Live data from Hacker News

Taking control of all .io domains with a targeted registration

thehackerblog.com

181–190 of 258 posts

Re: Taking control of all .io domains with a targeted registration

#181

This is a huge screwup on the part of the people who run the 'root' of .IO, and their entire operation should be severely scrutinized by ICANN. In my opinion almost all of the 'weird' TLDs which are country codes that are actually operated by a third party commercial service are 95% spam and junk registrations. .TV is a good example. Technical screwups aside, the existence of .IO and the fact that it "belongs" to the…

Cloudflare For Top Level Domains? :)

Why would that be a good thing, exactly?

Re: Taking control of all .io domains with a targeted registration

#182
post #33

This is a huge screwup on the part of the people who run the 'root' of .IO, and their entire operation should be severely scrutinized by ICANN. In my opinion almost all of the 'weird' TLDs which are country codes that are actually operated by a third party commercial service are 95% spam and junk registrations. .TV is a good example. Technical screwups aside, the existence of .IO and the fact that it "belongs" to the…

Just so no one is misled: "original inhabitants" does not mean "indigenous peoples" with respect to the BIOT. The islands were not populated prior to late-18th Century European colonization. The depopulation was of post-colonial people.

https://en.wikipedia.org/wiki/Depopulation_of_Chagossians_fr...

Re: Taking control of all .io domains with a targeted registration

#183
post #84

Side note: Please don’t use such gray and thin fonts. I had to modify the CSS to use black instead of #555 for the text color.

I don't mean this pejoratively, but how old are you? I'm just curious as I had no problems with the color / font weight. For my sites I usually use something like #232323 instead of pure black.

Re: Taking control of all .io domains with a targeted registration

#184

This is a huge screwup on the part of the people who run the 'root' of .IO, and their entire operation should be severely scrutinized by ICANN. In my opinion almost all of the 'weird' TLDs which are country codes that are actually operated by a third party commercial service are 95% spam and junk registrations. .TV is a good example. Technical screwups aside, the existence of .IO and the fact that it "belongs" to the…

.io has been on my mind for months now.

There is a guy who has a auction service for .io. He claimed his site is legit, and he's just a great Programmer, and Salesman.

I forget the site, and he might be a straight shooter.

I think I figured out his success. I think he scooped up thousands before he started the auction site, and people are basically just buying his domains.

There's nothing wrong with that--I guess?

My point is .io seems shady. I think they are overpriced. Yes--$99 bucks a year is $90 too much.

I know the .io is popular among tech people. The rest of the world could care less.

Re: Taking control of all .io domains with a targeted registration

#185

Earlier quoted context omitted.

We just used ai.google instead of google.ai as the canonical domain name for Google's AI initiative for precisely this reason. (We run .google and you can see the source code at https://nomulus.foo )

How about setting MX records for .google so you can have name@google emails

There's far too much software that won't accept that, sadly.

Re: Taking control of all .io domains with a targeted registration

#186

I am really super happy that the root domain serving the largest IOT population on the planet wasn't co-opted by the MIRAI bot writers. That could have been a net killing event.

There's an IOT population? I thought it was just a dumb trend everyone hates?

I'm not trying to diss anyone, I just thought the whole "IoT" concept was dead in the water?

Re: Taking control of all .io domains with a targeted registration

#187
post #163

Earlier quoted context omitted.

> That it is a distinction is important to me. Why ?

Are you being deliberately obtuse? It's a pretty important distinction that these were not some native tribesmen with millennia of ancestral history tied up in the lands.

No its not.

Re: Taking control of all .io domains with a targeted registration

#188

Earlier quoted context omitted.

We just used ai.google instead of google.ai as the canonical domain name for Google's AI initiative for precisely this reason. (We run .google and you can see the source code at https://nomulus.foo )

How about setting MX records for .google so you can have name@google emails

We also have .gmail, so you can imagine some clever possibilities with that.

God knows how widely a "ben@google" email address would work though. I'm going to guess not very.

Re: Taking control of all .io domains with a targeted registration

#189
Good grief! I've always found using vanity domains for your project/company to be tasteless at best. Now .io is even associated with deportation, dispute of territory, and security screwups. Using an .io domain only serves to demonstrate that you care about pretending to be a 2010-ish startup at the expense of everything else at this point.

Re: Taking control of all .io domains with a targeted registration

#190

Wow, I don't think I would've even considered such an attack... DNSSEC, HSTS and Certificate Pinning would've made it more difficult to abuse this, but I guess it would've been pretty easy to get valid SSL certificates for all your favourite .io domains. Let's try to play malicious party here: Phase A: First set up a simple DNS forwarder playing by the rules and answering requests as we should (as to not get any unwa…

If you control the root DNS servers for .io, you can simply not answer the DNSSEC queries. Many resolvers will fail open. HSTS requires the site is HTTPS with a valid cert. If you own all .io, you can use LetsEncrypt to get that for free. They now even support Wildcard Certs! :-) That said, you would have to choose your targets carefully and/or load balance your requests to LetsEncrypt. There is a rate limit. There a…

I think the problem with PKP is that there's such a big risk of temporarily unfixable breakage if things aren't done right.
Post reply on HN