<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[AAAAARGH.]]></title><description><![CDATA[<p>AAAAARGH.</p><p>Trailing dots on host names in URLs is the gift that keeps on giving, I said it already four years ago and it still generously continues to poke me in the eye.</p><p><div class="card col-md-9 col-lg-6 position-relative link-preview p-0">



<a href="https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-dot/" title="A tale of a trailing dot">
<img src="https://daniel.haxx.se/blog/wp-content/uploads/2022/04/trailing-dot.jpg" class="card-img-top not-responsive" style="max-height: 15rem;" alt="Link Preview Image" />
</a>



<div class="card-body">
<h5 class="card-title">
<a href="https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-dot/">
A tale of a trailing dot
</a>
</h5>
<p class="card-text line-clamp-3">Trailing dots on host names in URLs is the gift that keeps on giving. Let me take you through a dwindling story of how the dot is handled differently in different places through the stack of an Internet client. The evil trailing dot. DNS When a given host name is to be resolved to an … Continue reading A tale of a trailing dot →</p>
</div>
<a href="https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-dot/" class="card-footer text-body-secondary small d-flex gap-2 align-items-center lh-2">



<img src="https://daniel.haxx.se/blog/wp-content/uploads/2024/07/daniel-greenbg-blackandwhite-413x413-1.jpg" alt="favicon" class="not-responsive overflow-hiddden" style="max-width: 21px; max-height: 21px;" />







<p class="d-inline-block text-truncate mb-0">daniel.haxx.se <span class="text-secondary">(daniel.haxx.se)</span></p>
</a>
</div></p>]]></description><link>https://board.circlewithadot.net/topic/fff329d8-0649-4926-b3dc-aeae94112e1a/aaaaargh.</link><generator>RSS for Node</generator><lastBuildDate>Fri, 15 May 2026 01:53:48 GMT</lastBuildDate><atom:link href="https://board.circlewithadot.net/topic/fff329d8-0649-4926-b3dc-aeae94112e1a.rss" rel="self" type="application/rss+xml"/><pubDate>Wed, 13 May 2026 22:40:04 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 12:23:31 GMT]]></title><description><![CDATA[<p><span><a href="/user/bagder%40mastodon.social">@<span>bagder</span></a></span> yes, HTTP is broken in this regard, right from the start.<br /><span><a href="/user/catsalad%40infosec.exchange">@<span>catsalad</span></a></span></p>]]></description><link>https://board.circlewithadot.net/post/https://chaos.social/users/byteborg/statuses/116572907848328387</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://chaos.social/users/byteborg/statuses/116572907848328387</guid><dc:creator><![CDATA[byteborg@chaos.social]]></dc:creator><pubDate>Thu, 14 May 2026 12:23:31 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 11:42:21 GMT]]></title><description><![CDATA[<p><span><a href="/user/bagder%40mastodon.social">@<span>bagder</span></a></span> </p><p>Tbh, why don't all URLs just get normalised to have a dot at the end? Do we really want DNS Suffix lists?</p><p>That is my most hated "feature" in almost everything that does DNS.</p><p>Same?</p>]]></description><link>https://board.circlewithadot.net/post/https://chaos.social/users/agowa338/statuses/116572745963728303</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://chaos.social/users/agowa338/statuses/116572745963728303</guid><dc:creator><![CDATA[agowa338@chaos.social]]></dc:creator><pubDate>Thu, 14 May 2026 11:42:21 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 10:18:35 GMT]]></title><description><![CDATA[<p dir="auto">I think the existence of the PSL is a symptom of a design flaw in how cookies are handled. This is not a curl problem as curl wasn't where cookies originated.</p>
<p dir="auto">And as for URLs without a trailing dot I think it's a problem that the server doesn't get to know what domain the client appended. Imagine a client simply sending <code>Host: www</code>. How is the server supposed to know which site the client wants without knowing what the client had appended.</p>
<p dir="auto">The domain search feature is inherently incompatible with the TLS security model. I think it would have made more sense to make the trailing dot mandatory in https URLs as it would have better aligned with the security model of TLS. But I recall having seen cases where adding a trailing dot to https URLs would break things.</p>
<p dir="auto">I understand that the intention is for curl to handle all of the corner cases correctly, and I think that makes sense for a project like curl. I can imagine how frustrating it can be, and at times I guess you just want to reject those corner cases.</p>
]]></description><link>https://board.circlewithadot.net/post/https://westergaard.social/objects/2814cae0-8714-45fb-9cf9-cd251b329e62</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://westergaard.social/objects/2814cae0-8714-45fb-9cf9-cd251b329e62</guid><dc:creator><![CDATA[kasperd@westergaard.social]]></dc:creator><pubDate>Thu, 14 May 2026 10:18:35 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 09:30:37 GMT]]></title><description><![CDATA[<p><span><a href="/user/bagder%40mastodon.social">@<span>bagder</span></a></span> Ugh, reminds me of the trailing spaces vulnerability that windows had for years.</p><p>(Please no one tell me it still exists, please. I don't want nightmares.)</p>]]></description><link>https://board.circlewithadot.net/post/https://infosec.exchange/users/NosirrahSec/statuses/116572228016149202</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://infosec.exchange/users/NosirrahSec/statuses/116572228016149202</guid><dc:creator><![CDATA[nosirrahsec@infosec.exchange]]></dc:creator><pubDate>Thu, 14 May 2026 09:30:37 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 09:17:18 GMT]]></title><description><![CDATA[<p>So yes, there is at least one more pending <a href="https://mastodon.social/tags/curl" rel="tag">#<span>curl</span></a> CVE involving trailing dots.</p>]]></description><link>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116572175639391995</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116572175639391995</guid><dc:creator><![CDATA[bagder@mastodon.social]]></dc:creator><pubDate>Thu, 14 May 2026 09:17:18 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 09:15:12 GMT]]></title><description><![CDATA[<p><span><a href="/user/bagder%40mastodon.social" rel="nofollow noreferrer noopener">@<span>bagder</span></a></span> i remember when <a href="http://dk./" rel="nofollow noreferrer noopener">http://dk./</a> was a website.</p>]]></description><link>https://board.circlewithadot.net/post/https://social.yetzt.me/users/yetzt/statuses/01KRJW9GW6EYW9TDF5J86EWM5R</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://social.yetzt.me/users/yetzt/statuses/01KRJW9GW6EYW9TDF5J86EWM5R</guid><dc:creator><![CDATA[yetzt@social.yetzt.me]]></dc:creator><pubDate>Thu, 14 May 2026 09:15:12 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 08:18:31 GMT]]></title><description><![CDATA[<p><span><a href="/user/bagder%40mastodon.social">@<span>bagder</span></a></span> You'll hate me for writing that, but actually you gave the best argument for using trailing dot more often in URLs: "The trailing dot then means the name is to be used actually exactly only like that, it is specified in full, while the name without a trailing dot can be tried with a domain name appended to it." — Just to stop this terrible mess that's caused by DNS lookup suffixes. There should be an RFC banning this ancient and dangerous mechanism.</p>]]></description><link>https://board.circlewithadot.net/post/https://mastodon.green/users/taschenorakel/statuses/116571944474772524</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://mastodon.green/users/taschenorakel/statuses/116571944474772524</guid><dc:creator><![CDATA[taschenorakel@mastodon.green]]></dc:creator><pubDate>Thu, 14 May 2026 08:18:31 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 06:56:23 GMT]]></title><description><![CDATA[<p><span><a href="/user/bagder%40mastodon.social">@<span>bagder</span></a></span> "In 2022, someone found a web site that actually requires a trailing dot in the Host: header [...] and reported it to the curl project. Sigh. We back-pedaled on the eight years old decision and decided to internally keep the dot in the name, but strip it for the purpose of the SNI field. This seems to be how the browsers are doing it. We released curl 7.82.0 with this change. That site that needed the trailing dot kept in the Host: header could now be retrieved with curl. Yay." wow <img src="https://board.circlewithadot.net/assets/plugins/nodebb-plugin-emoji/emoji/android/1f642.png?v=28325c671da" class="not-responsive emoji emoji-android emoji--slightly_smiling_face" style="height:23px;width:auto;vertical-align:middle" title=":)" alt="🙂" /></p>]]></description><link>https://board.circlewithadot.net/post/https://mastodon.green/users/joostvb/statuses/116571621531059395</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://mastodon.green/users/joostvb/statuses/116571621531059395</guid><dc:creator><![CDATA[joostvb@mastodon.green]]></dc:creator><pubDate>Thu, 14 May 2026 06:56:23 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 06:39:09 GMT]]></title><description><![CDATA[<p><span><a href="/user/bagder%40mastodon.social">@<span>bagder</span></a></span><br />DNS section is technically incorrect.</p><p>With and without trailing dot does not necessarily refer to the same ip. The name example.com. always refers to example.com. where as example.com sometimes refers to example.com.internaldomain.tld.</p><p>That one bit me when I added a domain with a wildcard A-record to my dns search list. Suddenly example.com.internaldomaon.tld resolved. That caused quite a panic when I suddenly saw my own browser making a ton of requests to domains like doubleclick.net.mydomain.tld. in the webserver logs.</p><p>(As you might guess, I use dns blocklist for the big advertising domains, so only the subdomain version resolved).</p>]]></description><link>https://board.circlewithadot.net/post/https://c.im/ap/users/116216635389955538/statuses/116571553742022785</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://c.im/ap/users/116216635389955538/statuses/116571553742022785</guid><dc:creator><![CDATA[leeloo@c.im]]></dc:creator><pubDate>Thu, 14 May 2026 06:39:09 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 05:04:31 GMT]]></title><description><![CDATA[<p><span><a href="/user/rachel%40transitory.social">@<span>rachel</span></a></span> <span><a href="/user/bagder%40mastodon.social">@<span>bagder</span></a></span> but having TLS cert contain relative name only is completely ridiculous. Names in certs are always absolute. TLS code should use the full name resolved. getaddrinfo() provides it in canonical field.</p>]]></description><link>https://board.circlewithadot.net/post/https://fosstodon.org/users/pemensik/statuses/116571181638131607</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://fosstodon.org/users/pemensik/statuses/116571181638131607</guid><dc:creator><![CDATA[pemensik@fosstodon.org]]></dc:creator><pubDate>Thu, 14 May 2026 05:04:31 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 03:53:51 GMT]]></title><description><![CDATA[<p><span><a href="/user/bagder%40mastodon.social">@<span>bagder</span></a></span> My take: the HTTP spec is wrong and anyone serving a different site with a trailing dot is insane and shouldn't be accomodated.</p>]]></description><link>https://board.circlewithadot.net/post/https://furry.engineer/users/whyrl/statuses/116570903743909583</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://furry.engineer/users/whyrl/statuses/116570903743909583</guid><dc:creator><![CDATA[whyrl@furry.engineer]]></dc:creator><pubDate>Thu, 14 May 2026 03:53:51 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Thu, 14 May 2026 01:41:34 GMT]]></title><description><![CDATA[<p><a href="/user/bagder%40mastodon.social">@bagder@mastodon.social</a> yup I had some trailing dots to force some things to not do a dns search, then they got coppied into something that did tls, and guess what, that cert does NOT have an alt name with a dot of course not, super fun to track down</p>]]></description><link>https://board.circlewithadot.net/post/https://transitory.social/notes/am8dzyofdi</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://transitory.social/notes/am8dzyofdi</guid><dc:creator><![CDATA[rachel@transitory.social]]></dc:creator><pubDate>Thu, 14 May 2026 01:41:34 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Wed, 13 May 2026 23:06:00 GMT]]></title><description><![CDATA[<p><span><a href="/user/bagder%40mastodon.social" rel="nofollow noopener">@<span>bagder</span></a></span> </p><blockquote><p>Someone called it a dot release.</p></blockquote><p>sounds like you have a good dot product to me</p>]]></description><link>https://board.circlewithadot.net/post/https://oldbytes.space/users/gloriouscow/statuses/116569771892020696</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://oldbytes.space/users/gloriouscow/statuses/116569771892020696</guid><dc:creator><![CDATA[gloriouscow@oldbytes.space]]></dc:creator><pubDate>Wed, 13 May 2026 23:06:00 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Wed, 13 May 2026 23:05:01 GMT]]></title><description><![CDATA[<p><span><a href="/user/unlambda%40hachyderm.io">@<span>unlambda</span></a></span> exactly, and that inevitably leads to a security problem somewhere deep in there where we did or did not handle it appropriately...</p>]]></description><link>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116569768035696841</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116569768035696841</guid><dc:creator><![CDATA[bagder@mastodon.social]]></dc:creator><pubDate>Wed, 13 May 2026 23:05:01 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Wed, 13 May 2026 22:59:47 GMT]]></title><description><![CDATA[<p><span><a href="/user/bagder%40mastodon.social">@<span>bagder</span></a></span> Always a problem when different systems have different requirements for the handling of something like this; different rules for the handling of the trailing dot, or case sensitivity, or the like. Frustrating that the standards and systems you need to interoperate with, like system hostname resolution, can't agree, so there's never an easy answer.</p>]]></description><link>https://board.circlewithadot.net/post/https://hachyderm.io/users/unlambda/statuses/116569747450671517</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://hachyderm.io/users/unlambda/statuses/116569747450671517</guid><dc:creator><![CDATA[unlambda@hachyderm.io]]></dc:creator><pubDate>Wed, 13 May 2026 22:59:47 GMT</pubDate></item><item><title><![CDATA[Reply to AAAAARGH. on Wed, 13 May 2026 22:44:28 GMT]]></title><description><![CDATA[<p><span><a href="/user/bagder%40mastodon.social">@<span>bagder</span></a></span> <img src="https://board.circlewithadot.net/assets/plugins/nodebb-plugin-emoji/emoji/android/1f602.png?v=28325c671da" class="not-responsive emoji emoji-android emoji--joy" style="height:23px;width:auto;vertical-align:middle" title="😂" alt="😂" />.</p>]]></description><link>https://board.circlewithadot.net/post/https://chaos.social/users/fluffel/statuses/116569687223746072</link><guid isPermaLink="true">https://board.circlewithadot.net/post/https://chaos.social/users/fluffel/statuses/116569687223746072</guid><dc:creator><![CDATA[fluffel@chaos.social]]></dc:creator><pubDate>Wed, 13 May 2026 22:44:28 GMT</pubDate></item></channel></rss>