LLMs.txt is also nonsense since it isn't adopted by any of the major AI players.

> expertise claimed by the author

The author is on record as trying to remove HTTP 418 "I'm a teapot" support from NodeJS, which resulted in backlash and Python adding support for it.

https://en.wikipedia.org/wiki/Hyper_Text_Coffee_Pot_Control_...

The point of the post was that you need to add robots.txt (or similar) because it's a thing, and also tell us where they are.

The so-called "modern" web browsers send SNI to all websites even when not required

For example, Firefox would send SNI to archive.org even though TLS connections to archive.org without sending SNI work just the same

Some www users dislike SNI because it defeats the puported purpose of "encrypted DNS". It reveals domain names in plaintext on the wire. For some www users, this does not qualify as "operating securely"

SNI benefits CDNs and arguably their customers. But the benefits, if any, to www users may be offset by the costs of sending plaintext domain names

I'm selective about sending SNI. I don't send it when it isn't necessary. There are still many sites not using CDNs

I accomplish this selectivity by _not_ using a so-called "modern" browser to make remote HTTP requests. I can also force TLSv1.3 by not using the browser to send remote HTP requests

Nor do I use DNS lookups when I make remote HTTP requests. I have collected the DNS data in bulk at regular intervals from a variety of sources that I can cross check against each other. This works well for me but might not be appropriate for others

Every www user is different

Some might like SNI, they might not care about plaintext domain names

To each their own

SNI is good, though? I'm curious how you are running into this.

What do you mean? It was explicitly designed to be a junk drawer.

A junk drawer is an improvement over scattered junk.

Isn't that the point though? Keeping all the junk in a drawer labeled as junk, instead of keeping it on the kitchen counter?

Your own spec wouldn't be used by anyone else.

The password-reset well-known endpoint is used by password managers to show a "Change password..." button in their interface, which magically links to the password change page described in that well-known file.

> Why discord domain verification instead of domain-verifications with a dynamic list on entries?

The TXT record itself is already a dynamic list of entries. It's far simpler and easier to iterate through the list and compare the start of each value with your search string until you find "discord domain verification" directly than it would be to do anything else.

Example:

    ;; ANSWER SECTION:
    ycombinator.com.        300     IN      TXT     "openai-domain-verification=dv-QbhxxK0G0JK0dnyZ4YTsNAfw"
    ycombinator.com.        300     IN      TXT     "v=spf1 include:_spf.google.com include:mailgun.org a:rsweb1-36.investorflow.com include:_spf.createsend.com include:servers.mcsv.net -all"
    ycombinator.com.        300     IN      TXT     "MS=ms37374900"
    ycombinator.com.        300     IN      TXT     "anthropic-domain-verification-0qe2ww=yK576oHdDgyTcXgkPfj1KXgGt"
    ycombinator.com.        300     IN      TXT     "ZOOM_verify_2ndw8KZxSRa8PT8NmdyXvw"
    ycombinator.com.        300     IN      TXT     "google-site-verification=KsI69Y_jEVkp4eXqSQ9R9gwxjIpZznvuvrus6UolB9Y"
    ycombinator.com.        300     IN      TXT     "ca3-4861b957e83847c188e45d04ec314ee3"
    ycombinator.com.        300     IN      TXT     "apple-domain-verification=WG0sP5Alm7N6h1Te"
    ycombinator.com.        300     IN      TXT     "dropbox-domain-verification=asc63coma4mv"
    ycombinator.com.        300     IN      TXT     "google-site-verification=GJKdQskycEclAGPua3yXB9m_nVhxbrsVps_y-t9SXV0"
    ycombinator.com.        300     IN      TXT     "Wayback verify for support request 741082"
    ycombinator.com.        300     IN      TXT     "google-site-verification=rivq8jKu6AADGtbbEzJhmOpcqq08B7QxIzXxYV8DtyU"
    ycombinator.com.        300     IN      TXT     "rippling-domain-verification=a660f7a4ab77a3de"

> discord domain verification

That’s on Discord. They’re not in the registry: https://www.iana.org/assignments/well-known-uris/well-known-...

> Why password-reset instead of a more generic link tree?

[edit: answered in more detail in a sibling thread https://news.ycombinator.com/item?id=48596286]

Slightly less well-known than XDG directories among the developers of Linux-targeted software, it would seem.

Seriously, what an oxymoronic name. "/index.html" is a well known URL, literally: most of web-developers are aware of it. But inventing a bunch of URLs with predefined semantics and then slapping the "well-known" label on it... well, it won't magically make them actually well-known.

I spent 10 minutes searching for one in the article, in the RFC, in the wikipedia page, on google, to search for a .well-known example. Couldn't find one.

I did read one before while working with github oidc, and I did find it very useful.

What is it with technical documentations that go deep describing what it is in plenty words but refusing to give a single example? This far from the first case I've ran into either.

There's an interesting list on Wikipedia: https://en.wikipedia.org/wiki/Well-known_URI#List_of_well-kn...

They are collected at this registry: https://www.iana.org/assignments/well-known-uris/well-known-...

I agree. I was hoping for a few positive examples, but didn't see any. The only one I know of is the OIDC discovery endpoint.

Whoever decided it would be a good idea for ".well-known" to be a "hidden" directory is a complete fool. All it does is provide the opportunity for confusion, misconfiguration, skipped backups, missed git check-ins, forgotten updates and more. Literally the only people a folder like that is hidden from is the whoever is managing the web server.

Sure, if everyone knows what they're doing, it's not a problem. But we all know how long that assumption lasts.