You’ve probably built APIs assuming that certain internet standards are sacred. You trust HTTPS, you trust DNS, and if you’re a developer, you trust the /.well-known/ URI registry. It’s maintained by IANA, the ultimate authority on internet infrastructure. It feels like a gated community of elite engineers.
It’s not. It’s a public wiki with zero vetting.
Someone recently looked at the registry and noticed a bizarre entry. They asked a simple question: “Can anyone just add themselves? Is ‘Wei Tang’ and ‘[email protected]’ well known?”
The answer is a resounding yes. Anyone can submit a pull request. The barrier to entry isn’t a rigorous peer review; it’s basically a web form.
A standard isn’t a guarantee of quality; it’s just a record of who showed up first.
This creates a massive, invisible tension in the tech world. The /.well-known/ path is used for critical security protocols—like SSL certificate validation, security.txt files, and OAuth configurations. We treat these URIs as definitive because they live on IANA’s hallowed domain. But the “well-known” label is only as reliable as the community’s oversight, not a technical guarantee.
When everyone is ‘well-known,’ no one is.
If you’re an API designer or protocol implementer, this should set off alarm bells. You are building security architectures on top of a system that operates on the honor system. The trust you place in IANA isn’t misplaced—the organization is crucial—but the assumption that their registries are pre-vetted for legitimacy is dangerous.
This isn’t just an administrative loophole; it’s an abstraction leak that threatens interoperability. The registry aims to be a definitive, standardized reference, yet the self-submission process blurs the line between legitimate standards and blatant self-promotion.
Trust is not a protocol; it’s a social contract. And right now, that contract is written on a napkin.
Stop treating IANA registries as gospel. The next time you see a “well-known” URI, don’t assume it earned its place through consensus. Verify its adoption. Check its community traction. The internet is built on open standards, but openness without oversight is just an open door.
FAQ
Q: Doesn't IANA review these submissions?
A: No. IANA acts as a registrar, not a gatekeeper. They manage the registry, but the burden of review and consensus falls entirely on the IETF community.
Q: How should I handle well-known URIs in production?
A: Treat them with skeptical curiosity. Just because a URI is listed doesn't mean it's widely adopted or secure. Verify its community traction before integrating it into your security stack.
Q: Is self-submission actually a good thing?
A: It's a double-edged sword. It allows for rapid innovation and open standards, but it also means the registry is polluted with vanity entries and unproven protocols.