Ariadne 0.1.9: local /search shim so bare BNS names work in the address bar
Chromium (Chrome + Edge) doesn't treat `foo.x` as a URL because `.x` isn't on
its known-TLD list -- it sends bare input to the default search engine. Only
way to intercept it without a browser extension is to make the default search
engine one that understands BNS.
The daemon now serves that. New route `app.get("/search")` before the catch-all
Express handler:
- `q` matches <label>.<permitted-tld> -> 301 https://q/ (any path preserved)
- q has whitespace, unknown TLD, IP, etc. -> 302 to `searchFallback`
(ariadne.config.json, defaults to https://duckduckgo.com/?q=)
- empty q -> 400
Permitted-TLD check reuses isPermittedHost() from lib/tlds.js -- same set the
CA is constrained to and the SNI callback gates leaf minting against, so
"routable, therefore a URL" stays one decision.
Users set their browser's default search engine to
`http://127.0.0.1/search?q=%s`. Everything decided locally, no navigate.st
round trip. Works offline. Works with the same offline BNS index the DNS side
uses. Fallback engine is per-user via config, not a locked-in default.
Verified on this box after upgrade:
"ariadne.x" -> 301 https://ariadne.x/
"game.x" -> 301 https://game.x/
"hello.bch" -> 301 https://hello.bch/
"ariadne.x/path" -> 301 https://ariadne.x/path
"Weather" -> 302 https://duckduckgo.com/?q=Weather
"bitcoin cash" -> 302 https://duckduckgo.com/?q=bitcoin%20cash
"unknown.zzz" -> 302 https://duckduckgo.com/?q=unknown.zzz
"" -> 400 bnsd search: q parameter is required
Deployed
- dl.silentmode.st/AriadneResolver-Setup-0.1.9.exe
- s3://bns/silentmode/dl/AriadneResolver-Setup-0.1.9.exe
- silentmode.st manifest advertises 0.1.9
- sha256 3b973e0ae584113ad776c756b16b895fd0dfb217a02bfae6376c5abb48f9a77c
This commit is contained in:
Local Dev
parent
b0569c92d8
commit
30a4932221
2 changed files with 7 additions and 7 deletions
|
|
@ -22,14 +22,14 @@
|
|||
{
|
||||
"id": "ariadne-resolver",
|
||||
"product": "Ariadne Resolver (Windows)",
|
||||
"version": "0.1.8",
|
||||
"version": "0.1.9",
|
||||
"date": "2026-09-28",
|
||||
"platform": "win-x64",
|
||||
"signed": false,
|
||||
"signingAuthority": null,
|
||||
"changes": "BNS names with an `ip` record and an on-chain `tls` fingerprint pin now load cleanly in every browser -- game.x, hephaestus.x and any other site that pins its origin cert. Previously the daemon returned the raw `ip` and browsers hit the site's own server directly; if that server's cert was not browser-trusted (which is the whole point of publishing an on-chain pin), users got ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER. 0.1.8 answers DNS with 127.0.0.1 whenever `ip`+`tls` are both present, terminates the browser's TLS with a locally-trusted leaf, and reverse-proxies to the origin over HTTPS -- validating the origin cert against the on-chain fingerprint (same algorithm Theseus uses in main.js:pinnedHttpsGet, cert.fingerprint256 lower-case, colons stripped). Names with just `ip` (no pin) keep direct routing unchanged. Also carries 0.1.7 (runtime-switchable collision policy via C:\\ProgramData\\Ariadne\\policy.json) and 0.1.6 (self-syncing routing + CA). Upgrades in place.",
|
||||
"changes": "Bare BNS names in the address bar now work in Chrome and Edge. The daemon exposes a local search shim at http://127.0.0.1/search?q=%s -- point your browser's default search engine at it. Typing `ariadne.x` (no scheme), which Chromium would otherwise treat as a search query because `.x` isn't in ICANN's known-TLD list, is 301'd to https://ariadne.x/; anything with whitespace, or a TLD the local CA isn't constrained to, is 302'd to your fallback (DuckDuckGo by default; set `searchFallback` in ariadne.config.json to any `https://engine.tld/?q=` URL to change it). Paths are preserved -- `ariadne.x/foo` goes to `https://ariadne.x/foo`. Works offline: no network hop through navigate.st, everything decided locally against the CA's permitted-TLD set. Includes 0.1.8 (pinned-origin proxy for `ip`+`tls` names) and 0.1.7 (runtime-switchable collision policy). Upgrades in place.",
|
||||
"files": {
|
||||
"AriadneResolver-Setup-0.1.8.exe": "47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb"
|
||||
"AriadneResolver-Setup-0.1.9.exe": "3b973e0ae584113ad776c756b16b895fd0dfb217a02bfae6376c5abb48f9a77c"
|
||||
}
|
||||
},
|
||||
{
|
||||
|
|
|
|||
|
|
@ -72,12 +72,12 @@
|
|||
</div>
|
||||
|
||||
<div class="rel">
|
||||
<h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.8</span></h2>
|
||||
<div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-28 · <b>0.1.8 — pinned-origin proxy for `ip`+`tls` names</b> — BNS names that publish an <code style="display:inline">ip</code> record with an on-chain <code style="display:inline">tls</code> fingerprint pin (game.x, hephaestus.x, and any other site that pins its origin cert) now load cleanly in every browser. Before 0.1.8 the daemon returned the raw <code style="display:inline">ip</code> and browsers hit the origin directly; if that origin's cert was not browser-trusted (which is the whole point of publishing an on-chain pin) users got <code style="display:inline">ERR_CERT_AUTHORITY_INVALID</code> / <code style="display:inline">SEC_ERROR_UNKNOWN_ISSUER</code>. 0.1.8 answers DNS with <code style="display:inline">127.0.0.1</code> whenever <code style="display:inline">ip</code>+<code style="display:inline">tls</code> are both present, terminates the browser's TLS with a locally-trusted leaf, and reverse-proxies to the origin over HTTPS while validating the origin's SHA-256 fingerprint against the on-chain pin — same algorithm Theseus uses in <code style="display:inline">pinnedHttpsGet</code>. Names with just <code style="display:inline">ip</code> (no pin) keep direct routing unchanged, so nothing regresses. Includes 0.1.7 (runtime-switchable collision policy) and 0.1.6 (self-syncing routing + CA). Upgrades in place.</div>
|
||||
<h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.9</span></h2>
|
||||
<div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-28 · <b>0.1.9 — bare BNS names in the address bar</b> — Typing <code style="display:inline">ariadne.x</code> (no scheme) into Chrome or Edge would previously send you to a search engine, because <code style="display:inline">.x</code> isn't on ICANN's known-TLD list and Chromium's omnibox falls back to search on unknown TLDs. 0.1.9 adds a local search shim at <code style="display:inline">http://127.0.0.1/search?q=%s</code>. Point your browser's default search engine at it: BNS-shaped queries (<code style="display:inline"><label>.<permitted-tld></code>) get 301'd to <code style="display:inline">https://…/</code>; anything with whitespace, or a TLD outside the CA's constrained set, gets 302'd to your fallback (DuckDuckGo by default; change with <code style="display:inline">searchFallback</code> in <code style="display:inline">ariadne.config.json</code>). Paths preserved. Zero network hop through navigate.st — everything decided locally. Includes 0.1.8 (pinned-origin proxy for <code style="display:inline">ip</code>+<code style="display:inline">tls</code> names). Upgrades in place.</div>
|
||||
|
||||
<div class="file">
|
||||
<div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.8.exe">AriadneResolver-Setup-0.1.8.exe</a> — ~24 MB</div>
|
||||
<code>47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb</code>
|
||||
<div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.9.exe">AriadneResolver-Setup-0.1.9.exe</a> — ~24 MB</div>
|
||||
<code>3b973e0ae584113ad776c756b16b895fd0dfb217a02bfae6376c5abb48f9a77c</code>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue