Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Taking control of all .io domains with a targeted registration

thehackerblog.com

Post reply on HN
Print view View original

51–60 of 258 posts

Re: Taking control of all .io domains with a targeted registration

#51

Post by panglott »

ben_jones wrote: post #47
mrkrab wrote: post #32

>Technical screwups aside, the existence of .IO and the fact that it "belongs" to the UK government is morally questionable, since the entire country code only exists because the British and American militaries forcibly removed the original inhabitants of islands such as Diego Garcia so that they could use the area as naval and air force bases. Since you're getting political there for no reason at all, let me say thi…

This comment is in terrible taste but it isn't wrong. We can't just shove our hands in the sand and say it isn't fair so it isn't true.

Might makes the rules, but that doesn't mean the rules are right. We can definitely shove our hands in the sand and say that they are not fair.

Re: Taking control of all .io domains with a targeted registration

#52

Post by JoshTriplett »

toast0 wrote: post #45
JoshTriplett wrote: post #21

Earlier quoted context omitted.

HSTS (correction: HPKP) preloading would help avoid that, and Certificate Transparency monitoring would help detect it, but yes, in general, if you control DNS for a domain, you can get a valid certificate for the domain.

HSTS preloading doesn't help if you can get a Domain Validated certificate. HPKP preloading helps, but only if you pin to a CA that won't issue a DV certificate to someone who controls 4 out of 7 of the nameservers for the TLD your domain is in. And also only helps if the incident is cleaned up before the browser preload process catches the malicious server when confirming the preload. It might be a good idea to requ…

Edited in a correction, thanks. But also: you can pin to a specific certificate, not just a CA.

> It might be a good idea to require DV certificate issuance to respect DNSSEC -- in this case, the poison nameservers wouldn't be able to sign the responses properly, and .io is DNSSEC enabled.

That seems like a good idea. DNSSEC isn't perfect, but for this purpose it's better than nothing.

(That said, I'd love to know where we stand on getting a better replacement for it.)

> Certificate transparency should help you know what's going on, but only if you're getting notifications through a method that's not compromised (email to your domain may not make it to you).

Definitely a good idea to point domain-related notifications of any kind to an email that doesn't go through that domain.

Re: Taking control of all .io domains with a targeted registration

#53

Post by CydeWeys »

walrus01 wrote: post #13

This is a huge screwup on the part of the people who run the 'root' of .IO, and their entire operation should be severely scrutinized by ICANN. In my opinion almost all of the 'weird' TLDs which are country codes that are actually operated by a third party commercial service are 95% spam and junk registrations. .TV is a good example. Technical screwups aside, the existence of .IO and the fact that it "belongs" to the…

I'm in the TLD space (we run a fair number of gTLDs). If a gTLD operator screwed up like this then there could be consequences. A ccTLD, however, runs with very few restrictions. I don't see much of consequence happening to it as a result of this.

I will, however, say that gTLDs are generally more secure and well-run than smaller ccTLDs, and are worth preferring for that reason. It's a weird historical quirk that .io randomly became popular in the developer community, but there are better options. And, as you point out, it's morally suspect, which is why we don't use it for new domain names.

Re: Taking control of all .io domains with a targeted registration

#54

Post by venning »

panglott wrote: post #49
venning wrote: post #33

Earlier quoted context omitted.

Just so no one is misled: "original inhabitants" does not mean "indigenous peoples" with respect to the BIOT. The islands were not populated prior to late-18th Century European colonization. The depopulation was of post-colonial people.

Why is that an important distinction? Is forcible expulsion and dispropriration more acceptable if the people were brought to the island as slaves and laborers in the mid-1700s?

> an important distinction

That it is a distinction is important to me. Having difficult discussions is made more difficult if we obscure facts or conflate terms.

> more acceptable

I applied no normative judgement.

Re: Taking control of all .io domains with a targeted registration

#55

Post by arglebarnacle »

mrkrab wrote: post #32

>Technical screwups aside, the existence of .IO and the fact that it "belongs" to the UK government is morally questionable, since the entire country code only exists because the British and American militaries forcibly removed the original inhabitants of islands such as Diego Garcia so that they could use the area as naval and air force bases. Since you're getting political there for no reason at all, let me say thi…

Next time summon the courage to express your moral nihilism on your real account.

It almost feels like a mistake to dignify this with the obvious response: might is might, but might is not right. Moral criticism like that of the GP is subject to debate, but not to the blanket claim that injustice as a thing doesn't exist and power is the only reality.

Re: Taking control of all .io domains with a targeted registration

#56

Post by CydeWeys »

andypants wrote: post #48
tedmiston wrote: post #36

Earlier quoted context omitted.

The post states that they were registered, used, then revoked.

Registered by the author. What lwansbrough means is that they weren't already registered, which means it's unlikely this was previously exploited unless the previous registrant let those domains expire afterwards.

The registry (and many other people who have downloaded zone files and such) would have records of these having previously been registered. If it was exploited then it would easily be possible to find that out.

Re: Taking control of all .io domains with a targeted registration

#57

Post by kuschku »

CydeWeys wrote: post #53
walrus01 wrote: post #13

This is a huge screwup on the part of the people who run the 'root' of .IO, and their entire operation should be severely scrutinized by ICANN. In my opinion almost all of the 'weird' TLDs which are country codes that are actually operated by a third party commercial service are 95% spam and junk registrations. .TV is a good example. Technical screwups aside, the existence of .IO and the fact that it "belongs" to the…

I'm in the TLD space (we run a fair number of gTLDs). If a gTLD operator screwed up like this then there could be consequences. A ccTLD, however, runs with very few restrictions. I don't see much of consequence happening to it as a result of this. I will, however, say that gTLDs are generally more secure and well-run than smaller ccTLDs, and are worth preferring for that reason. It's a weird historical quirk that .io…

There are a few ccTLDs that differ from that, though. DENIC and CZNIC are two that are generally very well-run, DENIC even offering better security and safety than many gTLDs (while also being a cooperative, not a commercial NIC, so prices are very low, too)

Re: Taking control of all .io domains with a targeted registration

#58

Post by walrus01 »

CydeWeys wrote: post #53
walrus01 wrote: post #13

This is a huge screwup on the part of the people who run the 'root' of .IO, and their entire operation should be severely scrutinized by ICANN. In my opinion almost all of the 'weird' TLDs which are country codes that are actually operated by a third party commercial service are 95% spam and junk registrations. .TV is a good example. Technical screwups aside, the existence of .IO and the fact that it "belongs" to the…

I'm in the TLD space (we run a fair number of gTLDs). If a gTLD operator screwed up like this then there could be consequences. A ccTLD, however, runs with very few restrictions. I don't see much of consequence happening to it as a result of this. I will, however, say that gTLDs are generally more secure and well-run than smaller ccTLDs, and are worth preferring for that reason. It's a weird historical quirk that .io…

ccTLDs don't appear to be held to very high standards. For example the .AF top level domain (which is controlled by the government's ministry of communications) doesn't even have a working website, www.nic.af

Re: Taking control of all .io domains with a targeted registration

#59

Post by abiox »

ben_jones wrote: post #47
mrkrab wrote: post #32

>Technical screwups aside, the existence of .IO and the fact that it "belongs" to the UK government is morally questionable, since the entire country code only exists because the British and American militaries forcibly removed the original inhabitants of islands such as Diego Garcia so that they could use the area as naval and air force bases. Since you're getting political there for no reason at all, let me say thi…

This comment is in terrible taste but it isn't wrong. We can't just shove our hands in the sand and say it isn't fair so it isn't true.

> it isn't wrong

are you referring to "might is right"? what makes you say that?

Post reply on HN