Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Taking control of all .io domains with a targeted registration

thehackerblog.com

Post reply on HN
Print view View original

131–140 of 258 posts

Re: Taking control of all .io domains with a targeted registration

#131

Post by sillysaurus3 »

Karunamon wrote: post #128
sillysaurus3 wrote: post #120

Earlier quoted context omitted.

"Responsible disclosure" is a coercive term. It implies that it's irresponsible to do anything else. "Coordinated disclosure" is far better. That said, coordinated disclosure is the neighborly thing to do, but it's by no means a moral obligation. It would be perfectly fine for the author to tweet about it, for example.

It represents a moral judgement that it is absolutely not okay (or perhaps: irresponsible) to screw over n+y people for the actions of n people.

This moral judgement is mistaken because its premise is false. The moral blame lies on the company that allowed the problem to happen, not the person calling attention to it. It's not at all the same as "if I leave my door unlocked..." type scenarios. It's perfectly legal to register .io's nameservers.

Re: Taking control of all .io domains with a targeted registration

#132

Post by Steeeve »

walrus01 wrote: post #13

This is a huge screwup on the part of the people who run the 'root' of .IO, and their entire operation should be severely scrutinized by ICANN. In my opinion almost all of the 'weird' TLDs which are country codes that are actually operated by a third party commercial service are 95% spam and junk registrations. .TV is a good example. Technical screwups aside, the existence of .IO and the fact that it "belongs" to the…

The idea that there should be a breakdown of domains by country is a bad one. There's this situation. There are many other situations where countries don't have the resources or drive to maintain what they have been allocated. And then there's the fact that there are enough domains conflicting with this structure that it makes no intuitive sense.

The fact is that there is nothing that can be derived by an end user from most top level TLDs. EDU is one of the few, but then anybody can have a subdomain in an edu environment for any purpose.

Maybe the time isn't now, but somebody should be thinking about how to replace the current domain management system and with what.

Re: Taking control of all .io domains with a targeted registration

#133

Post by chriswarbo »

andai wrote: post #125
runnr_az wrote: post #7

That's amazing! Nice find, man!

Trying to figure out why you were downvoted. Was it the positivity? The exclamation marks? The lack of pretending to contribute to the conversation?

I downvoted because it doesn't raise any questions or add any information to the discussion.

BTW, neither does commenting about votes ;)

As per https://news.ycombinator.com/newsguidelines.html

"Please resist commenting about being downvoted. It never does any good, and it makes boring reading."

Re: Taking control of all .io domains with a targeted registration

#134

Post by kuschku »

leipert wrote: post #115
kuschku wrote: post #57

Earlier quoted context omitted.

There are a few ccTLDs that differ from that, though. DENIC and CZNIC are two that are generally very well-run, DENIC even offering better security and safety than many gTLDs (while also being a cooperative, not a commercial NIC, so prices are very low, too)

It is really nice, that the .de domain is seen more as infrastructure than some business. But there are a few downsides to DENIC as well. 1. you need to have a person (juridicial or natural) with an address in Germany to register and list that person as ADMIN-C 2. if you run a website that provide contents which COULD generate revenue, you have to have an Impressum [1] which includes the address, names, etc. of the w…

Well, this is what every domain should have, though. A Ladungsfähige Anschrift of a person that is liable.

This is a major criticism I have with many other domains, I don’t know where to send a C&D, or whom to sue if they violate my rights.

And requiring only commercial entities to have these things also makes sense.

Re: Taking control of all .io domains with a targeted registration

#135

Post by pmarreck »

walrus01 wrote: post #13

This is a huge screwup on the part of the people who run the 'root' of .IO, and their entire operation should be severely scrutinized by ICANN. In my opinion almost all of the 'weird' TLDs which are country codes that are actually operated by a third party commercial service are 95% spam and junk registrations. .TV is a good example. Technical screwups aside, the existence of .IO and the fact that it "belongs" to the…

In the mid 90's I got to spend a quiet and frankly wonderful 60 days on Diego Garcia while I was enlisted in the USAF. It is a wonderful island, you can bike around the whole thing in a couple hours, the rec facilities were great, beer was incredibly cheap, and the Internet (on such a remote island, in 1995!) was the best/fastest I had seen at that point.

That all said, the forced expulsion thing (which I just caught up on) is news to me now. I guess bullies will always exist. It reminds me of forcibly relocating people in the US via eminent domain to build a highway. It's possible that an ethical argument can be made that if the security of the USA actually did depend on total control of that island, the cost in dollars and emotion of "strongly encouraging" people to move elsewhere might be justifiable (and I do believe they were compensated... the gassing of pets thing is shocking, though).

Re: Taking control of all .io domains with a targeted registration

#136

Post by mpounsett »

While it's definitely an error on the part of the backend registry operator for .io, this is not the major security issue the author describes. He couldn't have hijacked any DNS traffic this way.

I've written in detail about why this is the case at https://mpounsett.blogspot.ca/2017/07/the-io-error-problem-w...

Re: Taking control of all .io domains with a targeted registration

#137

Post by rmwaite »

CydeWeys wrote: post #79
james_pm wrote: post #76

Earlier quoted context omitted.

Like .ai, the new "hot" ccTLD.

We just used ai.google instead of google.ai as the canonical domain name for Google's AI initiative for precisely this reason. (We run .google and you can see the source code at https://nomulus.foo )

Hey, when are you guys gonna open .meme? Asking for a friend :-)

Re: Taking control of all .io domains with a targeted registration

#138

Post by walrus01 »

CydeWeys wrote: post #67
coldpie wrote: post #62

Earlier quoted context omitted.

As an average user, how do I know which is which? How can I tell whether .ABCXYZ is competently run and trustworthy? gTLDs & ccTLDs have to be some of the worst ideas in Internet history.

ccTLDs are two letters long and gTLDs are everything else.

except all the new punycode IDN ccTLDs which now exist, for chinese, bulgarian, russian, etc.

Re: Taking control of all .io domains with a targeted registration

#139

Post by walrus01 »

CydeWeys wrote: post #79
james_pm wrote: post #76

Earlier quoted context omitted.

Like .ai, the new "hot" ccTLD.

We just used ai.google instead of google.ai as the canonical domain name for Google's AI initiative for precisely this reason. (We run .google and you can see the source code at https://nomulus.foo )

I just looked at the wikipedia page for the .ai ccTLD and registering something in Anguilla requires.... a fax machine?

It's like time traveling to 1987.

Re: Taking control of all .io domains with a targeted registration

#140

Post by walrus01 »

kuschku wrote: post #134
leipert wrote: post #115

Earlier quoted context omitted.

It is really nice, that the .de domain is seen more as infrastructure than some business. But there are a few downsides to DENIC as well. 1. you need to have a person (juridicial or natural) with an address in Germany to register and list that person as ADMIN-C 2. if you run a website that provide contents which COULD generate revenue, you have to have an Impressum [1] which includes the address, names, etc. of the w…

Well, this is what every domain should have, though. A Ladungsfähige Anschrift of a person that is liable. This is a major criticism I have with many other domains, I don’t know where to send a C&D, or whom to sue if they violate my rights. And requiring only commercial entities to have these things also makes sense.

making a single person personally liable for content that's hosted on a domain is problematic, to say the least. Go down that path and you eventually end up where the chinese government is now. Where you need a "license" from some ministry to operate an http daemon and you need to hire censors to police all user generated content that disagrees with an authoritarian regime's politics.

https://www.google.com/search?q=china+lgbt+web&ie=utf-8&oe=u...

Post reply on HN