Many missing URLs in KB article about network endpoints

Hi Adobe,

There are many URLs missing in the KB article about Network Endpoints (https://helpx.adobe.com/enterprise/kb/network-endpoints.html). I’m not just talking about optional URLs but also essential URLs which affect the look & feel of your products - means they affect the real usability and product experience :( Moreover there are general inconsistencies. All in all this makes the implementation for IT admins very tedious.

Some examples:

1. If the URL "d3awf6rem6b5na.cloudfront.net" is blocked by firewall/proxy, the icons of plugins in the "Creative Cloud desktop app > Stock & Marketplace tab > Plugins" won't get displayed.
   --> However, this essential URL is missing in your detailed "Downloadable allowlist"!
    
2. If the URL "adobe-3di-substance-source.s3.us-west-2.amazonaws.com" is blocked by firewall/proxy, 3D Assets in the "Creative Cloud desktop app > Stock & Marketplace tab > 3D Assets" cannot be downloaded.
   --> However, this essential URL is missing in your detailed "Downloadable allowlist"!
    
3. If the URL "cpf-temp-repo-ew1-prod.s3.eu-west-1.amazonaws.com” is blocked by firewall/proxy, the export/download as PDF will fail in Adobe Express.
   --> However, this essential URL is missing in your detailed "Downloadable allowlist"!
    
4. If the URLs “api.echosign.com” and “adobe.na1.adobesign.com” are blocked by firewall/proxy, the Adobe Sign features won’t work.
   --> However, these essential URLs are missing in your detailed "Downloadable allowlist"!
    
5. If the URLs “cdn.substance3d.com” and “source-api.substance3d.com” are blocked by firewall/proxy, Adobe Substance 3D features won’t work.
   --> However, these essential URLs are missing in your detailed "Downloadable allowlist"!

These are just 5 examples of my findings. There are many more. As Adobe is unfortunately using a huge URL jungle, I do not know for each blocked URL what the consequences are. However, the allegedly complete granular allowlist ("Downloadable allowlist") is missing a lot of URLs - not just the examples above.

Below you can find a list containing a huge amount of missing URLs. Imho those should be all included in the "Downloadable allowlist" and other sections of the knowledge base article as well:

Apart from that, Adobe's "Downloadable allowlist" contains many URLs which are very probably deprecated or in the meantime maybe even malicious, e.g. (ftp.)yourdomain.com:

https://www.virustotal.com/gui/domain/yourdomain.com

Another inconsistency:

Apart from the fact that many URLs are missing in the "Downloadable allowlist", it also contains some very general wildcard domains, which should be only included in the separate KB section "The minimal allowlist" but not in the very granular "Downloadable allowlist". Two examples:

• Example 1
  Countless granular/specific URLs such as:
  lcs-ulecs.adobe.io
  audio-video-api.adobe.io
  livecreate-ew1.adobe.io
  …
  
  General wildcard domain:
  *.adobe.io

  
  If you choose the granular/specific approach and implement the exact URLs on the firewall, it makes no sense to also implement the general wildcard domain, as it will allow everything (no matter what – as long as it ends with ".adobe.io") .
  Therefore, naming the wildcard domain "*.adobe.io" in this granular "downloadable allowlist" makes no sense at all.
   

• Example 2
  Countless granular/specific URLs such as:
  t3.ftcdn.net
  t4.ftcdn.net
  as1.ftcdn.net
  as.ftcdn.net
  …
   

  General wildcard domain:
  *. ftcdn.net

  If you choose the granular/specific approach and implement the exact URLs on the firewall, it makes no sense to also implement the general wildcard domain, as it will allow everything (no matter what – as long as it ends with ".ftcdn.net") .
  Therefore, naming the wildcard domain "*.ftcdn.net" in this granular "downloadable allowlist" makes no sense at all.

One more severe inconsistency:

Many wildcard domains are missing from the section “The minimal allowlist”.  Either all wildcard domains used by Adobe products should be listed there, OR at least those that are required for the actual functionality of your products.
Regardless of Adobe's approach: the KB entry unfortunately lacks some essential wildcard domains that are even essential for the proper functioning of your products, such as:

Although I appreciate Adobe’s extensive documentation, it is worthless if it is fundamentally wrong.