Uh oh!
There was an error while loading. Please reload this page.
feat(parking): host-parked Moshpit names go to the Pit too - #88
Merged
Conversation
#87 moved /parking?name= to the Pit, but that is not how a parked name actually arrives. The DNS resolver points an unpointed name at this app (DEFAULT_PARKING_HOST), so `curl scrambled.eggs` lands here as a Host header and still rendered the "IS COMING" tenant card. A name resolved from the Host now redirects to <pit>/n/<name>, while an ordinary parked clearnet domain renders exactly as before. Which is which is asked of the Pit per name, not by pulling its ending list: that list is capped at 200 and `.eggs` already falls outside it, so matching against it would quietly answer "no" for real names. resolve's `registered` flag has no such ceiling. 307, not 308. The owner can point the name at a real target at any moment; a permanent redirect cached in a browser would keep sending them here long after this app stopped being the answer. /parking keeps its 308 — that URL will always mean "go to the pit". Fails closed: an unreachable Pit answers "not ours", so a registry outage leaves every parked domain rendering as it does today rather than bouncing the whole internet at /n/. Answers are memoised per name behind a 5-minute TTL, with a bounded map because Host is attacker-controlled. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
Uh oh!
There was an error while loading. Please reload this page.
ralyodio added a commit
that referenced
this pull request
Aug 17, 2026
…114) `moshcode.sh` was 307-redirecting to `pit.moshcode.sh/n/moshcode.sh` — the Pit's page for a name it says nobody holds — instead of serving its own tenant page. Any two-label domain parked here is affected: `.io`, `.dev`, `.app`, `.ai`, `.sh` and `.co` are all claimed endings today, out of 17,848. `isMoshpitName()` read `registered` from the Pit's resolve endpoint and treated it as "this host is a Moshpit name". It is not: `registered` means "the pit holds this ending", and the Pit already ships the rule for what to do about it in `prefer` — clearnet nothing registered here fallback use the pit only where the legacy root has no answer (default) moshpit use the pit even where the legacy root answers (opt-in) Reading `registered` alone collapses "fallback" into "moshpit" and hands the pit every domain whose ending someone claimed. So honour `prefer`, and settle "fallback" the way the extension does: ask a public resolver whether the legacy root answers for the name. Only a definitive NXDOMAIN sends a visitor to the Pit — a timeout or a SERVFAIL must never be why a working domain starts offering itself to strangers. The opt-out is the variable the resolvers already use, `MOSHPIT_RESOLVE_MODE`, so one vocabulary covers the extension, the DNS bridge and this app. docs/moshpit-dns.md already stated this policy; the web app was the one place not applying it. Names under an ending the legacy root has never heard of are unchanged — the root NXDOMAINs `scrambled.eggs`, so it still goes to the Pit (#88). Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#87 moved
/parking?name=to the Pit — but that isn't how a parked name actually arrives. The DNS resolver points an unpointed name at this app (DEFAULT_PARKING_HOST = moshcoding.com), socurl scrambled.eggslands here as a Host header and still rendered the "IS COMING" tenant card.Change
A name resolved from the Host now redirects to
<pit>/n/<name>. An ordinary parked clearnet domain renders exactly as before.Measured locally against the live registry:
scrambled.eggs307→https://pit.moshcode.sh/n/scrambled.eggshawaiian.chicken307→https://pit.moshcode.sh/n/hawaiian.chickenmoshcode.sh200—<title>Moshcode IS COMING</title>(tenant page, untouched)200— the landing pageThree decisions worth flagging
Asked per name, not by pulling the ending list.
/api/moshpit/tldsis capped at 200 and.eggsalready falls outside it — matching against that list would quietly answer "no" for real names.resolve'sregisteredflag has no such ceiling and means exactly "an ending the pit holds".307, not 308. The owner can point the name at a real target at any moment; a permanent redirect cached in a browser would keep sending visitors here long after this app stopped being the answer.
/parkingkeeps its 308, because that URL will always mean "go to the pit".Fails closed. An unreachable Pit answers "not ours", so a registry outage leaves every parked domain rendering as it does today rather than bouncing the whole internet at
/n/. Answers are memoised per name behind a 5-minute TTL, in a bounded map —Hostis attacker-controlled, so the memo can't be allowed to grow without end.Verification
bun test tests/— 157 pass, 0 fail (9 new), covering ours/not-ours, shape rejection without a request, memoisation, case normalisation, fail-closed on outage and non-200, and warm-cache survivalbun run buildcleanLocationheaders with realHostheaders — the table above is measured🤖 Generated with Claude Code