Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

331–340 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#331

Post by XajniN »

notpushkin wrote: post #318
sneak wrote: post #271

Earlier quoted context omitted.

Thankfully you can still get them without ID, for cash. Unlike in Germany, where you can’t get one without a passport or ID card.

I’m wondering how feasible would it be to just use a SIM card from another country (e.g. in Estonia, you can get a prepaid card for 1 € that works in EU roaming just fine, with domestic-like prices on local calls). How many services in Germany require you to use specifically German number?

The EU roaming thing usually works for 6-12 months until you are required to connect to the home network.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#332

Post by ryan29 »

ossyrial wrote: post #330
ohashi wrote: post #219

Earlier quoted context omitted.

This is the most obvious reason why Verisign is a monopolist and should be regulated like a utility. They make false claims about choice and not being locked in. You buy a domain, you use it, you're locked in forever. And they know it. That's why they fight tooth and nail to protect their monopoly.

There is an alternative to such regulation though. In the Netherlands, all registrars are required to support automatic transfer between registrars. You can lookup your "transfer code", which you can enter at a new registrar, and they will handle that your domain is transferred (with proper DNS etc) and your old subscription stops.

GP is referring to the registry, not the registrar. There's lots of competition between registrars, but the registries have a post-sale monopoly on all domains.

Put another way, as soon as you register a .com domain, the only registry that can sell you a renewal is Verisign. If there weren't price controls, Verisign could increase the price of a .com renewal to $100 and there's nothing anyone could do but pay it.

This whole thread back to the root is right. Verisign has a monopoly, you can never drop a domain once it's associated with your business, and all of it should be regulated like a monopoly.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#333

Post by huskyr »

ryan29 wrote: post #332
ossyrial wrote: post #330

Earlier quoted context omitted.

There is an alternative to such regulation though. In the Netherlands, all registrars are required to support automatic transfer between registrars. You can lookup your "transfer code", which you can enter at a new registrar, and they will handle that your domain is transferred (with proper DNS etc) and your old subscription stops.

GP is referring to the registry , not the registrar . There's lots of competition between registrars, but the registries have a post-sale monopoly on all domains. Put another way, as soon as you register a .com domain, the only registry that can sell you a renewal is Verisign. If there weren't price controls, Verisign could increase the price of a .com renewal to $100 and there's nothing anyone could do but pay it. T…

Yup. Think about what happened when the Internet Society almost sold the .org TLD to Ethos Capital and they were planning on raising the registration prices by a lot.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#334

Post by mr_mitm »

SSLy wrote: post #216
lovasoa wrote: post #206

> $ sqlite3 whois-log-copy.db "select source from queries"|sort|uniq|wc -l Oh cool they saved the logs in a database ! Wait... |sort|uniq|wc -l ?? But why ?

beats up re-re-remembering how to do it in sql

I found that this is actually a good use case for LLMs. You can probably paste that one liner up there and ask it to create the corresponding SQL query.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#335

Post by ryan29 »

j-bos wrote: post #280
hsbauauvhabzb wrote: post #273

Earlier quoted context omitted.

It’s worse if you stop using the phrase ‘buy’ and instead use the term ‘rent’. A DNS provider could 10,000x your domain cost and there’s nothing you can do about it.

Can they? I thought ICANN prevented such steep increases?

There are a bunch of different domain types all commingled together; non-premium gTLD domains, ccTLD domains, 3rd level domains, registry premium gTLD domains and, as added complexity, aftermarket domains which could be any of the previous listed types.

ICANN provides some protection for standard gTLD domains, but it's minimal. You're guaranteed identical pricing to all other standard domain registrants on the gTLD, so they can only raise your price by raising the price of everyone else at the same time. That hasn't stopped some registries from 10x price increases though. The only thing it does is ensure they can't single you out and massively hike your renewal fee.

However, that does not apply to registry premium gTLD domains. When you register a registry premium domain you waive those protections and the registries can technically do anything they want.

If you register a ccTLD domain, you're at the mercy of that country's registry. If you register a 3rd level domain you're at the mercy of the 2nd level domain owner and they're regulated by either ICANN or a country based registry.

It's actually somewhat complex when you get into it.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#336

Post by ryan29 »

huskyr wrote: post #333
ryan29 wrote: post #332

Earlier quoted context omitted.

GP is referring to the registry , not the registrar . There's lots of competition between registrars, but the registries have a post-sale monopoly on all domains. Put another way, as soon as you register a .com domain, the only registry that can sell you a renewal is Verisign. If there weren't price controls, Verisign could increase the price of a .com renewal to $100 and there's nothing anyone could do but pay it. T…

Yup. Think about what happened when the Internet Society almost sold the .org TLD to Ethos Capital and they were planning on raising the registration prices by a lot.

If you really want to get upset, go look what the NTIA did with the 2018 renewal of the .com agreement. Prior to 2018, the US DoC had a significant amount of oversight and control. The 2018 renewal pretty much gave .com to Verisign. The only thing the US DoC can do now is renew the contract as-is or withdraw.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#337

Post by SSLy »

mr_mitm wrote: post #334
SSLy wrote: post #216

Earlier quoted context omitted.

beats up re-re-remembering how to do it in sql

I found that this is actually a good use case for LLMs. You can probably paste that one liner up there and ask it to create the corresponding SQL query.

yeah, they're good for cursed tools like that, ffmpeg, excel macros, etc etc

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#338

Post by account42 »

lambda wrote: post #100
account42 wrote: post #89

Earlier quoted context omitted.

Fully compiled languages don't even have an eval at all.

No, but they have system or the like, which is effectively the same, just being evaluated by the shell. https://man7.org/linux/man-pages/man3/system.3.html

a) system doesn't let you modify the state of the running process so it doesn't attract abuse like the example here. It's still a bad function but calling it effectively the same is absurd - the scope for "clever" usage of it is much much lower.

b) It's a legacy misfeature that I hope new compiled languages don't copy. There are much much better better interfaces for running processes that don't rely on an intermediate shell.

c) Shell escaping is much more stable than some hipster language like PHP where you'd need to update your escaping for new language changes all the time.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#339

Post by notpushkin »

XajniN wrote: post #331
notpushkin wrote: post #318

Earlier quoted context omitted.

I’m wondering how feasible would it be to just use a SIM card from another country (e.g. in Estonia, you can get a prepaid card for 1 € that works in EU roaming just fine, with domestic-like prices on local calls). How many services in Germany require you to use specifically German number?

The EU roaming thing usually works for 6-12 months until you are required to connect to the home network.

I don’t think that’s a big problem though? Especially if you live in Germany and get a SIM card in e.g. Czech Republic.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#340

Post by [deleted] »

ryan29 wrote: post #335
j-bos wrote: post #280

Earlier quoted context omitted.

Can they? I thought ICANN prevented such steep increases?

There are a bunch of different domain types all commingled together; non-premium gTLD domains, ccTLD domains, 3rd level domains, registry premium gTLD domains and, as added complexity, aftermarket domains which could be any of the previous listed types. ICANN provides some protection for standard gTLD domains, but it's minimal. You're guaranteed identical pricing to all other standard domain registrants on the gTLD,…

[deleted]
Post reply on HN