Repository navigation
Add IPv6, RPKI, DANE and TLS configuration pages - #260
Merged
Merged
Conversation
Deploying specification-website with
|
| Latest commit: |
5c6f218
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://97b2c5fe.specification-website.pages.dev |
| Branch Preview URL: | https://claude-internetnl-gaps-86a9b.specification-website.pages.dev |
jdevalk
changed the title
- resilience/ipv6 (recommended): AAAA for web and name servers, same site over v4 and v6, Happy Eyeballs hiding dead AAAA records. - security/rpki (recommended): ROAs and origin validation; for most site owners the action is choosing a host that signs ROAs. - security/dane (optional): TLSA at _443._tcp; no browser validates it, real value is SMTP (links to specification.email). - security/tls-configuration (recommended): TLS compression, renegotiation, 0-RTT, Extended Main Secret, cipher order, signature hashes, certificate key and signature. Linked from https-tls. Also adds BREACH to compression's common mistakes, cross-links DNSSEC, CAA and monitoring, changelog entry, OG images and skill page count. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jdevalk
force-pushed
the
claude/internetnl-gaps-86a9b2
branch
from
October 15, 2026 13:04
e416fdf to
5c6f218
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds four pages covering infrastructure that sits underneath a website: IP reachability, routing security, DNS-pinned certificates, and the finer TLS parameters.
New pages
/spec/resilience/ipv6/(recommended): AAAA records for the web server and the authoritative name servers, and serving the same site over IPv6 as over IPv4. The misconception it names: Happy Eyeballs hides a dead AAAA record in browsers, so operators never notice./spec/security/rpki/(recommended): Route Origin Authorisations and route origin validation. Says plainly that most site owners don't hold address space, so the action is picking a host that signs ROAs; covers web, name and mail servers, and the maxLength guidance from RFC 9319./spec/security/dane/(optional): TLSA records at_443._tcp, which require DNSSEC. No mainstream browser validates them, hence optional; the page points to DANE for SMTP on specification.email as the place DANE does real work. Cross-linked from the DNSSEC page./spec/security/tls-configuration/(recommended): TLS compression, secure and client-initiated renegotiation, 0-RTT (RFC 8470), Extended Main Secret (renamed from Extended Master Secret by RFC 9846), cipher order, key-exchange signature hash, and certificate key and signature. Split out ofhttps-tls, which was already over 1,100 words;https-tlsstays the entry point and links to it from its checklist.Each page says whether this site follows it. IPv6 is shipped (the apex and both name servers have AAAA records). RPKI is shipped through Cloudflare's ROAs, which RIPEstat reports as valid. DANE is not shipped for HTTPS, and the page says why. The TLS parameters come from the CDN.
Edits
performance/compression: BREACH added to common mistakes (mask per-response secrets, or don't compress reflected input next to secrets), with a note that treating all HTTP compression as a risk overstates the exposure.relatedSlugscross-links on dnssec, caa-records, https-tls and monitoring-uptime.addedentry, OG images, and the SKILL.md page count and digest.Open questions
required. This PR leaves the status alone; worth a look at whetherrecommendedfits the status bar better.changedentry, so it isn't logged. Happy to add one.Checks: lint, format:check, astro check, build, check:skill, and an internal-link sweep of the changed pages all pass.
🤖 Generated with Claude Code