Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The new .zip TLD is going to cause some problems

shkspr.mobi

Post reply on HN
Print view View original

71–80 of 90 posts

Re: The new .zip TLD is going to cause some problems

#73

Post by pornel »

tbyehl wrote: post #57
pornel wrote: post #34

Earlier quoted context omitted.

Because these systems and conventions were first. ICANN should have considered the status quo instead of passing the buck to thousands of other preexisting implementations.

The first TLD / file extension collision is older than that.

As I've said elsewhere, I don't think any of them was a big deal. Normal people don't send each other .com files, and users of .pl/.sh/.rs files are likely sophisticated enough to spot the difference. But tons of webmail users may click Photos.zip and open whatever it downloads. They already do in whatever phish mail they get, but thanks to autolinking now the boobytrapped links will be everywhere, including trusted sources.

Re: The new .zip TLD is going to cause some problems

#74

Post by hgs3 »

gcoakes wrote: post #64
hgs3 wrote: post #46

Earlier quoted context omitted.

Message someone and mention a file with a .zip extension, like "Go to Trusted Bank and download financials.zip". Since .zip is now a TLD, software could auto-link it to https://financials.zip . The receiver will think the sender legibility linked to financials.zip for their convivence, but in fact they'll be redirected to a URL with a malicious zip file.

At least with HTML email, I can already link text to an arbitrary link. This whole thing doesn't seem that important to me.

> At least with HTML email, I can already link text to an arbitrary link.

The sender doesn't have to link to anything. Merely writing some non-whitespace characters, followed by a dot, followed by a TLD can trigger client software to automatically create a link, e.g. mentioning "attachments.zip" could cause client software - that is trying to be clever - to create a link to https://attachments.zip which might serve a malicious zip file. The receiver will think the sender created the link, but in actuality it was their own software that created it trying to be clever.

> This whole thing doesn't seem that important to me.

This affects any client software that creates auto-links for TLD's. The "solution" is software must never create an auto-link in the absence of a protocol, e.g. never auto-link "example.com" but "https://example.com" is ok.

Re: The new .zip TLD is going to cause some problems

#75

Post by desro »

wand3r wrote: post #43
computerfriend wrote: post #23

Earlier quoted context omitted.

Use an ad blocker.

I'm not sure you can on iOS? Or not in a straightforward way. If you can block YT ads on ios, would love to know

Safari extensions "Vinegar" and "Baking Soda" are also great at turning pretty much any web video player into a native html5 player and automatically blocking autoplay.

Re: The new .zip TLD is going to cause some problems

#78

Post by neurostimulant »

gcoakes wrote: post #64
hgs3 wrote: post #46

Earlier quoted context omitted.

Message someone and mention a file with a .zip extension, like "Go to Trusted Bank and download financials.zip". Since .zip is now a TLD, software could auto-link it to https://financials.zip . The receiver will think the sender legibility linked to financials.zip for their convivence, but in fact they'll be redirected to a URL with a malicious zip file.

At least with HTML email, I can already link text to an arbitrary link. This whole thing doesn't seem that important to me.

Chat clients like whatsapp don't allow you to link text to an arbitrary link, but instead will automatically turns text "attachment.zip" into a link to http://attachment.zip
Post reply on HN