Sindarina, Edge Case DetectiveJan 16, 2023

Since I just saw yet another developer use '1.2.3.4' in an example configuration, a reminder that you MUST NOT use publicly routable addresses that you do not control in your code.

Instead, use one of the available 'TEST-NET' IPv4 or IPv6 ranges documented in RFC 6890, such as;

192.0.2.0/24
198.51.100.0/24
203.0.113.0/24

❌ 1.2.3.4
✅ 192.0.2.4

Pass it on to all of your fellow developers, documentation writers, and so forth.

Full RFC is here;

https://datatracker.ietf.org/doc/rfc6890/

RFC 6890: Special-Purpose IP Address Registries

This memo reiterates the assignment of an IPv4 address block (192.0.0.0/24) to IANA. It also instructs IANA to restructure its IPv4 and IPv6 Special-Purpose Address Registries. Upon restructuring, the aforementioned registries will record all special-purpose address blocks, maintaining a common set of information regarding each address block.

IETF Datatracker
Show threadKen '|<3ns41' 🌻 🫰🏻
@sindarina I saw a bug bounty we paid (since fixed) because a long time ago someone made a default DNS in our internal tooling something like "PutYourDomainHere.com" and nobody ever thought to register the default, because we expected it to be changed by the engineers before going live... and that often wasn't the case. 😝
Jan 16, 2023 at 10:51pmWeb
Show threadSindarina, Edge Case DetectiveJan 16, 2023
@K3n_5s This is basically how the saga of 'corp.com' started, too; https://krebsonsecurity.com/2020/04/microsoft-buys-corp-com-so-bad-guys-cant/
Microsoft Buys Corp.com So Bad Guys Can’t – Krebs on Security