feat(pit): a DNS tab, so the namespace is reachable from a machine - #124
Merged
Conversation
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This was referenced Jul 31, 2026
The pit could sell you `scrambled.eggs` and then leave you with no way to open it. Resolvers now exist (moshcoder/moshcoding#77) that answer Moshpit names from this registry and forward everything else to the ordinary internet — this is the page that tells a person how to use one. A tab rather than a link in a paragraph: `/pit` is the namespace and `/pit/dns` is how you reach it, two halves of the same thing, and nobody finds the second one buried in prose. The addresses come from MOSHPIT_DNS_RESOLVERS rather than the source, because they are operational facts that change when a box moves, and a page that keeps telling people to use an address that moved is worse than one that says nothing. Unset — which is today — it says the resolvers are not published yet and explains how to run one. It never invents an address for a stranger to paste into their network settings, and entries that are not addresses are dropped rather than rendered. Also states what does not work: HTTPS on a Moshpit name warns, because no public CA will issue for a namespace outside the ICANN root, and clearnet lookups are forwarded to Google and Cloudflare. Both are reasons to run your own, which the page then tells them how to do. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`/pit?name=mosh.whatever` is where a resolver or the gateway sends someone
whose name did not resolve to a site. They have just demonstrated demand for a
name, so the page opens with what they can do about it rather than a 404.
Four honest answers, because what can be offered depends on who holds the
ending, and today only a TLD's owner may mint names under it:
nobody holds `.whatever` -> claim the ending, prefilled; the name and every
other one under it comes with it
you hold it -> one form, prefilled, registers `mosh.whatever`
you already minted it -> it is yours, it is in your list
someone else holds it -> say so. `registerName` refuses anyone but the
owner and there is no way for them to sell it
through the pit yet, so an offer button would be
an invitation into a flow that does not exist
The decision lives in lib/moshpit-landing.mjs with no database and no request,
so the wording is testable and cannot drift from the rule it describes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ralyodio
force-pushed
the
feat/pit-dns-tab
branch
from
July 31, 2026 04:43
1b593c3 to
69c7d7c
Compare
ralyodio
marked this pull request as ready for review
July 31, 2026 04:45
ralyodio
added a commit
to moshcoder/moshcoding
that referenced
this pull request
Jul 31, 2026
…ge (#79) Someone types `mosh.whatever`. Today the registry has no ending called `.whatever`, so the resolver hands back clearnet's verdict — NXDOMAIN, a browser error page, and a person who just demonstrated demand for a name walks away. This turns that into the front door. Two halves. The gateway now redirects any Moshpit Host it does not serve to `app.moshcode.sh/pit?name=<host>`, where the pit offers them the ending the name sits under (moshcoder/moshcode#124). A redirect rather than a proxy: proxying would leave people signing in under a hostname no CA will vouch for, with a session cookie on a domain the app does not own. The other half is MOSHPIT_DNS_CATCHALL, off by default, which makes unclaimed names resolve to the gateway at all. Without it the funnel only works for endings someone already claimed, which is the wrong half of the audience. The boundary is the entire feature. `asdkjh.com` is NXDOMAIN too, and answering it would make this a typo-squatter for the whole internet — the behaviour ISPs were rightly hated for. So the catch-all fires only when the TLD itself is absent from the legacy root, checked by asking the upstreams for its SOA (one cached query per ending, not per name) rather than by shipping an IANA list that is stale the week after it is written. An unreachable upstream fails closed: unknown means the root has it, because the alternative is handing the internet to the catch-all during an outage. Answers say what they are: `aa` is 0 since nobody holds the name, and TXT reports `unclaimed=1`. Off by default — answering for names the registry never granted is a product decision, not a default a resolver should assume. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The pit will sell you
scrambled.eggsand then leave you with no way to open it. Resolvers now exist (moshcoder/moshcoding#77) that answer Moshpit names from this registry and forward everything else to the ordinary internet. This is the page that tells a person how to use one.A tab, not a link in a paragraph.
/pitis the namespace,/pit/dnsis how you reach it — two halves of the same thing, and nobody finds the second one buried in prose.The page
MOSHPIT_DNS_RESOLVERS.dig +short anything.moshpitnext todig +short example.com, because "did I break the internet" is the first question.https://on a Moshpit name warns (no public CA will issue for a namespace outside the ICANN root), and clearnet lookups are forwarded to Google and Cloudflare.Addresses are config, not source
They are operational facts that change when a box moves, and a page that keeps telling people to use an address that moved is worse than one that says nothing.
Unset — which is the state today — the page says the resolvers are not published yet and explains how to run one. It never invents an address for a stranger to paste into their network settings, and entries that are not addresses are dropped rather than rendered, since that list exists to be copied into network settings.
Verified
/pit/dns) and without (the "not published yet" copy, no invented address)./pitstill 200s with the tab strip andNamespaceactive.🤖 Generated with Claude Code