5 ms·

And this is why you buy the .com domain for your company, instead of some weird one like .info, .io, or .pizza: most people assume that's where they'll find you

And this is why you buy the .com domain for your company, instead of some weird one like .info, .io, or .pizza: most people assume that's where they'll find your company. If someone's squatting it, you can buy it from them, or just come up with a new nonsense word for your company. Maybe developers are getting used to the `getQwerpy.io` convention, but I don't see it catching on more broadly.

antsar 7y ago
Good idea for a company. Tough if you're a FOSS project and the domain costs $xx,xxx (almost any desireable dot-com does).
- vikramkr 7y ago
  Change the name. Especially if you're a security oriented service and not having the dot com opens you up to this sort of, I guess its phishing? .info and all are basically active red flags, especially for a security oriented project...
  - Macha 7y ago
    Honestly the Keepass maintainers have had enough basic issues with website security (see how long they held out on https for update downloads), that I use KeepassXC even on Windows these days. I figure there's enough eyes on the kdbx 4 protocol that it's safe, but the keepassxc team feels better organised.
    - mywittyname 7y ago
      IIRC, the update was over HTTPS, just the "check for new version" call was to HTTP.
      - stordoff 7y ago
        According to https://keepass.info/help/kb/sec_issues.html https://keepass.info/help/kb/sec_issues.html, it doesn't auto-update - it just displays that a new version is available. Enabling a man-in-the-middle to display a fake update notification, when there are fake versions of Keepass floating around and the user could easily slip up (and the MITM could guide the user towards a fake version) still feels like a hole, albeit a minor one. It has however been resolved: > the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS.
- magicalhippo 7y ago
  The domain name provider I use[1] takes $2 less per year for a .com compared to a .info. [1]: https://domainname.shop/register https://domainname.shop/register
  - dmix 7y ago
    That page says €9.95/yr for .com which is $11.17 USD...
    - magicalhippo 7y ago
      $11.95 vs $13.95 for me. Similar in my local currency if I go to their regional page.
  - antsar 7y ago
    For an unregistered .com. Most desirable .com's have been squatted, and the squatters want five to six digits for the domain. The business model deserves a fiery death, yet it thrives.
    - munk-a 7y ago
      So cities recently have been toying with vacancy taxes that target rich people using prime real estate speculatively or who wish to reserve a unit without anyone having lived there for cultural reasons - maybe that's the sort of tactic we need to examine with domains, some sort of creative usage bar that utilizes distinctness from other domains to detect squatting and levy a fee.
      - antsar 7y ago
        At scale, distinguishing a squatter's markov-generated WordPress landing page from a genuine pre-product startup in stealth mode sounds like a Hard Problem. On the other hand someone with 10,000 domains and zero business plans is obviously a squatter. There's probably a way to draw the line that's viable to enforce.

antsar 7y ago

Good idea for a company. Tough if you're a FOSS project and the domain costs $xx,xxx (almost any desireable dot-com does).

vikramkr 7y ago
Change the name. Especially if you're a security oriented service and not having the dot com opens you up to this sort of, I guess its phishing? .info and all are basically active red flags, especially for a security oriented project...
- Macha 7y ago
  Honestly the Keepass maintainers have had enough basic issues with website security (see how long they held out on https for update downloads), that I use KeepassXC even on Windows these days. I figure there's enough eyes on the kdbx 4 protocol that it's safe, but the keepassxc team feels better organised.
  - mywittyname 7y ago
    IIRC, the update was over HTTPS, just the "check for new version" call was to HTTP.
    - stordoff 7y ago
      According to https://keepass.info/help/kb/sec_issues.html https://keepass.info/help/kb/sec_issues.html, it doesn't auto-update - it just displays that a new version is available. Enabling a man-in-the-middle to display a fake update notification, when there are fake versions of Keepass floating around and the user could easily slip up (and the MITM could guide the user towards a fake version) still feels like a hole, albeit a minor one. It has however been resolved: > the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS.
magicalhippo 7y ago
The domain name provider I use[1] takes $2 less per year for a .com compared to a .info. [1]: https://domainname.shop/register https://domainname.shop/register
- dmix 7y ago
  That page says €9.95/yr for .com which is $11.17 USD...
  - magicalhippo 7y ago
    $11.95 vs $13.95 for me. Similar in my local currency if I go to their regional page.
- antsar 7y ago
  For an unregistered .com. Most desirable .com's have been squatted, and the squatters want five to six digits for the domain. The business model deserves a fiery death, yet it thrives.
  - munk-a 7y ago
    So cities recently have been toying with vacancy taxes that target rich people using prime real estate speculatively or who wish to reserve a unit without anyone having lived there for cultural reasons - maybe that's the sort of tactic we need to examine with domains, some sort of creative usage bar that utilizes distinctness from other domains to detect squatting and levy a fee.
    - antsar 7y ago
      At scale, distinguishing a squatter's markov-generated WordPress landing page from a genuine pre-product startup in stealth mode sounds like a Hard Problem. On the other hand someone with 10,000 domains and zero business plans is obviously a squatter. There's probably a way to draw the line that's viable to enforce.