Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We spent $20 to achieve RCE and accidentally became the admins of .mobi

labs.watchtowr.com

Post reply on HN
Print view View original

381–390 of 391 posts

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#381

Post by parineum »

hsbauauvhabzb wrote: post #273
ohashi wrote: post #219

Earlier quoted context omitted.

This is the most obvious reason why Verisign is a monopolist and should be regulated like a utility. They make false claims about choice and not being locked in. You buy a domain, you use it, you're locked in forever. And they know it. That's why they fight tooth and nail to protect their monopoly.

It’s worse if you stop using the phrase ‘buy’ and instead use the term ‘rent’. A DNS provider could 10,000x your domain cost and there’s nothing you can do about it.

And if you're domain is really worth that much, you can sell it before it expires.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#382

Post by Semaphor »

firefoxd wrote: post #380
Semaphor wrote: post #371

Earlier quoted context omitted.

https://www.sim.de/ German provider

If I compared it to the service provider in Guinea, I can also say that you are overpaying way too much.

Germany is not exactly known for cheap plans, but apparently it’s worse in the US and you can only get comparable plans if you pay yearly, which I guess might just barely make a $5 parking contract worth it.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#383

Post by nusl »

WeLostMcguffin wrote: post #306
nusl wrote: post #12

Pretty horrible negligence on the part of .mobi to leave a domain like this to expire.

Can't agree entirely. It's negligent, sure, but the negligent part wasn't letting it expire. The negligent part was not holding the domain with an error result for 10 years and respond to every request with an email telling them to stop using that domain. And I say 10 years because 10 years of having a broken system is already way too long to not go addressing, no matter how sluggish the service underneath. You can n…

Sure, though if you're a central provider like a registrar/ISP there are very bad things that happen no matter what you do with a domain.

Since the registrar could very easily determine whether or not the domain was in active use in the wild (and still return an error if they wanted), and didn't, I do consider it negligence.

People hard-code them, they end up in configs, all over, specially in forgotten or hard-to-change places.

$20 a year forever is pretty cheap for a company.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#384

Post by MichaelZuo »

dgoldstein0 wrote: post #359
MichaelZuo wrote: post #181

Earlier quoted context omitted.

Plus IPv6 has significant downsides (more complex, harder to understand, more obscure failure modes, etc…), so the actual cost of moving is the transition cost + total downside costs + extra fears of unknown unknowns biting you in the future.

Definitely there are fear of unknowns to deal with. And generally some business won't want to pay the switching costs over something perceived to be working. IPv6 is simpler in a lot of ways than ipv4 - fewer headers/extensions, no support for fragmentation. What makes it more complicated? What makes the failure modes more obscure? Is it just that dual stack is more complex to operate?

Well you can try listing the top dozen or so for both and see the difference?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#385

Post by wkat4242 »

robert_tweed wrote: post #377
hsbauauvhabzb wrote: post #273

Earlier quoted context omitted.

It’s worse if you stop using the phrase ‘buy’ and instead use the term ‘rent’. A DNS provider could 10,000x your domain cost and there’s nothing you can do about it.

This actually happened to me, but fortunately I never actually used the domain. I registered tweed.dev intending to use robert.tweed.dev as a personal blog. It wasn't classed as a "premium" domain and the first year was £5 or something IIRC, which was half price compared to the normal renewal fee. The next year they decided it was premium after all, and wanted to charge £492,000 for renewal. I still have a screenshot…

Couldn't you just transfer it to another registrar? I guess they blocked that but I wonder whether icann allows them to do so. It's indeed ridiculous.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#386

Post by wkat4242 »

notpushkin wrote: post #339
XajniN wrote: post #331

Earlier quoted context omitted.

The EU roaming thing usually works for 6-12 months until you are required to connect to the home network.

I don’t think that’s a big problem though? Especially if you live in Germany and get a SIM card in e.g. Czech Republic.

It depends of course how far you are. I used to use an orange Spain SIM before the EU roaming deal because they had free roaming on sister networks. But I didn't go there so much.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#387

Post by salad-tycoon »

declan_roberts wrote: post #102
post-it wrote: post #101

Obviously there are a lot of errors by a lot of people that led to this, but here's one that would've prevented this specific exploit: > As part of our research, we discovered that a few years ago the WHOIS server for the .MOBI TLD migrated from whois.dotmobiregistry.net to whois.nic.mobi – and the dotmobiregistry.net domain had been left to expire seemingly in December 2023. Never ever ever ever let a domain expire.…

Always use subdomains. Businesses only ever need a single $10 domain for their entire existence.

A lot of interesting and informative rebuttals to this comment but no one anticipated the obvious counter argument.

Businesses only ever need two $10 domains, usercompany.com and company.com, just in case they ever want to host user generated content.

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#388

Post by tdy_err »

robert_tweed wrote: post #377
hsbauauvhabzb wrote: post #273

Earlier quoted context omitted.

It’s worse if you stop using the phrase ‘buy’ and instead use the term ‘rent’. A DNS provider could 10,000x your domain cost and there’s nothing you can do about it.

This actually happened to me, but fortunately I never actually used the domain. I registered tweed.dev intending to use robert.tweed.dev as a personal blog. It wasn't classed as a "premium" domain and the first year was £5 or something IIRC, which was half price compared to the normal renewal fee. The next year they decided it was premium after all, and wanted to charge £492,000 for renewal. I still have a screenshot…

Isn’t Google the .dev registrar?

Re: We spent $20 to achieve RCE and accidentally became the admins of .mobi

#389

Post by xelamonster »

tdy_err wrote: post #388
robert_tweed wrote: post #377

Earlier quoted context omitted.

This actually happened to me, but fortunately I never actually used the domain. I registered tweed.dev intending to use robert.tweed.dev as a personal blog. It wasn't classed as a "premium" domain and the first year was £5 or something IIRC, which was half price compared to the normal renewal fee. The next year they decided it was premium after all, and wanted to charge £492,000 for renewal. I still have a screenshot…

Isn’t Google the .dev registrar?

They operate the registry, but are not a registrar (bad choice of terminology) since they sold off that part of their business to Squarespace. Unclear to me who actually raised the price here since you can register a .dev domain with many registrars.

That's insane though, I assumed renewal prices were more or less locked in after you own a domain. Even the premium ones that go for thousands say they renew at the standard $12 or whatever.

Post reply on HN