Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The new .zip TLD is going to cause some problems

shkspr.mobi

Post reply on HN
Print view View original

31–40 of 90 posts

Re: The new .zip TLD is going to cause some problems

#31

Post by partiallypro »

anecdotal1 wrote: post #28
p4bl0 wrote: post #8

Funny that this is said from a .mobi website, which is also a file extension. Granted, .mobi files are much less used and much less standardly shared than .zip files, but still it made me smile.

.com .sh There are many file extension collisions with TLDs and the sky didn't fall yet

Neither of those are used by general consumers on a regular basis. Those are used by people that are generally knowledgeable. I don't know why people can't wrap their head around this. .zip is used every day by people that aren't the best at understanding computer security. Massive difference.

Re: The new .zip TLD is going to cause some problems

#33

Post by chrismorgan »

Honestly, I harbour just a smidgeon of hope that cases like this will nudge companies to reevaluate the whole “find text that could be a link with a missing protocol” feature and realise that it’s a terrible idea that causes more trouble than it solves. If you want a link, write a proper URL.

The embedded tweet shows another problem, too:

> Grrr... Because .zip is a valid TLD, it's impossible to know whether http://t.co/webB2l1Y9w should be a URL or a filename.

Twitter mangle your links to use t.co including the presented text, so that embedders have no way to determine that the text was supposed to be “example.zip” without following the link or the tweet link. There may have been some purpose to t.co quite a few years ago, but the reasons justifying it vanished completely a few years ago, leaving behind just something that is completely hostile to users and security common sense.

(This also reminds me of Cloudflare’s “email address protection” feature, which catches and mangles (in a you-need-to-run-our-JavaScript sort of way, so it doesn’t actually affect most people) various things that aren’t and can’t be email addresses, like package-name@1.2.3.)

Re: The new .zip TLD is going to cause some problems

#34

Post by pornel »

tbyehl wrote: post #19

Weird how everyone wants to blame the TLD and not the systems that naively convert text into hyperlinks.

Because these systems and conventions were first. ICANN should have considered the status quo instead of passing the buck to thousands of other preexisting implementations.

Re: The new .zip TLD is going to cause some problems

#35

Post by pornel »

brookst wrote: post #3

How is this different from .com, which was also a common file extension?

It's not a commonly used extension, and it's a dangerous file type, so users shouldn't be opening received .com files either way. OTOH .zip is quite common and has legitimate uses.

Re: The new .zip TLD is going to cause some problems

#36

Post by pornel »

bityard wrote: post #12

It's only going to cause problems for software which tries to be too smart for its own good. Applications should not try to guess what the user meant in ambiguous situations because they will often get it wrong.

Until now they were mostly getting it right, and unintended links were more of a minor annoyance than a risk (e.g. it happens when talking about Perl or Rust files, but programmers aren't an easy phishing target).

Re: The new .zip TLD is going to cause some problems

#37

Post by [deleted] »

partiallypro wrote: post #31
anecdotal1 wrote: post #28

Earlier quoted context omitted.

.com .sh There are many file extension collisions with TLDs and the sky didn't fall yet

Neither of those are used by general consumers on a regular basis. Those are used by people that are generally knowledgeable. I don't know why people can't wrap their head around this. .zip is used every day by people that aren't the best at understanding computer security. Massive difference.

[deleted]

Re: The new .zip TLD is going to cause some problems

#39

Post by iforgotpassword »

chrismorgan wrote: post #33

Honestly, I harbour just a smidgeon of hope that cases like this will nudge companies to reevaluate the whole “find text that could be a link with a missing protocol” feature and realise that it’s a terrible idea that causes more trouble than it solves. If you want a link, write a proper URL. The embedded tweet shows another problem, too: > Grrr... Because .zip is a valid TLD, it's impossible to know whether http://t…

I've only ever implemented this in hobby projects, but after a while my simple rule to detect links that are missing the protocol prefix became either having a www. prefix or having a slash after what could be a domain name.
Post reply on HN