Hacker News

Before this submission, it genuinely never occurred to me that people would actually have tests that rely on example.com being up, let alone depend on its content.

Opus 5.5 in Claude code added a unit test checking DNS and internet access using example.com as the target on a project I'm building yesterday. It's an agent sandbox (I know, yet another), so the call was expected to fail, but still... It should have at least targeted a captive portal endpoint or a project owned domain.

I caught it in review but thousands of others won't.

That ship has sailed I would say.

I have been naively using example.com in the browser. WHATWG URL throws if there is no origin when constructing the URL. Web apps that need to construct _just_ the pathname must go through this song and dance. `new URL("/blah", "https://example.com").pathname` This isn't relying on any external example.com service but I'm learning the lesson.

So is wrong to use captive.apple.com for tests as well? It's nice to know your network can reach the internet and these pages are generally fairly reliable.

[1]: https://captive.apple.com/

People depend on all sorts of weird stuff working exactly as expected. https://www.hyrumslaw.com/

As an example, depending on "man -w" not outputting anything to stderr: https://unix.stackexchange.com/questions/405783/why-does-man...

While not the same thing, I was once stung by a test failing because a dependency of a dependency decided on a minor version bump that foo@example.com wasn't a valid email address.

Probably akin to: https://xkcd.com/1172/

I like using http://neverssl.com/ for that... easy to remember (although I guess example.com was as well).

Same server also has an endpoint for that: http://no-tls.testserver.host. Sends RST for any attempted TLS connections, so clients always fall back to plain HTTP.

Also as a _long_ list of other specialist TLS endpoint configurations if you're interested, which can be arbitrarily combined, see https://testserver.host/#tls-endpoints.

That gives neat tricks like https://tls-v1-2--expired--incomplete-chain--http2.testserve...: only accepts TLS 1.2, then sends an expired certificate but fails to send the intermediate cert for the chain (so the client must infer it) and then negotiates HTTP/2 for the connection on top. Fun!

> the status page for a major CDN (such as Cloudflare or Akamai)

Would you settle for any old static page served by Cloudflare? For instance, example.com? https://bgp.tools/dns/example.com

> go hit the home page of a tech megacorp (such as Microsoft or Google)

Much too big for metered data, full of ads, and importantly they all mandate HTTPS these days, which breaks my use case of forcing a captive portal on paid/login-gated Wi-Fi to render.

example.com is (unfortunately for the IATA) the almost perfect "can I reach the Internet" service: It's unlikely to go away, supports HTTP, is fairly small, easy to remember, and I don't care if a captive portal poisons my DNS cache with a fake response temporarily.

example.com-as-a-service, although XaaS is no longer hip so now it'll be example.ai, an AI that will generate an example.com style landing page using frontier AI models. $20 / month for the beginner plan (100 requests/month), contact us for pricing.

Enterprise ready. Coming soon in Q4.

Go a step further and randomize it. Different page at every request.

… then you'll be back in the world before CloudFlare set up its public DNS service, which is also the world where taking over 1.1.1.1 in the first place came at the price of having to measure how many people had ignorantly or lazily put four ones into somewhere that they had to fill in an IP address, and how much bogus and positively risky (to them) traffic there was being caused by people just thinking 'I will just use 1.1.1.1, which is not a real IP address.'.

Just before COVID, a random unidentifiable person reported that 1.1.1.1 saw 60Mb/s of ICMP echo traffic. When APNIC first experimented with making it a valid network almost a decade before that, it was being sent 50Mb/s of general IP traffic. Amusingly, a side-effect of what CloudFlare has done is that it has stopped all of that traffic leaving the edges of the Internet, and funnelling in to one big central place.

There are those who remember the risks of 'just use 1.1.1.1' and how the people who did that used be characterized as 'bad Internet citizens'. The ServerFault answer (q.v.) is from 2011.

* https://labs.ripe.net/author/franz/pollution-in-18/

* https://news.ycombinator.com/item?id=19335833

* https://serverfault.com/a/339782

I don’t use this one, because I remember when long, long ago it was in some random IP address block belonging to someone, and this particular address didn’t reply to ping.

Likely for good reason, even back then there would have bound to be lots of misconfigured endpoints trying to access 1.1.1.1, so just blocking it at the earliest point possible kept at lot of the annoyance away. Nowadays, it’s an anycast address, so it’s slightly less bad.

But for me, old habits die hard.

I've already seen a couple of train hotspots respond locally to pings directed at 1.1.1.1 and 8.8.8.8, apparently in effort to convince devices that they are on a good network event if the internet itself is broken due to being in the tunnel.

If 1.1.1.1 fails, I will try 8.8.8.8

> 1.1.1.1

Pinging such an address is inherently a troublesome practice. This address, like many public DNS servers (resolvers as well as root and authoritative ones), uses "anycast" routing methodology.

https://en.wikipedia.org/wiki/Anycast

Pinging an anycast address will yield a cornucopia of different results. Of course, people who naïvely "ping" a recognizable or easy-to-type IPv4 address get what they deserve, especially when they enshrine it into software, unit tests, or the LLM coughs up such tokens on their behalf.

Fundamentally, the question is "what do you really want to test?" by pinging a particular IPv4? Do you want to test Layer 3 connectivity? Test your ISP's backbone and connectivity? Test only your upstream router? Test the existence of ICMP in your stack and theirs?

... the possibilities are endless. Your router can do anything. Ping zombo.com.

For some reason the localization still requires javascript... (I'm pretty sure the transition could have been done in just CSS as well)

What makes you think it's edited?

The hilariously ironic thing is that Dunk, a Google Engineer, went out of their way to make a hyperlink of "example dot com" so that people could tap and visit the site, even where Davies' email specifically reiterates that the domain is for documentation purposes only and nobody should ever be actually visiting the site!

McCarthy of DebugBear clearly noticed this admonition and perhaps the mistake as well, because they have carefully highlighted "example.com" without linking to it, although they apparently have visited the site in order to copy and cite screenshots and unpack the CSS, and describe an extensive history of it.

Wouldn't help OC if their system is dark mode.

> Just select the preferred color.

I kinda expected this to be Ford Model T "Any color the customer wants, as long as it’s black" joke.

Guess I am part of the problem. Thank you for the link kind stranger.

Thanks. But you also forgot to include the link. You used the example domain https://example.com/ but forgot to substitute the correct address of the website. In this case that would be https://example.com/

By typing it or copy+pasting it, which is much more time consuming and much less convenient.

(I actually tried the select, share [sic], open in browser route, but for some reason I only saw opera as an option, not chrome, the browser I actually use for everything. Links still rule.)

Someone else could

It’s not incompetence they are intentionally doing as much as possible via javascript to reduce their bandwidth costs. This is because most access to the domain is automated (not using a browser, using curl etc) and doesn’t load javascript

Wouldn't removing the pointless SVG image entirely save the most precious bytes from being served no matter if JS (or SVG) is supported or not?

I get nothing but a gray page with the following with JS disabled https://i.imgur.com/81aYPeB.png in Firefox via javascript.enabled set to false.

You may want to check your settings again or clear you cache as there is definitely a `s.js`[0] file that inserts the `<svg>` element into the HTML DOM[1], which you can see does not contain the element itself.

0

```

var B = document.body, P, p; B.children[0].insertAdjacentHTML("afterend", "<p lang=ar dir=rtl>هذا النطاق مُخصص للاستخدام في أمثلة التوثيق دون الحاجة إلى إذن. هذه ليست خدمة، يُرجى تجنب الاعتماد عليها لأغراض الاختبار والمراقبة.</p><p lang=zh>该域名仅用于文档示例，无需获得许可。这并非一项服务，请勿将其用于测试和监控目的。</p><p lang=fr>L’usage de ce domaine est réservé à des exemples de documentation, sans autorisation préalable. Il ne s’agit pas d’un service ; son utilisation à des fins de test ou de surveillance est à éviter.</p><p lang=ru>Данный домен предназначен для использования в примерах документации без необходимости получения предварительного разрешения. Это не сервис; не рекомендуется его использование для тестирования и мониторинга.</p><p lang=es>Este dominio está destinado al uso en ejemplos de documentación sin necesidad de permiso. Esto no es un servicio; evitar utilizarlo para realizar pruebas o monitoreos.</p><a href=https://iana.org/help/example-domains>Learn more</a>"); P = [...B.querySelectorAll("p")]; P[0].lang = "en"; navigator.languages.some(l => p = P.find(p => p.lang == l.split("-")[0])); p = p || P[0]; B.prepend(p); B.insertAdjacentHTML("afterbegin", '<style>svg{display:block;margin:-2.75em auto 0;opacity:.55}p+p{font-size:.875em;opacity:.6}</style><svg viewBox=0,0,20,20 width=44 height=44 fill=currentColor aria-hidden=true><path fill=none stroke=currentColor stroke-width=1.3 stroke-linejoin=round d="M6 4H3v12q4 0 7 1.5-1-3.5-4-4.5V2q3.5 1 4 3v12.5q3-1.5 7-1.5V4q-4.5 0-7 1"/><g transform=rotate(-6,13.6,8.3)><path id=q d="M11.5 6.6h1.8v1.8l-1 1.6-.6-.3.8-1.3h-1z"/><use href=#q x=2.4 /></g></svg>')

```

1

```

<!doctype html> <html lang=en> <head> <meta charset=utf-8> <link rel=icon href=data:,> <meta name=viewport content="width=device-width,initial-scale=1"> <title>Example Domain</title> <style> html { color-scheme: light dark; background: light-dark(#eee,#222) }

            body {
                font: 16px/1.6 system-ui,sans-serif;
                max-width: 26em;
                margin: auto;
                padding: 25vh 2em 2em;
                text-align: center
            }
        </style>
    </head>
    <body>
        <p>This domain is for use in documentation examples without needing permission. This is not a service; avoid relying on it for testing and monitoring purposes.</p>
        <script src=/s.js></script>
    </body>

```

I never queried it _automatically_, but many projects do. They might not have set out to provide that use, but what happened has happened, and breaking this implicit contract for a silly redesign is an odd choice.

I see the government continues to try solving impossible problems in the shadows. A pity.

HN is currently anti Cloudflare. The only thing worse probably would’ve been to serve the static files on GitHub.io

http://neverssl.com/online/ seems to work for me?

Are you perhaps on an untrusted network which is spoofing that url to make it redirect somewhere else?

BTW, a "background:white;" for the body improves things. But still, the versions from 2013 or 2019 are much better in my opinion.

Nonsense. One may very well explain to a newbie how to link to an external site using example.com as target. Though I would not do it, with that layout. I would link to Google probably.

It's English at the top for you. The top language depends on your browser settings afaik.

Not an advert. I wish we ran example.com. However, we run a few other services.

The issue with example.com is this statement:

> This domain is for use in documentation examples without needing permission. This is not a service; avoid relying on it for testing and monitoring purposes.

The problem is that, disclaimer or not, if a website provides a useful utility, people will use it as a service.

If example.com breaks, IANA can reasonably say it was never intended to be stable. But that does not change the fact that people will use it for testing and monitoring.

What we do is adopt legacy services whose maintainers can no longer afford, want, or have the resources to maintain them, and invest in keeping them running reliably.

neverssl.com is slightly better for that, since it resists caching.

Not to mention indefinitely. Any decommission, even decades in the future, will be messy. Or imagine if ipinfo got bought up by private equity and they turned off the free service, or maybe attached some sort of agent-pay token to the response[0] so that they collect revenue from running it when possible.

0: https://blog.cloudflare.com/monetization-gateway-beta/

I hate this with a passion. Google is very guilty of this. Their AI summary very often insists on replying in the (IP) local language, nevermind the language of my HTTP headers, Google profile, or the actual natural language request...

Do you have ca-fr (or whatever) in your accept language header?

Yep, that's exactly their reasoning:

> As it tends to be heavily trafficked, the overall bandwidth is a key consideration

Then they should have just kept it english only without any script.

Interesting, didn’t know that. Also I would have expected German and Hindi to be official UN languages given the number of native speakers in the world