diff --git a/apps/pwa/src/routes/moshpit.mjs b/apps/pwa/src/routes/moshpit.mjs index 34461e9..7398b68 100644 --- a/apps/pwa/src/routes/moshpit.mjs +++ b/apps/pwa/src/routes/moshpit.mjs @@ -985,6 +985,13 @@ moshpitRouter.get("/pit", async (req, res) => { * internet, so the instruction is "change one setting", not "install a * browser". * + * There is a second route, and leaving it off this page was a hole: TronBrowser + * asks this registry over ordinary HTTPS before every navigation, so it needs no + * network settings at all. It is listed after the resolvers because it only + * fixes the browser -- curl, git and everything else on the machine still + * resolve through DNS -- but it is the only route that works where DNS is + * somebody else's to configure, and the only one that does not warn on https://. + * * The addresses come from the environment (lib/moshpit-resolvers.mjs). When * none are configured this page says so and explains how to run one, rather * than inventing an address for a stranger to paste into their network @@ -1025,6 +1032,8 @@ moshpitRouter.get("/pit/dns", async (req, res) => { .yeah resolve like any other name — while .com, .org and the rest of the internet keep working exactly as before, forwarded on to 8.8.8.8 and 1.1.1.1. + If the DNS settings on the machine are not yours to change, + TronBrowser resolves the same namespace without touching them.

${pitTabs("dns")} @@ -1045,8 +1054,41 @@ moshpitRouter.get("/pit/dns", async (req, res) => {
  • A locked-down machine where DNS is not yours to change — use DNS over HTTPS in the browser. Firefox: Privacy & Security → DNS over HTTPS → custom provider. Chrome: Security → Use secure DNS → custom. - ${doh ? `The endpoint is ${esc(doh)}.` : "An endpoint appears here once a resolver is up."}
    • + ${doh ? `The endpoint is ${esc(doh)}.` : "An endpoint appears here once a resolver is up."} + Or run TronBrowser, which changes no network settings at all. + + +

    Or change nothing: TronBrowser

    +

    + TronBrowser + resolves these names itself. Before every navigation it asks this registry, over ordinary HTTPS, who + holds the name you typed. Nothing in your network settings changes, nothing needs admin rights, and + it works on a machine where DNS is somebody else's to configure. +

    + 
    curl -fsSL https://tronbrowser.dev/install.sh | sh   # macOS, Linux — Windows: the releases page
+tron http://scrambled.eggs                          # or type it in the address bar
    +
      +
    1. Nothing to configure for a new ending. .eggs, + .moshpit, .yeah resolve out of the box — the + legacy root has never heard of them, so there is nothing to conflict with.
      2. +
    2. Contested names are a setting. Settings → Name resolution → When a name + exists in both. Clearnet wins is the default and never redirects a domain that already + works; Moshpit wins lets a registered name override the clearnet one. It is the same + decision the resolvers make with MOSHPIT_RESOLVE_MODE, taken per browser instead of + per network.
      3. +
    3. Claim from the address bar. mosh.eggs opens the Pit for + .eggs. mosh.anything is reserved, so nobody + can register that label and impersonate the page you register on.
      4. +
    4. Your own pit — Settings → Name resolution → Registry (advanced). Point it at + the registry you run and it is looked up exactly like this one.
      5. +
    5. Needs 3.8.8 or newer. Older builds sent a claimed-but-unpointed name to a URL + that has never existed, so parking 404'd. tron upgrade — and a stale address left in + settings by one of those builds is discarded on the way, rather than outliving the fix.
    +

    + It fixes the browser, not the machine: curl, git and everything else still + go through DNS. On a machine you control, run both. +

    Check it worked

    dig +short anything.moshpit     # an address, not an error
@@ -1056,13 +1098,24 @@ nslookup anything.moshpit       # the Windows spellingTXT lookup on any Moshpit name reports which registry and gateway answered — the
     fastest way to tell a resolver problem from a site problem.
   
    
+  
    
+    On the browser route there is nothing to dig: resolution never touches DNS. Open
+    mosh.eggs — if the Pit loads, the browser is talking to this registry.
+  
    
 
   
    What still breaks
    
   
    
-    https:// on a Moshpit name will warn. No public certificate authority will issue for
-    scrambled.eggs, because none of them recognise a namespace that does not
-    descend from the ICANN root. Plain http:// works, and so does this site. A
-    certificate authority you opt into is the real answer, and it is not built yet.
+    https:// on a Moshpit name will warn on the resolver route. No public
+    certificate authority will issue for scrambled.eggs, because none of them
+    recognise a namespace that does not descend from the ICANN root. Plain http:// works,
+    and so does this site. A certificate authority you opt into is the real answer, and it is not built
+    yet.
+  
    
+  
    
+    TronBrowser sidesteps it rather than solving it: it rewrites the navigation to this registry's own
+    https:// host, so the certificate is one the browser already trusts. The address bar
+    shows where it landed, not what you typed — an honest trade, and the reason the two routes are
+    documented separately.
   
    
   
    
     Clearnet lookups are forwarded to Google and Cloudflare, which is what a forwarder does. Run your