docs(prd): 0005 — a hosted Moshpit resolver, for devices that cannot run the bridge - #196
Merged
Conversation
…run the bridge A Moshpit ending is not in the ICANN root, so nothing resolves it until the client is told something. Today there is one way to be told, and it is unavailable exactly where people meet a name: a phone cannot run a daemon, a router takes a DNS server and nothing else, and the person you sent the link to has installed nothing. The fallback for all of them is /n/<name>, which works and is not resolution — the URL bar reads pit.moshcode.sh, so the name never becomes the visitor's address, which is the point of holding one. Written as a draft rather than a plan because the central tradeoff is not solvable, only disclosed: a hosted resolver sees every DNS query the device makes, not just Moshpit ones. The PRD says so in the goals, in the UI requirement, and in the risks, and states plainly that the honest outcome may be to not ship it. Deliberately not a replacement for the local bridge, which stays the recommended path wherever it can run. The infrastructure is already half-built — MOSHPIT_DNS_RESOLVERS and MOSHPIT_DOH_URL are read, validated and rendered on /pit/dns, and both are unset in production. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft PRD, no code. Follows the
/pit/dnsquestion: should resolution go to a Moshpit-run DNS server instead of a list on every machine?The gap it addresses
A Moshpit ending isn't in the ICANN root, so nothing resolves it until the client is told something. Today there's exactly one way to be told —
moshcode dns enable— and it's unavailable precisely where people meet a name:resolved.conf.dThe fallback for all three is
/n/<name>. It works, and it isn't resolution: the URL bar readspit.moshcode.sh, so the name never becomes the visitor's address — which is the point of holding one.What it is not
Not a replacement for the local bridge. Where a bridge can run it stays better: nobody else sees the queries, no round trip, no shared outage. This is for clients that can't run one, and the PRD says so in Goals, Non-Goals and R6.
The tradeoff, stated rather than solved
A hosted resolver sees every DNS query the device makes, not just Moshpit ones. That isn't fixable, only disclosed, and the PRD is written accordingly:
/pit/dnsmust state the cost in the same visual weight as the addresses. A page listing an IP with no context gets pasted into a router by someone who hasn't thought about it.Risks section says outright that if the tradeoff is unacceptable, the honest outcome is to not ship this and leave
/n/as the answer for phones.Two things worth knowing
The infrastructure is already half-built.
MOSHPIT_DNS_RESOLVERSandMOSHPIT_DOH_URLare read, validated as real addresses, and rendered on/pit/dns— both unset in production. The shop window exists; the shop doesn't.R5: reuse
src/dns.mjs, don't fork it. The forwarding, the claimed-ending gate, the NODATA/NXDOMAIN distinction and AAAA support all exist and are tested (#195). A second implementation would drift — this codebase has already had that happen five times over with one regex.Cheapest next step
Before building anything: measure how often
/n/is loaded from mobile user agents. If nobody is meeting Moshpit names on phones, this is infrastructure and abuse surface bought for an audience that isn't there.Status is Draft deliberately — this is a decision to make, not a plan to execute.
🤖 Generated with Claude Code