From fc1f85993e43ce61798f4d3848a3f04b9f87194a Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Sat, 1 Aug 2026 02:02:10 +0000 Subject: [PATCH] docs(pit): put the browser route on /pit/dns The page told people to change a DNS setting and never mentioned the other way in, so anyone whose DNS is not theirs to change read it as "the namespace does not work for you". TronBrowser asks this registry over ordinary HTTPS before every navigation: no network settings, no admin rights, and the navigation lands on a host with a certificate the browser already trusts, so it is also the only route that does not warn on https://. Listed after the resolvers rather than instead of them, because it only fixes the browser -- curl and git still resolve through DNS. Notes 3.8.8 as the floor: older builds parked unpointed names at moshcoding.com/parking, a route that has never existed, so every claimed name with no target 404'd. Co-Authored-By: Claude Opus 5 (1M context) --- apps/pwa/src/routes/moshpit.mjs | 63 ++++++++++++++++++++++++++++++--- 1 file changed, 58 insertions(+), 5 deletions(-) diff --git a/apps/pwa/src/routes/moshpit.mjs b/apps/pwa/src/routes/moshpit.mjs index 34461e9..7398b68 100644 --- a/apps/pwa/src/routes/moshpit.mjs +++ b/apps/pwa/src/routes/moshpit.mjs @@ -985,6 +985,13 @@ moshpitRouter.get("/pit", async (req, res) => { * internet, so the instruction is "change one setting", not "install a * browser". * + * There is a second route, and leaving it off this page was a hole: TronBrowser + * asks this registry over ordinary HTTPS before every navigation, so it needs no + * network settings at all. It is listed after the resolvers because it only + * fixes the browser -- curl, git and everything else on the machine still + * resolve through DNS -- but it is the only route that works where DNS is + * somebody else's to configure, and the only one that does not warn on https://. + * * The addresses come from the environment (lib/moshpit-resolvers.mjs). When * none are configured this page says so and explains how to run one, rather * than inventing an address for a stranger to paste into their network @@ -1025,6 +1032,8 @@ moshpitRouter.get("/pit/dns", async (req, res) => { .yeah resolve like any other name — while .com, .org and the rest of the internet keep working exactly as before, forwarded on to 8.8.8.8 and 1.1.1.1. + If the DNS settings on the machine are not yours to change, + TronBrowser resolves the same namespace without touching them.

${pitTabs("dns")} @@ -1045,8 +1054,41 @@ moshpitRouter.get("/pit/dns", async (req, res) => {
  • A locked-down machine where DNS is not yours to change — use DNS over HTTPS in the browser. Firefox: Privacy & Security → DNS over HTTPS → custom provider. Chrome: Security → Use secure DNS → custom. - ${doh ? `The endpoint is ${esc(doh)}.` : "An endpoint appears here once a resolver is up."}
    • + ${doh ? `The endpoint is ${esc(doh)}.` : "An endpoint appears here once a resolver is up."} + Or run TronBrowser, which changes no network settings at all. + + +

    Or change nothing: TronBrowser

    +

    + TronBrowser + resolves these names itself. Before every navigation it asks this registry, over ordinary HTTPS, who + holds the name you typed. Nothing in your network settings changes, nothing needs admin rights, and + it works on a machine where DNS is somebody else's to configure. +

    + 
    curl -fsSL https://tronbrowser.dev/install.sh | sh   # macOS, Linux — Windows: the releases page
+tron http://scrambled.eggs                          # or type it in the address bar
    +
      +
    1. Nothing to configure for a new ending. .eggs, + .moshpit, .yeah resolve out of the box — the + legacy root has never heard of them, so there is nothing to conflict with.
      2. +
    2. Contested names are a setting. Settings → Name resolution → When a name + exists in both. Clearnet wins is the default and never redirects a domain that already + works; Moshpit wins lets a registered name override the clearnet one. It is the same + decision the resolvers make with MOSHPIT_RESOLVE_MODE, taken per browser instead of + per network.
      3. +
    3. Claim from the address bar. mosh.eggs opens the Pit for + .eggs. mosh.anything is reserved, so nobody + can register that label and impersonate the page you register on.
      4. +
    4. Your own pit — Settings → Name resolution → Registry (advanced). Point it at + the registry you run and it is looked up exactly like this one.
      5. +
    5. Needs 3.8.8 or newer. Older builds sent a claimed-but-unpointed name to a URL + that has never existed, so parking 404'd. tron upgrade — and a stale address left in + settings by one of those builds is discarded on the way, rather than outliving the fix.
    +

    + It fixes the browser, not the machine: curl, git and everything else still + go through DNS. On a machine you control, run both. +

    Check it worked

    dig +short anything.moshpit     # an address, not an error
@@ -1056,13 +1098,24 @@ nslookup anything.moshpit       # the Windows spellingTXT lookup on any Moshpit name reports which registry and gateway answered — the
     fastest way to tell a resolver problem from a site problem.
   
    
+  
    
+    On the browser route there is nothing to dig: resolution never touches DNS. Open
+    mosh.eggs — if the Pit loads, the browser is talking to this registry.
+  
    
 
   
    What still breaks
    
   
    
-    https:// on a Moshpit name will warn. No public certificate authority will issue for
-    scrambled.eggs, because none of them recognise a namespace that does not
-    descend from the ICANN root. Plain http:// works, and so does this site. A
-    certificate authority you opt into is the real answer, and it is not built yet.
+    https:// on a Moshpit name will warn on the resolver route. No public
+    certificate authority will issue for scrambled.eggs, because none of them
+    recognise a namespace that does not descend from the ICANN root. Plain http:// works,
+    and so does this site. A certificate authority you opt into is the real answer, and it is not built
+    yet.
+  
    
+  
    
+    TronBrowser sidesteps it rather than solving it: it rewrites the navigation to this registry's own
+    https:// host, so the certificate is one the browser already trusts. The address bar
+    shows where it landed, not what you typed — an honest trade, and the reason the two routes are
+    documented separately.
   
    
   
    
     Clearnet lookups are forwarded to Google and Cloudflare, which is what a forwarder does. Run your