Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

twitter.com

Post reply on HN
Print view View original

91–99 of 99 posts

Re: Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

#91

Post by toast0 »

SahAssar wrote: post #82
toast0 wrote: post #60

Earlier quoted context omitted.

Namecheap's primary business is as a domain registrar. Sensible customers don't let their domain registrar act as their authoritative DNS, you'd need to change something else; but maybe mild defacement of the contact name or address in whois would qualify, without being harmful.

> Sensible customers don't let their domain registrar act as their authoritative DNS Are you saying that based on quality of the service or something else?

You want to be able to switch registrars whenever it's convenient. But if your registrar is also your authoritative DNS and your webhosting, it makes it inconvenient to switch registrars.

Re: Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

#92

Post by SahAssar »

toast0 wrote: post #91
SahAssar wrote: post #82

Earlier quoted context omitted.

> Sensible customers don't let their domain registrar act as their authoritative DNS Are you saying that based on quality of the service or something else?

You want to be able to switch registrars whenever it's convenient. But if your registrar is also your authoritative DNS and your webhosting, it makes it inconvenient to switch registrars.

Switching DNS is not harder than switching registrars, and keeping them in the same place is reasonable if that provider offers good service for both or you want to avoid the additional complexity of an additional vendor.

I thought your original comment made it sound like there was some obvious reason for keeping DNS and registrars separate.

Re: Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

#93

Post by ebfe1 »

NamecheapCEO wrote: post #51
gkoberger wrote: post #45

How else is the CEO supposed to respond? He's in the tough position where he can't prove a negative; the burden of proof is on the original tweeter. So the CEO needs the "hacker" to either prove it or admit they were mistaken, and bug bounties are exactly how companies do this. (Also, I feel like it's implied that "an account that isn't yours" doesn't mean "mess with any of our customers you want." He's clarifying th…

Thanks for your comment and you are correct with your latter point and assumption. It's hard to word things properly when you're limited with the amount of allowed characters on twitter.

love the bounty proposal but may I suggest creating a bounty target specifically for this and share it with everyone so whitehat folks can have a crack at it without raising concerns about hacking customers accounts? :)

Re: Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

#94

Post by toast0 »

SahAssar wrote: post #92
toast0 wrote: post #91

Earlier quoted context omitted.

You want to be able to switch registrars whenever it's convenient. But if your registrar is also your authoritative DNS and your webhosting, it makes it inconvenient to switch registrars.

Switching DNS is not harder than switching registrars, and keeping them in the same place is reasonable if that provider offers good service for both or you want to avoid the additional complexity of an additional vendor. I thought your original comment made it sound like there was some obvious reason for keeping DNS and registrars separate.

Switching DNS is harder than switching registrars, because there's more records, and you have to transfer them, and you ideally want the old service to send NS records pointing to the new service, and the old service should be cancelled only after sufficient DNS traffic has moved to the new service. For a seamless transition, you need a period of time with both services active, but some registrars with included nameservice will cancel your nameservice immediately when a domain is transfered to a new registrar; and you likely can't start service at the new registrar in advance either. Recursive resolvers do cache and use glue records, and 2 day TTLs are common at TLDs.

On the other hand, a registrar transfer is usually simple and quick and has no user visible changes. Unlock the domain, get a transfer code, do any confirmation stuff, make sure the glue records didn't change, you're done.

Re: Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

#95

Post by SahAssar »

toast0 wrote: post #94
SahAssar wrote: post #92

Earlier quoted context omitted.

Switching DNS is not harder than switching registrars, and keeping them in the same place is reasonable if that provider offers good service for both or you want to avoid the additional complexity of an additional vendor. I thought your original comment made it sound like there was some obvious reason for keeping DNS and registrars separate.

Switching DNS is harder than switching registrars, because there's more records, and you have to transfer them, and you ideally want the old service to send NS records pointing to the new service, and the old service should be cancelled only after sufficient DNS traffic has moved to the new service. For a seamless transition, you need a period of time with both services active, but some registrars with included names…

All of those arguments are arguments to use a good DNS provider, not specifically to not put the domain and the DNS on the same provider. I've seen DNS providers remove the namespace the instant they see the domain pointing somewhere else too.

Re: Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

#96

Post by aaaaaaaaata »

eric__cartman wrote: post #72
NamecheapCEO wrote: post #51

Earlier quoted context omitted.

Thanks for your comment and you are correct with your latter point and assumption. It's hard to word things properly when you're limited with the amount of allowed characters on twitter.

kek I thought this was a troll account until I saw your post history. I like your straight forward approach to username creation.

Approach to additional username creation, most likely!

Re: Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

#97

Post by kingofkyiv »

smt88 wrote: post #36
sva_ wrote: post #34

Earlier quoted context omitted.

> kingofkyiv.com > buyagf.com What the hell am I looking at?

My best guess for the second one is "human trafficking".

Absolutely not. The women are willing and come to me to help them leave Ukraine and move elsewhere. I screen my clients with background checks and proof of income.

Mail order bride is more appropriate.

Re: Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

#98

Post by utucuro »

toast0 wrote: post #94
SahAssar wrote: post #92

Earlier quoted context omitted.

Switching DNS is not harder than switching registrars, and keeping them in the same place is reasonable if that provider offers good service for both or you want to avoid the additional complexity of an additional vendor. I thought your original comment made it sound like there was some obvious reason for keeping DNS and registrars separate.

Switching DNS is harder than switching registrars, because there's more records, and you have to transfer them, and you ideally want the old service to send NS records pointing to the new service, and the old service should be cancelled only after sufficient DNS traffic has moved to the new service. For a seamless transition, you need a period of time with both services active, but some registrars with included names…

Having said all that, do you have a recommendation?

Re: Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

#99

Post by toast0 »

utucuro wrote: post #98
toast0 wrote: post #94

Earlier quoted context omitted.

Switching DNS is harder than switching registrars, because there's more records, and you have to transfer them, and you ideally want the old service to send NS records pointing to the new service, and the old service should be cancelled only after sufficient DNS traffic has moved to the new service. For a seamless transition, you need a period of time with both services active, but some registrars with included names…

Having said all that, do you have a recommendation?

I recommend that you not host DNS with your registrar. And if possible, that you not host DNS with your hosting provider (although, that can be more difficult).

If you have a high value domain, you might want to look for a corporate registrar, like MarkMonitor or CSC, or anyone else who can do Registry locks (which are very different than registrar locks and are rather inconvenient, but potentially very useful); but know it's going to be expensive. I also had a good corporate experience with register.eu, they've got a lot of ability to satisfy foreign presence needs for restricted TLDs, if that's something you need/want. If it's a low value domain (like my personal domains), I don't have strong feelings, except for the love of whatever you hold dear, don't use Network Solutions; they were a fine choice when they were the only choice, but ever since we had options, they should have been used. A lot of registrars are really pushy with upsells and what not, so I've tried to go with no fuss registrars over the years.

In terms of DNS services, I don't have any particular recommendations; I personally run my primary DNS on my hosted machine and secondary with Hurricane Electric, which is free for my usage. There are (or were) several free secondary DNS services out there, but the one I used to use stopped maintaining their website (TLS 1.0 only, certificate issued 2014, expired 2015) and I already had an account with HE's tunnel broker, so it seemed like a reasonable choice. I still have a domain I host for a friend that uses that old service, because I can't get my friend to update the glue records at her registrar; the service still works enough, I guess.

Post reply on HN