.ietf.org/doc/rfc6890/Reserved for documentation, IPv4 and IPv6;https://datatracker.ietf.org/doc/rfc5737/https://datatracker.ietf.org/doc/rfc3849/1/ 🧵
(DIR) Post #AX14euFhRvcmpNiBbk by sindarina@ngmx.com
2023-06-24T08:22:56Z
0 likes, 6 repeats
The same goes for domain names; do NOT use a public domain name you do not control in your configuration, documentation, or UI language.Instead, use one of the available reserved domain names documented in RFC 2606, such as 'example.com', 'example.net', or the .example top-level domain.❌ test.com❌ yourdomain.com✅ example.com✅ yourdomain.examplePass it on to your fellow developers, designers, documentation writers, and so forth.Full RFC text is here;https://datatracker.ietf.org/doc/rfc2606/2/ 🧵
(DIR) Post #AX14ew1EsfFIJ6xfLU by sindarina@ngmx.com
2023-06-24T08:27:08Z
0 likes, 1 repeats
Oh, and please, if you are sending email, don't make up random addresses for your app to test with. Only send mail to addresses you know are valid, and for which you have permission to send mail.If you need to test SMTP while developing software, use a mock SMTP server that drops all outgoing email in a local directory, so you can inspect it without dumping a metric ton of email in your upstream's SMTP queue.If you absolutely must generate unique email addresses for testing, either register a domain for that purpose and set up mail handling for it, or use the .test TLD, and have as many unique domain names as you like.3/ END
(DIR) Post #AX1MLWQraN1Sclq8O0 by Zerglingman@freespeechextremist.com
2023-06-24T15:47:13.603046Z
1 likes, 0 repeats
@sindarina lol anyone who runs an example config without inspecting it properly gets what they fucking deserve.DO use evil IP addresses in your examples, as a trap for people who run shit blind.
(DIR) Post #AX33okoXgQYyoX3pMe by SlicerDicer@bikeshed.party
2023-06-25T11:28:59.373282Z
0 likes, 0 repeats
@sindarina That’s assuming you even want to use email.
(DIR) Post #AX35KwPIDWOLzOA7ns by condret@shitposter.club
2023-06-25T11:46:03.002961Z
0 likes, 1 repeats
@sindarina no, i must use publicly routable addresses to potentially cause chaos for my own excitement. Would be funny if something breaks because someone copy-pasted my code without reading, understanding and modifying it
(DIR) Post #AX3G69B5YHZqkWfOLI by jeffcliff@shitposter.club
2023-06-25T13:46:37.642102Z
0 likes, 1 repeats
> you MUST NOT use publicly routable addresses that you do not control in your code.or else you'll do what???
(DIR) Post #AX3GALyLvLTHabiPE8 by Zerglingman@freespeechextremist.com
2023-06-25T13:47:23.963623Z
0 likes, 0 repeats
@condret @sindarina Exclusively use IPs pointing to spook servers
(DIR) Post #ApcDpNg8R8lH4gmwe8 by r000t@ligma.pro
2024-12-31T20:13:46Z
0 likes, 0 repeats
@sindarina Now you may be wondering: Why does this matter? Because imagine you're a network engineer who got assigned 1.2.3.0/24 and you basically can't use it because it gets DDoS'd whenever you announce it.
(DIR) Post #ApeRwDRafsEx2B3goa by paul_ipv6@infosec.exchange
2024-12-31T21:46:48Z
1 likes, 0 repeats
@sindarina indeed. there are also reserved DNS names for documentation. use them for documentation, not for internal hosts.https://www.rfc-editor.org/rfc/rfc2606.htmlhttps://www.rfc-editor.org/rfc/rfc6761
(DIR) Post #ApeRwLRsufEFrPG2Ns by audiodude@sfba.social
2024-12-31T18:06:54Z
1 likes, 0 repeats
@sindarina Nope, definitely didn't read the RFC.
(DIR) Post #ApeRwLSas1nPtbabUO by paul_ipv6@infosec.exchange
2024-12-31T21:50:07Z
1 likes, 0 repeats
@sindarina when i was doing tech support for an open source DNS server, we regularly got support customers wondering why using fake roots or fake DNS names that collided with the public DNS kept breaking things.i also worked for a large ISP that really pushed using IPv6 because they'd had problems in their NOC with many reuses of RFC1918 space and address collisions.RFCs are not for the faint of heart but they have lots of good info and lots of reasons why you should follow them. ;)
(DIR) Post #ApeRwMWWusXTC6RGGO by audiodude@sfba.social
2024-12-31T14:18:47Z
0 likes, 0 repeats
@sindarina In unit tests that are intended to be hermetic, I tend to use the .fake TLD for things that look approximately like URLs but are never intended to be accessible.http://amazon.fake/api/create_object
(DIR) Post #ApeRwNNLkUn1pv9Raq by pmevzek@framapiaf.org
2024-12-31T19:50:39Z
1 likes, 0 repeats
@audiodude @sindarina Never invent TLDs. You will get burn and get others burn. If you just need examples, see the `.dev` or `.box` fiasco. News at 11: new gTLD round in 2026, so you can expect new TLDs in 2030 or so, and `.fake`, or any other, can certainly be there, and suddenly all your documentation and setups have a big problem!
(DIR) Post #ApjylmXw5okmziSUwy by glent@aus.social
2025-01-04T05:14:23Z
1 likes, 0 repeats
@sindarina Similarly there is a test/documentation range for USB IDs: 0x1d50:0x5200 through to 0x1d50:0x52ffhttps://vk5tu.livejournal.com/53240.html