fix(moshpit): a real extension outranks a claimed ending by default - #114
Merged
Conversation
`moshcode.sh` was 307-redirecting to `pit.moshcode.sh/n/moshcode.sh` — the Pit's page for a name it says nobody holds — instead of serving its own tenant page. Any two-label domain parked here is affected: `.io`, `.dev`, `.app`, `.ai`, `.sh` and `.co` are all claimed endings today, out of 17,848. `isMoshpitName()` read `registered` from the Pit's resolve endpoint and treated it as "this host is a Moshpit name". It is not: `registered` means "the pit holds this ending", and the Pit already ships the rule for what to do about it in `prefer` — clearnet nothing registered here fallback use the pit only where the legacy root has no answer (default) moshpit use the pit even where the legacy root answers (opt-in) Reading `registered` alone collapses "fallback" into "moshpit" and hands the pit every domain whose ending someone claimed. So honour `prefer`, and settle "fallback" the way the extension does: ask a public resolver whether the legacy root answers for the name. Only a definitive NXDOMAIN sends a visitor to the Pit — a timeout or a SERVFAIL must never be why a working domain starts offering itself to strangers. The opt-out is the variable the resolvers already use, `MOSHPIT_RESOLVE_MODE`, so one vocabulary covers the extension, the DNS bridge and this app. docs/moshpit-dns.md already stated this policy; the web app was the one place not applying it. Names under an ending the legacy root has never heard of are unchanged — the root NXDOMAINs `scrambled.eggs`, so it still goes to the Pit (#88). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan21 finding(s) HIGH/CRITICAL: 8 | MEDIUM: 9 | LOW: 4
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
https://moshcode.shdoes not serve its own page. It 307s tohttps://pit.moshcode.sh/n/moshcode.sh— the Pit's page for the name, whichreads "Nobody holds this name."
wwwgets there in two hops:It is not DNS.
moshcode.shresolves fine, to this app's Railway service. Theredirect is ours, from
app/page.tsx:Why
isMoshpitName()asked the Pit's/api/moshpit/resolveand readregistered.That flag does not mean "this host is a Moshpit name" — it means "the pit
holds this ending". Someone claimed
.sh, so our own domain matched.The Pit already ships the rule for what to do about that, in
prefer:preferclearnetfallbackmoshpitReading
registeredalone collapsesfallbackintomoshpit, which hands thepit every domain whose ending someone claimed. Not a one-domain problem — of
the 17,848 claimed endings, these real TLDs are already taken:
.io.dev.app.ai.sh.co.com.net.orgmoshscript.comworks today only because.comhappens to be unclaimed.The fix
Honour
prefer, and settlefallbackthe way the extension does — ask apublic resolver whether the legacy root answers for the name. A real extension
wins by default; overriding the legacy internet stays something you opt into.
counts as "the root answers", so a blip is never why a working domain starts
offering itself to strangers.
Moshpit bridge answers for
.eggsitself and the question would answer itself.MOSHPIT_RESOLVE_MODE=moshpit, the same variable the resolversand the browser extension already use, so one vocabulary covers all three.
preferstill gets the new behaviour — the rule isderived from
registered+ mode.docs/moshpit-dns.mdalready stated this policy ("clearnet owns any nameclearnet can answer... indistinguishable from a hijack"). The web app was the
one place not applying it.
Not changed
Names under an ending the legacy root has never heard of. The root NXDOMAINs
scrambled.eggs, so it still goes to the Pit — #88 intact, and covered by atest.
Testing
bun test tests/— 215 pass, 0 fail (16 inmoshpit-tlds, up from 11)bunx tsc --noEmit— cleanclaimed ending still fills a gap the root leaves; the operator override; the
mode reaching the Pit; an unreachable root is not a reason to redirect; and
the old-Pit fallback path.
After merge
Railway redeploys on merge. Worth confirming:
curl -sS -o /dev/null -w '%{http_code} -> %{redirect_url}\n' https://moshcode.sh/Expect
200and no redirect. Separately, the claimed.io/.dev/.app/.ai/.sh/.coendings are worth releasing registry-side, and the Pit arguably should not let a
real TLD be claimed as an ending at all — neither is needed for this fix.
🤖 Generated with Claude Code