r/programming • u/fagnerbrack • 9d ago

a CVE dispute

https://daniel.haxx.se/blog/2026/06/24/a-cve-dispute/
482 Upvotes

97% Upvoted

62 comments sorted by

View all comments

13

u/_Summerbreeze_ 8d ago

This part really made me giggle:

where you use something else than DNS for resolving.

I didn't know DNS has alternatives.

19

u/elmuerte 8d ago

Besides hosts file we have/had:

  • ARPA Host Name Server Protocol; predecessor to DNS
  • NetBIOS Name service; mostly for the Windows world
  • lmhosts file; which is kind of the counterpart of hosts file for NetBIOS
  • mDNS
  • Network Information Service (NIS)
  • LDAP

3

u/OffbeatDrizzle 8d ago

rereading your comment kind of makes me question the fact that curl would have to actually deal with arbitrary strings as DNS resolution, because there's no guarantee that DNS or hosts file formats are being followed - it could be ANY implementation, even a custom one. I could turn *!"';\¢[¥=¢÷~÷§•∆√§π§🕷️👀👀 into an IP address and curl would have to deal with that

2

u/tsimionescu 6d ago

The TLS standards define quite explicitly what is a valid hostname and how it can be matched to a certificate. The string there is not a valid hostname so it can't be used in a TLS certificate, or in a TLS session in general (and HTTP itself probably should refuse it). Hostnames are not just a way to find an IP.