Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Taking control of all .io domains with a targeted registration

thehackerblog.com

Post reply on HN
Print view View original

191–200 of 258 posts

Re: Taking control of all .io domains with a targeted registration

#191

Post by Clubber »

michaelbuckbee wrote: post #25

So, the real question is: "How much should we freak out about this?" If you scroll back a few months to Cloudbleed/Cloudflare we sort of collectively decided that because cache data containing sensitive info (passwords, tokens, whatever) might be accessible for your site using Cloudflare that everything should be revoked, force password resets, etc. Now we have this vuln, which I'll dub "IOgate" because it's the cool…

>I'll dub "IOgate" because it's the cool thing to name these.

FWIW, I've found that whenever major news outlets use the "gate" postfix for anything other than Watergate, it's an indicator that they're being manipulative (it's tabloid bullshit). The certainly didn't call it Snowdengate or Trump/Russiagate.

Keep an eye out and see if you don't agree.

I deem this Clubber's Law!

Re: Taking control of all .io domains with a targeted registration

#192

Post by Mithorium »

CydeWeys wrote: post #188
Mithorium wrote: post #179

Earlier quoted context omitted.

How about setting MX records for .google so you can have name@google emails

We also have .gmail, so you can imagine some clever possibilities with that. God knows how widely a "ben@google" email address would work though. I'm going to guess not very.

True, I imagine a lot of software wouldn't know how to handle an email without a dot in the domain part

That and apparently ICANN would frown upon such an implementation [1]

[1] https://www.icann.org/news/announcement-2013-08-30-en

Re: Taking control of all .io domains with a targeted registration

#193

Post by nurettin »

rdtsc wrote: post #176
venning wrote: post #33

Earlier quoted context omitted.

Just so no one is misled: "original inhabitants" does not mean "indigenous peoples" with respect to the BIOT. The islands were not populated prior to late-18th Century European colonization. The depopulation was of post-colonial people.

> Just so no one is misled: "original inhabitants" does not mean "indigenous peoples" with respect to the BIOT. ... The depopulation was of post-colonial people. Oh that's fine then. They only lived there for what 100 years, totally fine to do these things to those 1000 some people: https://en.wikipedia.org/wiki/Diego_Garcia --- first tactics were implemented to decrease the population of Diego Garcia. Those who left…

Is there a country on Earth which does not have a forced removal of 1000+ people in it's history?

I mean, that doesn't justify the act, but I question the logic of claiming moral superiority or questioning authenticity over this.

Re: Taking control of all .io domains with a targeted registration

#194

Post by Symbiote »

7ewis wrote: post #126

I had a similar issue with the .IM domain three months ago. One of the four NS for the domain was not responding. Two of the guys at Cloudflare diagnosed it for me: https://twitter.com/xxdesmus/status/855858441289572353

At least that name is not at risk of subversion.

JA.NET is the Joint Academic Network, the university / academic Internet infrastructure for the UK.

Re: Taking control of all .io domains with a targeted registration

#195

Post by case »

bad_user wrote: post #113
CydeWeys wrote: post #53

Earlier quoted context omitted.

I'm in the TLD space (we run a fair number of gTLDs). If a gTLD operator screwed up like this then there could be consequences. A ccTLD, however, runs with very few restrictions. I don't see much of consequence happening to it as a result of this. I will, however, say that gTLDs are generally more secure and well-run than smaller ccTLDs, and are worth preferring for that reason. It's a weird historical quirk that .io…

Besides the old .org, what better options are there for software projects?

Play around at domainr.com, a brainstorming tool some friends and I made a few years ago. It supports all the new generic TLDs.

Re: Taking control of all .io domains with a targeted registration

#196

Post by narrowtux »

CrystalLangUser wrote: post #183
hk__2 wrote: post #84

Side note: Please don’t use such gray and thin fonts. I had to modify the CSS to use black instead of #555 for the text color.

I don't mean this pejoratively, but how old are you? I'm just curious as I had no problems with the color / font weight. For my sites I usually use something like #232323 instead of pure black.

I'm 25 and had to zoom to read and even then it wasn't comfortable. (not the OP)

Re: Taking control of all .io domains with a targeted registration

#197

Post by 7ewis »

addedlovely wrote: post #155
7ewis wrote: post #126

I had a similar issue with the .IM domain three months ago. One of the four NS for the domain was not responding. Two of the guys at Cloudflare diagnosed it for me: https://twitter.com/xxdesmus/status/855858441289572353

One Cofounder of cloudflare, pretty impressed they picked up tweets directly.

They really are great guys, it's not the first time they've tweeted me either!

The CEO is active on HN too. Great customer service.

Re: Taking control of all .io domains with a targeted registration

#198

Post by CrystalLangUser »

narrowtux wrote: post #196
CrystalLangUser wrote: post #183

Earlier quoted context omitted.

I don't mean this pejoratively, but how old are you? I'm just curious as I had no problems with the color / font weight. For my sites I usually use something like #232323 instead of pure black.

I'm 25 and had to zoom to read and even then it wasn't comfortable. (not the OP)

Ah I see, upping the font-weight to 400 helped when viewing it on my laptop screen. I didn't really have that issue on mobile, though.

Re: Taking control of all .io domains with a targeted registration

#200

Post by d--b »

michaelbuckbee wrote: post #25

So, the real question is: "How much should we freak out about this?" If you scroll back a few months to Cloudbleed/Cloudflare we sort of collectively decided that because cache data containing sensitive info (passwords, tokens, whatever) might be accessible for your site using Cloudflare that everything should be revoked, force password resets, etc. Now we have this vuln, which I'll dub "IOgate" because it's the cool…

I would have gone for "ih oh" rather than iogate!
Post reply on HN