5 ms·

Good idea for a company. Tough if you're a FOSS project and the domain costs $xx,xxx (almost any desireable dot-com does).

by antsar 7y ago

vikramkr 7y ago
Change the name. Especially if you're a security oriented service and not having the dot com opens you up to this sort of, I guess its phishing? .info and all are basically active red flags, especially for a security oriented project...
- Macha 7y ago
  Honestly the Keepass maintainers have had enough basic issues with website security (see how long they held out on https for update downloads), that I use KeepassXC even on Windows these days. I figure there's enough eyes on the kdbx 4 protocol that it's safe, but the keepassxc team feels better organised.
  - mywittyname 7y ago
    IIRC, the update was over HTTPS, just the "check for new version" call was to HTTP.
    - stordoff 7y ago
      According to https://keepass.info/help/kb/sec_issues.html https://keepass.info/help/kb/sec_issues.html, it doesn't auto-update - it just displays that a new version is available. Enabling a man-in-the-middle to display a fake update notification, when there are fake versions of Keepass floating around and the user could easily slip up (and the MITM could guide the user towards a fake version) still feels like a hole, albeit a minor one. It has however been resolved: > the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS.
magicalhippo 7y ago
The domain name provider I use[1] takes $2 less per year for a .com compared to a .info. [1]: https://domainname.shop/register https://domainname.shop/register
- dmix 7y ago
  That page says €9.95/yr for .com which is $11.17 USD...
  - magicalhippo 7y ago
    $11.95 vs $13.95 for me. Similar in my local currency if I go to their regional page.
- antsar 7y ago
  For an unregistered .com. Most desirable .com's have been squatted, and the squatters want five to six digits for the domain. The business model deserves a fiery death, yet it thrives.
  - munk-a 7y ago
    So cities recently have been toying with vacancy taxes that target rich people using prime real estate speculatively or who wish to reserve a unit without anyone having lived there for cultural reasons - maybe that's the sort of tactic we need to examine with domains, some sort of creative usage bar that utilizes distinctness from other domains to detect squatting and levy a fee.
    - antsar 7y ago
      At scale, distinguishing a squatter's markov-generated WordPress landing page from a genuine pre-product startup in stealth mode sounds like a Hard Problem. On the other hand someone with 10,000 domains and zero business plans is obviously a squatter. There's probably a way to draw the line that's viable to enforce.

Good idea for a company. Tough if you're a FOSS project and the domain costs $xx,xxx (almost any desireable dot-com does).

by antsar 7y ago

Good idea for a company. Tough if you're a FOSS project and the domain costs $xx,xxx (almost any desireable dot-com does).

vikramkr 7y ago

Change the name. Especially if you're a security oriented service and not having the dot com opens you up to this sort of, I guess its phishing? .info and all are basically active red flags, especially for a security oriented project...

Macha 7y ago
Honestly the Keepass maintainers have had enough basic issues with website security (see how long they held out on https for update downloads), that I use KeepassXC even on Windows these days. I figure there's enough eyes on the kdbx 4 protocol that it's safe, but the keepassxc team feels better organised.
- mywittyname 7y ago
  IIRC, the update was over HTTPS, just the "check for new version" call was to HTTP.
  - stordoff 7y ago
    According to https://keepass.info/help/kb/sec_issues.html https://keepass.info/help/kb/sec_issues.html, it doesn't auto-update - it just displays that a new version is available. Enabling a man-in-the-middle to display a fake update notification, when there are fake versions of Keepass floating around and the user could easily slip up (and the MITM could guide the user towards a fake version) still feels like a hole, albeit a minor one. It has however been resolved: > the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS.

magicalhippo 7y ago

The domain name provider I use[1] takes $2 less per year for a .com compared to a .info. [1]: https://domainname.shop/register https://domainname.shop/register

dmix 7y ago
That page says €9.95/yr for .com which is $11.17 USD...
- magicalhippo 7y ago
  $11.95 vs $13.95 for me. Similar in my local currency if I go to their regional page.
antsar 7y ago
For an unregistered .com. Most desirable .com's have been squatted, and the squatters want five to six digits for the domain. The business model deserves a fiery death, yet it thrives.
- munk-a 7y ago
  So cities recently have been toying with vacancy taxes that target rich people using prime real estate speculatively or who wish to reserve a unit without anyone having lived there for cultural reasons - maybe that's the sort of tactic we need to examine with domains, some sort of creative usage bar that utilizes distinctness from other domains to detect squatting and levy a fee.
  - antsar 7y ago
    At scale, distinguishing a squatter's markov-generated WordPress landing page from a genuine pre-product startup in stealth mode sounds like a Hard Problem. On the other hand someone with 10,000 domains and zero business plans is obviously a squatter. There's probably a way to draw the line that's viable to enforce.