For the desperate people whose tests all just broke, I have a page on my public endpoint testing server that exactly reproduces the classic design: <a href="https://example.testserver.host/" rel="nofollow">https://example.testserver.host/</a>. You can just use update the URL and go back to blissful ignorance.<p>Also open-source and self-hostable: <a href="https://github.com/httptoolkit/testserver" rel="nofollow">https://github.com/httptoolkit/testserver</a>. Lots of other endpoints too, full docs here: <a href="https://testserver.host/" rel="nofollow">https://testserver.host/</a>
If you do have tests relying on it... stop it:<p>> This is not a service; avoid relying on it for testing and monitoring purposes.
Before this submission, it genuinely never occurred to me that people would actually have tests that rely on example.com being up, let alone depend on its content.
Opus 5.5 in Claude code added a unit test checking DNS and internet access using example.com as the target on a project I'm building yesterday. It's an agent sandbox (I know, yet another), so the call was expected to fail, but still... It should have at least targeted a captive portal endpoint or a project owned domain.<p>I caught it in review but thousands of others won't.<p>That ship has sailed I would say.
So is wrong to use captive.apple.com for tests as well? It's nice to know your network can reach the internet and these pages are generally fairly reliable.<p>[1]: <a href="https://captive.apple.com/" rel="nofollow">https://captive.apple.com/</a>
A HTTP request for <a href="http://www.msftncsi.com/ncsi.txt" rel="nofollow">http://www.msftncsi.com/ncsi.txt</a> returning 200 OK and the text Microsoft NCSI. This is the url windows has been using for decades to determine if the device is online. It is highly reliable.
These pages are unfortunately getting special treatment from quite a few networks these days, among other things to avoid iOS users getting stuck in a loop of trying to connect, and getting disconnected by the OS due to a "non-working connection" for local-only networks like in-flight entertainment systems.<p>It's a shame that we don't have any standards for the concerns of canonically testing Internet reachability and for authoritatively redirecting network users to a captive payment portal (without having to resort to ugly hacks that often break with TLS).
If they say that it's not intended as a reliable service for testing purposes it can't be that reliable, and they might take it down or change the structure arbitrarily at any time, etc.<p>So yeah I would pick something simpler for a network access test probably?
Why not ping 8.8.8.8 or 1.1.1.1 or time.windows.com? Things that are actually designed to be highly available services
Is there any reason to believe captive.apple.com is any less "designed to be highly available" than time.windows.com?<p>It's a static page that every Apple device relies on saying only:<p><pre><code> <HTML><HEAD><TITLE>Success</TITLE></HEAD><BODY>Success</BODY></HTML></code></pre>
1.1 is enough.<p><pre><code> ~$ ping -c1 1.1
PING 1.1 (1.0.0.1) 56(84) bytes of data.
64 bytes from 1.0.0.1: icmp_seq=1 ttl=56 time=7.89 ms
--- 1.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 7.888/7.888/7.888/0.000 ms</code></pre>
Thanks! I'd forgotten that 1.1 and 1.1.1 resolve. I'll not infrequently ping 1.1.1.1.1 with overzealous typing. That will, alas, not resolve.
When did this start working? Did they backport IPv6-style addressing, or did I just never know this?
Just don't blame the user and/or their internet service when the service you're relying on inevitably goes down.
I have been naively using example.com in the browser. WHATWG URL throws if there is no origin when constructing the URL. Web apps that need to construct _just_ the pathname must go through this song and dance. `new URL("/blah", "<a href="https://example.com").pathname" rel="nofollow">https://example.com").pathname</a>` This isn't relying on any external example.com service but I'm learning the lesson.
What kind of tests would this break? Aside from the advice on the page itself (which, iirc, is new anyway), i'm wondering why any testing would actually involve the contents of design of the page. Just a weird 'sanity' check?
People depend on all sorts of weird stuff working exactly as expected. <a href="https://www.hyrumslaw.com/" rel="nofollow">https://www.hyrumslaw.com/</a><p>As an example, depending on "man -w" not outputting anything to stderr: <a href="https://unix.stackexchange.com/questions/405783/why-does-man-print-gimme-gimme-gimme-at-0030" rel="nofollow">https://unix.stackexchange.com/questions/405783/why-does-man...</a>
Our saas had an internal-use, undocumented, publicly accessibly but not publicly used (by us) health endpoint that included an internal version number.<p>We removed the version and a few customers complained we broke their stuff.
I landed a massive database upgrade on a payroll system years ago, end-to-end standardization, cleanup, and improvement with a seamless rollout.<p>Our back clapping was interrupted by an angry customer phone call. One of our customers had gotten access to our internal schema and had a massive reporting setup in Access solving most of his needs.<p>I ended up converting his reports using some internal tools we had. Customers will grab anything to give them.<p>[<i>The caliber and depth of his reports were such I wish we would have bought them instead of making me spend months building out our own reports.</i>]
> [The caliber and depth of his reports were such I wish we would have bought them instead of making me spend months building out our own reports.]<p>Learning from customers is some of the best learning you can do. :)
I had one customer that managed to figure out which stored procs were tied to which reports we were using. Then he would deliberately break it in weird subtle ways them and call tech support 'just to see how we would react'.
The API surface is what’s exposed, not just what’s documented.<p>This is probably an even more important principle in the age of LLMs.
While not the same thing, I was once stung by a test failing because a dependency of a dependency decided on a minor version bump that foo@example.com wasn't a valid email address.
> foo@example.com wasn't a valid email address<p>That's an interesting case. Did you consider this a correct result?<p>On one hand, <foo@example.com> is a valid <i>hypothetical address</i> that can be used strictly in documentation. It is also syntactically valid, which is the best kind of valid. However, <foo@example.com> (and all its permutations) is an obviously <i>invalid actual address</i> if you're trying to send email to it, or manipulate it in any real way on the Internet.<p>It's a good sanity check, but quite pedantic. I can understand if you are validating some public input form, where people are likely to put fake email addresses, and you don't want someone knowingly filling in <blah@example.com> because you also know, <i>a priori</i> it's a fake, and it will waste your time validating or trying to send to it.
Yeah it's an interesting one, I guess at some point a previous dev had chosen it on the fly and thought nothing of it - I didn't think anything of it either until it suddenly failed! I would agree in hindsight the newer behaviour in the library is the correct one, it was just a surprise.
Probably akin to: <a href="https://xkcd.com/1172/" rel="nofollow">https://xkcd.com/1172/</a>
One of the critical things I use example.com for is triggering wifi login portals as it doesn't not use SSL. Certificate pinning and all that fancy stuff has made it so the browser has an absolutely awful time figuring out what to do when <a href="https://google.com" rel="nofollow">https://google.com</a> does not present itself as the same host it was earlier.
Same server also has an endpoint for that: <a href="http://no-tls.testserver.host" rel="nofollow">http://no-tls.testserver.host</a>. Sends RST for any attempted TLS connections, so clients always fall back to plain HTTP.<p>Also as a _long_ list of other specialist TLS endpoint configurations if you're interested, which can be arbitrarily combined, see <a href="https://testserver.host/#tls-endpoints" rel="nofollow">https://testserver.host/#tls-endpoints</a>.<p>That gives neat tricks like <a href="https://tls-v1-2--expired--incomplete-chain--http2.testserver.host/" rel="nofollow">https://tls-v1-2--expired--incomplete-chain--http2.testserve...</a>: only accepts TLS 1.2, then sends an expired certificate but fails to send the intermediate cert for the chain (so the client must infer it) and then negotiates HTTP/2 for the connection on top. Fun!
I like using <a href="http://neverssl.com/" rel="nofollow">http://neverssl.com/</a> for that... easy to remember (although I guess example.com was as well).
Do you do any sort of rate-limiting to stop people/bots from hammering it (accidentally or otherwise)? Or do you just let it fall over under load.
Currently no rate limiting, I might if I have issues in future, but right now it's vastly overpowered for the traffic and extremely cheap to run.<p>If you want to hit it hard, or you just want to avoid any risk of limits in future, it's a one-liner to host it yourself with Docker: `docker run --rm -it -p 3000:3000 httptoolkit/testserver`, then open <a href="http://example.localhost:3000/" rel="nofollow">http://example.localhost:3000/</a>. Advanced config options for CAs etc are in the GitHub README.
> For the desperate people whose tests all just broke...<p>The web page at example.com is maintained as a courtesy by IANA in order to explain the purpose of the example.com domain to wayward humans.<p>In the nomenclature of RFC 2119, one MUST NOT design computer systems that rely on the correct operation of an HTTP server at that domain. [0] Plus, it's <i>_really_</i> rude to pound on a small-scale service being provided as a courtesy... go hit the home page of a tech megacorp (such as Microsoft or Google) or the status page for a major CDN (such as Cloudflare or Akamai) instead!<p>[0] I expect that <i>someone</i> here will want to pop up with a "gotcha" where they say something like "Oh, but IANA's email says that automated use is strongly recommended against, rather than <i>prohibited</i> and besides, they can't actually stop me from doing it!". To that, I reply "Sure, and standards-writers can't <i>actually</i> stop implementers that do the profoundly antisocial thing and do the things they MUST NOT. As any adult who's been paying attention to the world around them throughout their lives knows, there's only <i>so</i> much you can do to stop people who are <i>very</i> determined to be enormous assholes.".
> the status page for a major CDN (such as Cloudflare or Akamai)<p>Would you settle for any old static page served by Cloudflare? For instance, example.com? <a href="https://bgp.tools/dns/example.com" rel="nofollow">https://bgp.tools/dns/example.com</a>
That they've put it behind Cloudflare doesn't mean it's "served by Cloudflare"<p>Maybe Cloudflare gives them a good rate, or is donating service, but it's also possible or even likely that IANA is just using Cloudflare as a vendor, and therefore is paying for all the traffic, which is why they don't want people relying on it or hammering it all the time
<p><pre><code> In the nomenclature of RFC 2119, one MUST NOT design computer systems that rely on the correct operation of an HTTP server at [example.com.] Plus, it's *_really_* rude to pound on a small-scale service being provided as a courtesy.</code></pre>
> go hit the home page of a tech megacorp (such as Microsoft or Google)<p>Much too big for metered data, full of ads, and importantly they all mandate HTTPS these days, which breaks my use case of forcing a captive portal on paid/login-gated Wi-Fi to render.<p>example.com is (unfortunately for the IATA) the almost perfect "can I reach the Internet" service: It's unlikely to go away, supports HTTP, is fairly small, easy to remember, and I don't care if a captive portal poisons my DNS cache with a fake response temporarily.
> Much too big for metered data, full of ads, and importantly they all mandate HTTPS...<p>You'll be pleased to learn that nearly (actually?) all major sites that mandate HTTPS provide an HTTP redirect response when hit on port 80. You can't help but agree that a 30X with no body is <i>way</i> less data than pulling down even just the HTML parts of example.com.<p><pre><code> curl -v http://cloudflarestatus.com
* Trying [2600:1901:0:4a3b::]:80...
* Host cloudflarestatus.com:80 was resolved.
* IPv6: 2600:1901:0:4a3b::
* IPv4: 35.201.124.30
* Established connection to cloudflarestatus.com (2600:1901:0:4a3b:: port 80) from [REDACTED] port [REDACTED]
* using HTTP/1.x
> GET / HTTP/1.1
> Host: cloudflarestatus.com
> User-Agent: curl/8.22.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 301 Moved Permanently
< Cache-Control: private
< Location: https://www.cloudflarestatus.com:443/
< Content-Length: 0
< Date: Wed, 07 Oct 2026 08:07:34 GMT
< Content-Type: text/html; charset=UTF-8
<
* Connection #0 to host cloudflarestatus.com:80 left intact
</code></pre>
And in regards to "DNS cache poisoning", approximately no one cares about hitting the status page of a major CDN. ;)<p>> ...which breaks my use case of forcing a captive portal on paid/login-gated Wi-Fi to render.<p>Huh? Captive portals -especially ones that redirect to payment collection systems- are served up by infrastructure that either you control or that you've arranged with someone else to operate. If you're paying IANA to operate your captive portal, and they've made the choice to hit example.com:443, then that's <i>their</i> -odd- choice... but I bet that's not who's operating your captive portal.<p>If you've designed a captive portal system that <i>depends</i> on a functioning HTTPS server at example.com, you <i>desperately</i> need to go back and redesign it... if for no <i>other</i> reason than to -given your concern about metered data- massively reduce your own bandwidth bills.
> You'll be pleased to learn that nearly (actually?) all major sites that mandate HTTPS provide an HTTP redirect response when hit on port 80. You can't help but agree that a 30X with no body is way less data than pulling down even just the HTML parts of example.com.<p>My browser (in which I do these ad hoc connectivity tests) does in the end pull down the redirection target including all resources. Not fun on a slow and metered network such as in-flight Wi-Fi.<p>On top of that, sites like google.com just haven't worked as well for me in the past in these situations. Not sure why, but I suspect they just use all the latest security extensions like HSTS etc., making it hard to access the non-secure version once that's cached. Could also be some heuristics in my browser.<p>> And in regards to "DNS cache poisoning", approximately no one cares about hitting the status page of a major CDN. ;)<p>What I mean is the captive portal poisoning <i>my</i> DNS cache, and thereby rendering e.g. google.com unusable for me even after authenticating/purchasing access. I don't really care if example.com redirects me to the in-flight Wi-Fi portal; in fact, that's usually what I want it to do when losing connectivity.<p>> Huh? Captive portals -especially ones that redirect to payment collection systems- are served up by infrastructure that either you control or that you've arranged with someone else to operate.<p>I (unfortunately?) don't control the payment systems or captive portal implementation of the airlines I fly with. I'm just sharing my experience in practically mitigating their various deficiencies as a user.
I think we're on the verge of a big disruption coming for the example.com's business. I can see a SaaS opportunity. We can use AI to speed up time to market.<p>/s
example.com-as-a-service, although XaaS is no longer hip so now it'll be example.ai, an AI that will generate an example.com style landing page using frontier AI models. $20 / month for the beginner plan (100 requests/month), contact us for pricing.
Enterprise ready. Coming soon in Q4.
I'm wondering how many automated tests this change broke.<p>Yes, I know it's not the example.com's fault, and it's a side effect of Hyrum's Law:<p>> This is not a service, avoid relying on it for testing and monitoring purposes.<p>Don't we all have a few fragile tests?
That's an excellent reason to change the page design occasionally, so that people learn not to rely on it (the hard way if necessary).
If 1.1.1.1 ever stops responding to pings…
… then you'll be back in the world before CloudFlare set up its public DNS service, which is also the world where taking over 1.1.1.1 in the first place came at the price of having to measure how many people had ignorantly or lazily put four ones into somewhere that they had to fill in an IP address, and how much bogus and positively risky (to them) traffic there was being caused by people just thinking 'I will just use 1.1.1.1, which is not a real IP address.'.<p>Just before COVID, a random unidentifiable person reported that 1.1.1.1 saw 60Mb/s of ICMP echo traffic. When APNIC first experimented with making it a valid network almost a decade before that, it was being sent 50Mb/s of general IP traffic. Amusingly, a side-effect of what CloudFlare has done is that it has stopped all of that traffic leaving the edges of the Internet, and funnelling in to one big central place.<p>There are those who remember the risks of 'just use 1.1.1.1' and how the people who did that used be characterized as 'bad Internet citizens'. The ServerFault answer (q.v.) is from 2011.<p>* <a href="https://labs.ripe.net/author/franz/pollution-in-18/" rel="nofollow">https://labs.ripe.net/author/franz/pollution-in-18/</a><p>* <a href="https://news.ycombinator.com/item?id=19335833">https://news.ycombinator.com/item?id=19335833</a><p>* <a href="https://serverfault.com/a/339782" rel="nofollow">https://serverfault.com/a/339782</a>
I don’t use this one, because I remember when long, long ago it was in some random IP address block belonging to someone, and this particular address didn’t reply to ping.<p>Likely for good reason, even back then there would have bound to be lots of misconfigured endpoints trying to access 1.1.1.1, so just blocking it at the earliest point possible kept at lot of the annoyance away. Nowadays, it’s an anycast address, so it’s slightly less bad.<p>But for me, old habits die hard.
I've already seen a couple of train hotspots respond locally to pings directed at 1.1.1.1 and 8.8.8.8, apparently in effort to convince devices that they are on a good network event if the internet itself is broken due to being in the tunnel.
If 1.1.1.1 fails, I will try 8.8.8.8
[dead]
> 1.1.1.1<p>Pinging such an address is inherently a troublesome practice. This address, like many public DNS servers (resolvers as well as root and authoritative ones), uses "anycast" routing methodology.<p><a href="https://en.wikipedia.org/wiki/Anycast" rel="nofollow">https://en.wikipedia.org/wiki/Anycast</a><p>Pinging an anycast address will yield a cornucopia of different results. Of course, people who naïvely "ping" a recognizable or easy-to-type IPv4 address get what they deserve, especially when they enshrine it into software, unit tests, or the LLM coughs up such tokens on their behalf.<p>Fundamentally, the question is "what do you really want to test?" by pinging a particular IPv4? Do you want to test Layer 3 connectivity? Test your ISP's backbone and connectivity? Test only your upstream router? Test the existence of ICMP in your stack and theirs?<p>... the possibilities are endless. Your router can do anything. Ping zombo.com.
Why is pinging an anycast address an issue? Most people, myself included, ping addresses like 1.1.1.1 to check for internet connectivity. It's a perfectly valid check, you don't need a fine grained test all the time. If it fails, then I go looking in detail. Most of the time it will pass.<p>Pinging a domain name could fail for a variety of other reasons, particularly if it's not a reliable site. Cloudflare's business is being reliable; few sites would be a better choice.
The problem is pinging 1.1.1.1 can end up hitting a really really close-by server. You could be having ISP issues and 1.1.1.1 could end up being closer to you than the issue is, so you get okay ping results but still unable to access resources on the other side of the issue
You're thinking far too hard. If I can ping 1.1.1.1, it means traffic is flowing from inside my network, to outside my network. I'm not going to diagnose my ISP's issues, that's their job, I just need to know that it's not <i>my</i> problem.
Most of my connection issues are between the street and my computer, I don't think Cloudflare got there. Yet.
You can have routing issues that alow some IP addresses to work and others not, anycast or not. It's not supposed to be a comprehensive connectivity report, just a sanity check that the intertubes are connected at all.
Of course. Ping 1.1.1.1 is not a test that everything is working great. DNS could be dead. IPv6 could be black holed.<p>But it’s a good “is traffic making it past my router with some semblance of connectivity” sanity check, and easier than finding the provider-side next hop address.
The corollary is that when it fails, you've no idea what failed, or how it failed, or if the "fail" is even valid or relevant, because you're abusing a service that isn't designed for you and isn't fit for use. So if it succeeds, you really don't know, because perhaps your train's WiFi router is responding with a spoofed IPv4 address while it goes through the Chunnel. And if it fails, you really don't know, because you DGAF about learning formal troubleshooting methods and couldn't be arsed to find out your upstream router's address in order to simply isolate your PING to a singular link, rather than relying on complex routing rules, especially those introduced by "anycast". And perhaps you can manually dig in when your manual checks fail, but your AI agent or automated script DGAF about your nuanced knowledge that 1.1.1.1 isn't your upstream router; in fact it's not yours at all and has nothing to do with your network topology. But at least it looks elegant.
I ping 1.1.1.1 to see if my internet is working or not after a couple of websites don’t load. I reboot the router. I keep the terminal where I’m pinging 1.1.1.1 open until I start seeing responses and then I know my internet is back. Then I continue my web browsing and other online activities.
Fun fact, ping is the standard windows way to wait a given number of seconds[0]. You're supposed to ping 127.0.0.1, but I saw a lot of scripts pinging 1.1.1.1 or 8.8.8.8<p>[0]: <a href="https://stackoverflow.com/questions/1672338/how-to-sleep-for-five-seconds-in-a-batch-file-cmd#1672375" rel="nofollow">https://stackoverflow.com/questions/1672338/how-to-sleep-for...</a>
Any IP address could one day change where it is being announced from, or become anycast, or change the number of hops between you and it.<p>I don't think people are using `ping 1.1.1.1` as a stable API, rather as a yes/no test of the network segment that they control.
>Of course, people who naïvely "ping" a recognizable or easy-to-type IPv4 address get what they deserve<p>Look what happened because of what you did, what it led to! Two microservices are in critical condition and you're laughing. You're laughing.
Why would it matter?
[dead]
that's a really good point I'd not considered but if you just hash the response and the followups remain consistent (they do in this case)... you're gonna do just fine.
> there's a gradual opacity transition<p>Looks like they removed this and instead just show all languages with no CSS animation now.
Yes, the revised version that alternated through the translations was posted a week ago on Monday. It was revised to no longer do that on Friday based on reasonable feedback that it wasn't the best idea for accessibility. Now all the translations are presented together, but your preferred language will be bumped to the top based on your browser language preference.
Oh that's good, I had that complaint when it first changed. It was difficult to read the entire chunk of text before it transitioned to a different language. And then who knows how long it took to loop back round to english
Aww, I was wondering if I was just looking at an older version. How disappointing. But I suppose, unsurprising given the conversation here. I'm sure such transitions would be bringing a surprising amount of instrumentation down.<p>It still probably is as it is now. But there's better arguments to support localization than transitions.
Discussed here a few days ago: <a href="https://news.ycombinator.com/item?id=49915060">https://news.ycombinator.com/item?id=49915060</a>
Thanks! Macroexpanded:<p><i>IANA's email about why example.com changed</i> - <a href="https://news.ycombinator.com/item?id=49915060">https://news.ycombinator.com/item?id=49915060</a> - Sept 2026 (20 comments)
And the "statement" in this article is the text from that email, disingenuously edited. I'm not sure why, but it rubs me the wrong way.
What makes you think it's edited?
The hilariously ironic thing is that Dunk, a Google Engineer, went out of their way to make a hyperlink of "example dot com" so that people could tap and visit the site, even where Davies' email specifically reiterates that the domain is for <i>documentation purposes only</i> and nobody should ever be actually visiting the site!<p>McCarthy of DebugBear clearly noticed this admonition and perhaps the mistake as well, because they have carefully highlighted "example.com" without linking to it, although they apparently have <i>visited the site</i> in order to copy and cite screenshots and unpack the CSS, and describe an extensive history of it.
The page mentions example.com 14 times and not a single one is a link
You also failed to make it a link. In order to automatically create links, you should use the format <a href="https://example.com/" rel="nofollow">https://example.com/</a> with scheme included. So in your case you'd do <a href="https://example.com/" rel="nofollow">https://example.com/</a>
Guess I am part of the problem. Thank you for the link kind stranger.
Thanks. But you also forgot to include the link. You used the example domain <a href="https://example.com/" rel="nofollow">https://example.com/</a> but forgot to substitute the correct address of the website. In this case that would be <a href="https://example.com/" rel="nofollow">https://example.com/</a>
Outrageous. How will people ever find it?!
By typing it or copy+pasting it, which is much more time consuming and much less convenient.<p>(I actually tried the select, share [sic], open in browser route, but for some reason I only saw opera as an option, not chrome, the browser I actually use for everything. Links still rule.)
That’s because they are in code blocks. Oh I hate people who abuse code blocks for things that aren’t code. Domain names are not code. Your browser doesn’t display URLs in a monospace coding font. Stop this abuse.
This has rendered my usecase for example.org worthless.
I used this website several times per week to clean my glasses as it provided a nearly completely white website - optimal for allowing me to spot smudges on my glasses. It is now black by default for me, or grey.<p>I am devastated.
Do the kids not know about about:blank?
whitedisplay.com can be your new friend. Just select the preferred color.
Good old Hyrum's Law
Relevant xkcd: <a href="https://xkcd.com/1172/" rel="nofollow">https://xkcd.com/1172/</a>
Just expand the HN comment box. Some of my greatest bangers started out with a large blank canvas that I then felt compelled to fill.
> There is no requirement there is a HTTP service present on the host in order to fulfill its purpose, we just operate it as a courtesy.<p>I guess this is also done to prevent bad actors from abusing the fact that this domain is hit by people who might not know what they're doing (the ones copy-pasting code without reading it)
More the DNS and DNSSEC and the like. Whether or not there is actually an HTTP server responding is irrelevant to whether or not those securely point anywhere but a malicious system.
Yeah there’s definitely a lot of sensitive data that gets sent to the domain just because of people not changing configs
I don't understand, what risk would there be if they chose _not_ to serve a site?
Someone else could
No, because they can't register the domain, it's already taken, no matter if a web service is running behind it or not
I appreciate that there must be a lot of traffic hitting this web server so maybe every little bit of savings counts, but I kinda wish the HTML wasn't so heavily compressed.<p>I remember getting my start with web development by simply reading the source code of sites I found interesting and trying to recreate them. example.com isn't exactly very interesting but it feels like compressing the HTML isn't in the spirit of things either.<p>On a side note I'd love to see how complicated (or maybe simple) the hosting setup for this site actually is behind the scenes.
It's static content in Cloudflare CDN. Seems unlikely that many requests actually hit any kind of origin server. If I were building something like this the origin would be Cloudflare R2 (or similar) object storage, with a very long cache lifetime. Nothing to update, nothing to maintain.<p>But beyond that, what are you referring to as compression? When I look at the source I see a VERY short easily human-readable HTML page. It doesn't have newlines, but I wouldn't consider that compression. It also references a short, but non-obfuscated javascript file at <a href="https://example.com/s.js" rel="nofollow">https://example.com/s.js</a> .<p>Maybe I misunderstood what you're referring to...
Here is some context: <a href="https://kimdavies.com/being-exemplary" rel="nofollow">https://kimdavies.com/being-exemplary</a>
I'm not sure I believe that IANA's goal of reducing serving costs is met by a site where each letter is wrapped in a <span>...<p>separate shower thought: Microsoft have used contoso.com as the example domain in their docs for 25+ years. I bet the logs for that domain are absolutely wild.
> Conclusion<p>> Looking at the visual timeline, we can see that changes to example.com happen sporadically.<p>I am glad to see someone else struggling to write a non-awkward conclusion to a technical blog. I always feel like I am just restating the obvious to the point that it is borderline insulting to the reader. But I don't have much more to say and removing the conclusion makes it seem like the whole thing just fell off a cliff.
Kinda interesting that this is getting so much attention.<p>Ultimately, the example.com domain is just there so you can use it in documentation or code examples. Your expectation about the actual example.com domain should basically be none at all, maybe with the exception that it's hopefully not doing actively malicious things like serving malware or running a catchall mailbox feeding spammers.<p>Whatever HTML they server or if they serve anything at all... shouldn't matter.
This is mine now!
<link rel=icon href=data:,>
I’m curious… who hosts and controls this content? IANA? Never really considered this question until now…
see <a href="https://news.ycombinator.com/item?id=42705284">https://news.ycombinator.com/item?id=42705284</a> for some historic detail on this
the 'about' link on example.com sends you here <a href="https://www.iana.org/help/example-domains" rel="nofollow">https://www.iana.org/help/example-domains</a><p>which does appear to say that yes, IANA hosts this
So they made a prior tweak to reduce fetches of favicon.ico ( by link rel="icon" href="data:," )
but why do they still serve the overlarge meaningless html page to requests for robots.txt ?!<p>Given that they have gotten spiked by automated requests lately, aka agents, wouldn't this at least be respected by the big players?<p>Also, as they are using Cloudflare, wouldn't a discussion (or a note from IANA or CF) about how they configured CF request rejection and how one should love CF's flat rate static serving be appropriate?<p>Am I missing something?
Looking at the timeline and UI changes, it seems that web interfaces are strongly shaped by the cultural tastes, conventions, and technological assumptions of their era.
Really funny coincidence, I noticed amazon wasn't loading a couple hours ago. Thought it was my internet so went to example.com to check and noticed the redesign. Figured it was a while ago though.
It's been about 10 years since I last saw this site and accidentally visited it a few days ago and thought "I don't remember it looking like this"
> Along with introducing multi-language support, the JavaScript code also inserts an SVG book icon.<p>Wait - using JS for dynamic content is understandable, but why using it for inserting a static SVG?
Reducing egress bandwidth, if you have automated clients that don't support JS you save precious bytes from being served by not embedding the SVG, which at example.com scale may be worth it
I wonder if it's injecting both through javascript to minimize breaking people's tests. Trying to reduce dealing with non-ascii characters and svg tags.
Why does this site need JS at all? It appears to inject all of the other languages via client side JS. Why can't they all just be served from the server?
Simple answer is the article is wrong, I tried it with disabled JS and still see the SVG.<p>The whole article reads like something put together with AI, so maybe it’s not too surprising.
I get nothing but a gray page with the following with JS disabled <a href="https://i.imgur.com/81aYPeB.png" rel="nofollow">https://i.imgur.com/81aYPeB.png</a> in Firefox via javascript.enabled set to false.
You may want to check your settings again or clear you cache as there is definitely a `s.js`[0] file that inserts the `<svg>` element into the HTML DOM[1], which you can see does not contain the element itself.<p>0<p>```<p>var B = document.body, P, p;
B.children[0].insertAdjacentHTML("afterend", "<p lang=ar dir=rtl>هذا النطاق مُخصص للاستخدام في أمثلة التوثيق دون الحاجة إلى إذن. هذه ليست خدمة، يُرجى تجنب الاعتماد عليها لأغراض الاختبار والمراقبة.</p><p lang=zh>该域名仅用于文档示例，无需获得许可。这并非一项服务，请勿将其用于测试和监控目的。</p><p lang=fr>L’usage de ce domaine est réservé à des exemples de documentation, sans autorisation préalable. Il ne s’agit pas d’un service ; son utilisation à des fins de test ou de surveillance est à éviter.</p><p lang=ru>Данный домен предназначен для использования в примерах документации без необходимости получения предварительного разрешения. Это не сервис; не рекомендуется его использование для тестирования и мониторинга.</p><p lang=es>Este dominio está destinado al uso en ejemplos de documentación sin necesidad de permiso. Esto no es un servicio; evitar utilizarlo para realizar pruebas o monitoreos.</p><a href=<a href="https://iana.org/help/example-domains" rel="nofollow">https://iana.org/help/example-domains</a>>Learn more</a>");
P = [...B.querySelectorAll("p")];
P[0].lang = "en";
navigator.languages.some(l => p = P.find(p => p.lang == l.split("-")[0]));
p = p || P[0];
B.prepend(p);
B.insertAdjacentHTML("afterbegin", '<style>svg{display:block;margin:-2.75em auto 0;opacity:.55}p+p{font-size:.875em;opacity:.6}</style><svg viewBox=0,0,20,20 width=44 height=44 fill=currentColor aria-hidden=true><path fill=none stroke=currentColor stroke-width=1.3 stroke-linejoin=round d="M6 4H3v12q4 0 7 1.5-1-3.5-4-4.5V2q3.5 1 4 3v12.5q3-1.5 7-1.5V4q-4.5 0-7 1"/><g transform=rotate(-6,13.6,8.3)><path id=q d="M11.5 6.6h1.8v1.8l-1 1.6-.6-.3.8-1.3h-1z"/><use href=#q x=2.4 /></g></svg>')<p>```<p>1<p>```<p><!doctype html>
<html lang=en>
<head>
<meta charset=utf-8>
<link rel=icon href=data:,>
<meta name=viewport content="width=device-width,initial-scale=1">
<title>Example Domain</title>
<style>
html {
color-scheme: light dark;
background: light-dark(#eee,#222)
}<p><pre><code> body {
font: 16px/1.6 system-ui,sans-serif;
max-width: 26em;
margin: auto;
padding: 25vh 2em 2em;
text-align: center
}
</style>
</head>
<body>
<p>This domain is for use in documentation examples without needing permission. This is not a service; avoid relying on it for testing and monitoring purposes.</p>
<script src=/s.js></script>
</body></code></pre>
</html><p>```
``` doesn’t work on HN, prepend two spaces to each line to get a code block.<p>Regardless, it’s a lot of code, so maybe better move it out to a pastebin/gist?
> Since most of the traffic to the site is automated it tends not to fetch the Javascript file, reducing overall data requirements.<p>Well, IATA – give me api.example.com or sniff my user agent and I'll be out of your hair :)
Maybe this is the most web-development thing possible: even example.com eventually became a frontend project.
It seems that they changed it again and now there is minified HTML with english message + simple script that injects the other languages and the icon, no animation. Which to me seems much more sensible.
I actually noticed that! I was debugging some HTTP proxy and typed out an HTTP/1.1 request by hand in netcat, and was wondering why I saw a giant blob of dynamic nonsense instead of a small bit of markup.<p>(This was when it had the language scroll though, I think moving the extras to JS should have resolved that issue; maybe I was misremembering the details too.)<p>example.com is not a user-facing service. I don't want to disparage the designer, but it's not meant to be pretty. It's meant to be small so you can copy its response to an automated test or visually verify its correctness, or just out of the bandwidth consideration you'd still be serving it to billions of requestors, even if you insist it's not meant to be used that way.
I believe your use is what they're trying to discourage.<p>example.com is meant to be legally allowed to be used in text such as "You visit a website (example.com) to browse the internet"<p>It is not meant to be queried by automated tests or used as a service.
I never queried it _automatically_, but many projects do. They might not have set out to provide that use, but what happened has happened, and breaking this implicit contract for a silly redesign is an odd choice.
> It's meant to be small [...], even if [...] it's not meant to be used that way<p>It is not, in fact, _meant_ to be used that way.
> and was wondering why I saw a giant blob of dynamic nonsense instead of a small bit of markup.<p>It's 4.5x the size of the original. Which sounds bad, until you notice this means it's 2540 bytes and serves the explanatory text in 6x the number of languages. And it's now served with brotli compression, for a total of 1713 bytes. Or 334 bytes if you only request the HTML (which still has a usable page with the full English version of the explanatory text), like a basic scraper or a health check would. So for the vast majority of traffic, it's now half the size of the old version.<p>I notice it's been through several revisions, the pre-2025 version of the site most people are familiar with is 1270 bytes because it didn't make use of any minification, and it also triggered an unnecessary `/favicon.ico` request because it didn't use the trick to cancel the request.
who's job was it to make incremental stylesheet changes on example.com in the 2010s?
I just wonder how much unintended traffic they receive.<p>eg If they put DNS, NTP etc on it... Likely billions per hour or something equally ludicrous.<p>Deluge is likely an exponential understatement.
What should I use for example URLs in my testa.
Google operates <a href="http://connectivitycheck.gstatic.com/generate_204" rel="nofollow">http://connectivitycheck.gstatic.com/generate_204</a> and <a href="http://www.gstatic.com/generate_204" rel="nofollow">http://www.gstatic.com/generate_204</a>, both of which return a 204 No Content response.<p>Apple operates <a href="http://captive.apple.com" rel="nofollow">http://captive.apple.com</a>, which returns `<HTML><HEAD><TITLE>Success</TITLE></HEAD><BODY>Success</BODY></HTML>`.<p>Microsoft operates <a href="http://www.msftconnecttest.com/connecttest.txt" rel="nofollow">http://www.msftconnecttest.com/connecttest.txt</a>, which returns `Microsoft Connect Test`.<p>Mozilla operates <a href="http://detectportal.firefox.com" rel="nofollow">http://detectportal.firefox.com</a>, which returns `success`.<p>These are what these companies' respective browsers/operating systems use to check if they have an internet connection and are not stuck behind a captive portal. Given the enormous quantity of devices out in the world that are relying on these URLs to stay up, you can probably feel comfortable using these in your tests. If they do go down, good chance you'll see news articles about it before you notice your tests failing.
I had no idea that example.com is even <i>registered</i>. I thought that it was the official placeholder for, well, examples.<p>It would not occur to me that my examples may lead somewhere at all. I was actually glad they do not, to spontaneously break incorrect configurations.
I just don't understand why the operator, IANA, has to use Cloudflare for example.com<p>It cannot manage a one page website. WTF<p>There are no page "aseets", no need for images, CSS, etc. It was a text-only website to test connectivity<p>iana.org forwards to Cloudflare, too<p>Fortunately the FTP server service still works<p>Without assistance from a third party<p>If it's been a sensible decision to use Cloudflare for some period of time then why did IANA wait until now<p>(Yes, I know they used Akamai in the past)
Cloudflare is the latest in a number of different CDN providers we've used to serve this over many years. I guess the question is, why is it important not to use a CDN?
Same reason everyone else uses CF. Static page CDN only became too cheap to meter ~16 years ago, but if CF was around in the 90s IANA would have used it in the 90s too
IANA has a history of hosting even more important services with third-parties [0] [1], so this doesn't seem too problematic to me.<p>[0]: <a href="https://root-servers.org/" rel="nofollow">https://root-servers.org/</a><p>[1]: <a href="https://datatracker.ietf.org/doc/html/rfc6305.html" rel="nofollow">https://datatracker.ietf.org/doc/html/rfc6305.html</a>
NB. IANA isn't responsible for "root servers"<p>It's only responsible for root.zone, root.hints, .arpa and .int zones<p>AS112 is a volunteer project not a company
If it's a name in com/net/org only meant for documentation then why serve a page there for decades. If traffic is a problem then take it offline<p>Years ago IANA started requiring a user-agent header<p>FTP access to root.zone remains
*assets
Well, it's a popular website. By using Cloudflare I think they will save a lot of bandwidth and traffic because the page and assets can be cached.
Ive been using example1.com recently for availability type testing for what its worth.
it's nice, and it surprised me when I saw the redesign.... I use it to navigate into captive wifi portals that always seem to be misconfigured.
I've used <a href="http://www.com" rel="nofollow">http://www.com</a> for that.
Same here! Yes, I used it as the well-known site that supported unencrypted http and no HSTS. Yes, I was one of those guys using the site "as a service" rather than simply documentation. Admittedly, it was perhaps interchangeable with other sites, but since it reliably worked for that purpose, I couldn't be arsed to find other ones.<p>Isn't there a dedicated site called nohttps or something? NeverSSL? I just tried http NeverSSL, and it redirected me to an https page with a random hostname and an Amazon SSL certificate!<p>Does example.com still function this way, with http and no HSTS? I noticed that my Chrome browser was immediately redirected in the customary way.
Andddd it broke all my EVALs... ;)
Previously:<p><i>IANA's email about why example.com changed</i><p><a href="https://news.ycombinator.com/item?id=49915060">https://news.ycombinator.com/item?id=49915060</a>
I did not know about that empty favicon trick, and I will be adding it to all my base HTML templates for my Flask projects where I get annoyed at all the 404s scrolling past as my browser keeps requesting a favicon that will not exist in that form.
And example.net!
<a href="https://en.wikipedia.org/wiki/Example.com" rel="nofollow">https://en.wikipedia.org/wiki/Example.com</a><p>example.com, example.net, example.org, and example.edu, along with .example, are all classified as the same type of name, reserved for documentation purposes.<p>Furthermore, there are IPv4 and IPv6 addresses that are reserved for documentation purposes! You never need to write live addresses, or even private RFC 1918 addresses!<p><a href="https://en.wikipedia.org/wiki/IPv4#Special-use_addresses" rel="nofollow">https://en.wikipedia.org/wiki/IPv4#Special-use_addresses</a>
the copy on example.com looks llm-generated now...
I find the text shown on this site passive agressive.<p>When a newbie learning programming sees this message, then this is a downer.<p>"Hello World from example.com [more info]"
I find it pretty neutral, if maybe a bit bureaucratic. It explains what this domain does, and what it’s not supposed to be used for – that’s it.
>When a newbie learning programming<p>A newbie shouldn't test their programs using example.com
Static test is still, IMHO best, but if they want that fancy transition they could at least have used a gif. All that js is terrible overkill.
Overkill for a web of humans loading sites in browsers. Not overkill for a dead internet with swarms of agents DDoSing everything in sight.
The language translation animation only lasted a few days. Now it’s static with English at the top and translations below.
You understand that the GIF would be larger than the JS, right? (Apart from other problems with this idea.)
It's down?
We (IPinfo) have a practice of adopting low-maintenance, high-utility services. Generally, we adopt websites that would have become defunct and run them as services.<p>Even though IANA says example.com is intended for documentation purposes and not as a service, I feel that it nonetheless serves as a service to the broader internet. I think there are some cornerstone services on the internet, regardless of the maintainers' intentions or their legal definitions.<p>For example, we ourselves sometimes have to recognize that we are not a standard API service. Considering that we expect to process 3 trillion requests this year, a major outage could take down a good chunk of IT systems everywhere. So, we invested in infrastructure to avoid outages. We then started adopting other cornerstone services and running them indefinitely because we might as well support the users who depend on them because we have infrastructure to support them and us.
For a moment I thought you were saying ipinfo runs example.com.<p>Instead it just seems to be an advert for ipinfo on a post about example.com?
Not an advert. I wish we ran example.com. However, we run a few other services.<p>The issue with example.com is this statement:<p>> This domain is for use in documentation examples without needing permission. This is not a service; avoid relying on it for testing and monitoring purposes.<p>The problem is that, disclaimer or not, if a website provides a useful utility, people will use it as a service.<p>If example.com breaks, IANA can reasonably say it was never intended to be stable. But that does not change the fact that people will use it for testing and monitoring.<p>What we do is adopt legacy services whose maintainers can no longer afford, want, or have the resources to maintain them, and invest in keeping them running reliably.
Example.com is one of the sites I visit most often for troubleshooting my connection on the go. It's great for tickling a captive Wi-Fi login that didn't trigger properly.
I think what you describe is exactly right, it has organically become a service and it is maintained with that in mind. That doesn't mean you shouldn't be clear about what its for and what should be avoided. Otherwise it is setting up an implicit contract that it will service those needs without limitation which turns it into an even bigger dependency.
Not to mention indefinitely. Any decommission, even decades in the future, will be messy. Or imagine if ipinfo got bought up by private equity and they turned off the free service, or maybe attached some sort of agent-pay token to the response[0] so that they collect revenue from running it when possible.<p>0: <a href="https://blog.cloudflare.com/monetization-gateway-beta/" rel="nofollow">https://blog.cloudflare.com/monetization-gateway-beta/</a>
[flagged]
IANA, a natural monopoly, can't even host simple html page is kinda funny.
IANA and ICANN should be moved under UN ITU from a non profit, so that they don't make breaking changes without approval.
What would have been nice is that depending on the visitors IP address’s region, showing a localised message instead of fixed number of languages
This feels like a “falsehood developers think about localization.”<p>It’s always funny when I get French YouTube ads. As if YouTube is desperately trying to offload the adbuys anywhere they can by pretending that Canada must mean French.
I hate this with a passion. Google is very guilty of this. Their AI summary very often insists on replying in the (IP) local language, nevermind the language of my HTTP headers, Google profile, or the actual natural language request...
Do you have ca-fr (or whatever) in your accept language header?
I want to read content only in a specific language. This is different language than the language of the country I live in. I have my operating system, my keyboard layout, my browser, my accept languages header, everything configured to the language I want.<p>And get I often get websites and ads in the language of the country my IP points to
Google famously think they know better than you what languages you want.
I think the whole point is for it to be a static site that is easily distributed with little-to-no overhead, as it probably receives a non-trivial amount of traffic.
Yep, that's exactly their reasoning:<p>> As it tends to be heavily trafficked, the overall bandwidth is a key consideration
Then they should have just kept it english only without any script.
That assumes that (i) every region has a primary language, and (ii) everyone in that region speaks that language, both of which are false.<p>(And false often enough that guessing language based on IP address works badly in practice, I hear.)
Just check the Accept-Language header
I believe it's just using the official languages of the UN