search

imperviousinc / fingertip

https://impervious.com/fingertip
Apache License 2.0
93 stars 19 forks source link

Feature request: conflict resolution #8

Open Falci opened 2 years ago

Falci commented 2 years ago

Hey 🖖

A common question on Handshake community is: "What about conflicts with ICANN new TLDs?" The answer for that is something like "you should use a DNS that pick the one you prefer"

Could we have a setting page on Fingertip where we could set that? IE: Add .music to the skip list, which would resolve it as ICANN

buffrr commented 2 years ago

At the moment, Fingertip skips any TLDs on this list (hardcoded) maintained by IANA. .music is not there yet, but we may want to skip it anyway in the next release.

I suppose giving users control over this would be nice. In reality, most users will probably go with the default since they wouldn't know/or care to change those settings. Hm not sure about the security aspects of this; technically, the owner of .music on Handshake can MITM any .music SLD on ICANN. This isn't an easy problem to solve.

Unless you own the same TLD in both namespaces, I think the default should be preferring any ICANN TLDs (that aren't claimed on Handshake), at least for now but still allowing users to prefer HNS for some/all TLDs if they want to.

Note: this isn't an issue for ICANN TLDs claimed on Handshake because we know they have the same owner so we can set Handshake as the default for those.

Falci commented 2 years ago

Technically, the owner of .music on ICANN can MITM any .music SLD on Handshake.

IMO, it's OK if fingertip wants to set a default, as long as the user still can change it.

buffrr commented 2 years ago

Technically, the owner of .music on ICANN can MITM any .music SLD on Handshake.

Yeah, that's why there is no simple automatic way to resolve this, i think. Naturally, the TLD with the most users/more popular would win, but conflicts may have to end up being resolved manually case by case and hardcoded for now. Fingertip should have safe, more conservative defaults. I'm suggesting we should skip .music to avoid conflicts for now, but open to hearing other opinions if someone thinks otherwise.

IMO, it's OK if fingertip wants to set a default, as long as the user still can change it.

yup users should be able to change it to whatever they want