Re: [Bug-wget] Overly permissive hostname matching

[Daniel Kahn Gillmor]

On 03/19/2014 11:55 AM, Jeffrey Walton wrote:
> Also, be careful of where you are pulling the list from. I got burned
> by pulling a list that was not being updated
> (https://bugzilla.mozilla.org/show_bug.cgi?id=968064).

i've been similarly burned before too, but i settled on the mxr address
i just posted after trying a few other places.

> The Mozilla folks state the canonical list is at
> http://publicsuffix.org/list/effective_tld_names.dat. See Comment 11
> at https://bugzilla.mozilla.org/show_bug.cgi?id=968064#c11.

i just followed up there to point out that the canonical location for
the data needs to have some form of cryptographic integrity mechanism.
thanks for pointing that out.

        --dkg

signature.asc
Description: OpenPGP digital signature