7 ms·

Hi, I am the author of this post. I had posted another link about this story a few days ago when this story was still unfolding.[1][2] This blog post summarize

by susam 7y ago

Hi, I am the author of this post. I had posted another link about this story a few days ago when this story was still unfolding.[1][2] This blog post summarizes the timeline and the events that occurred to resolve the domain transfer issue. Like I have mentioned in this blog post, multiple parties such as Namecheap Support, the Shadowsecurity Foundation, and NIXI helped me in resolving this issue. Thanks to all of them and special thanks to Namecheap CEO, Richard Kirkendall, for looking into this issue on priority as soon as he became aware of it. I wish the domain name management, in particular, and the Internet, in general, had a higher degree or decentralization, so that it were technically impossible for something like this to happen but I think there are many factors at play that are currently preventing from such an Internet to become mainstream at this time. [1]: https://news.ycombinator.com/item?id=21671579 https://news.ycombinator.com/item?id=21671579 [2]: https://twitter.com/susam/status/1200678538254393345 https://twitter.com/susam/status/1200678538254393345

mirimir 7y ago
This is great news! Have you consulted a lawyer? It seems that the Shadowsecurity Foundation did act recklessly. But you'd need to prove monetary damages. But perhaps they'd settle to avoid the hassle. Edit: This is an admission of guilt: > He explained in his email that my domain name was sinkholed accidentally as part of their Avalanche operation.
- ovi256 7y ago
  Yes, sue them, and incentivize a worse, slower (because lawyers involved) and less transparent resolution of errors.
  - deleted 7y ago
    [deleted]
- susam 7y ago
  Thank you for this comment. I have not consulted a lawyer. I have not suffered any monetary loss due to this yet. I use this domain name only to run a small personal blog (the one linked to in this post) and an Exim4 MTA. The fact that the MTA became unreachable via the domain name did mean that some emails sent to it must have bounced back. The primary loss I suffered was in terms of time. In fact, I appreciate the efforts of the Shadowserver Foundation in depriving Avalanche malware families of their command and control infrastructure by sinkholing the domain names generated by the malware domain generation algorithms. I understand false-positives like this can happen. It comes with the territory. It just sucks that the domain name I was using happened to be a false positive. In this case, it ended well because the Shadowserver Foundation (along with Namecheap) acted quickly on my issue and asked NIXI to have the domain transfer undone. Having said that, I do believe that you make a very good point. Actions like this should be taken with a lot more care. What if it were not a personal blog but a small business? Depending on the nature of the business, an inadvertent domain transfer like this could have affected the business seriously. The Shadowsecurity Foundation did say that they are improving their processes. I am not very concerned about this particular foundation when I talk about this. But I am concerned about the systemic issue in the domain name management system that allowed a mistake like this to occur. There could be some type of peer review before a domain transfer like this is executed. I don't think there is a general and popular solution for this problem in the near future. I am hoping that the recent work that is going on in consensus protocols based on cryptography might pave the way to a more decentralized network and more decentralized name management that also become popular and mainstream.
  - dorfsmay 7y ago
    The scariest part is that it looks like this got resolved quickly only because your tweet got noticed and retweeted. I wonder how long it would have taken otherwise.
  - mirimir 7y ago
    Yes, I get that the Shadowserver Foundation does good work. And that they acted quickly, after being pointed to your tweet. However, if your tweet hadn't gotten traction, and if Namecheap hadn't been proactive, you'd likely have never gotten the domain back. I mean, you had the Namecheap CEO on the case! And for a business losing a domain like that, it'd probably be fatal. I get that many think that Americans are hugely too litigious. But there is the argument that there ought to be compensation for damages. You say that "[t]he primary loss I suffered was in terms of time". But arguably your time is worth something. Such as your customary billing rate, times three. Edit: Or just send them an invoice. At perhaps 50% over your customary billing rate, given that it was a rush job.
    - maroonblazer 7y ago
      >But arguably your time is worth something. Such as your customary billing rate, times three. Wouldn't the legal fees and time spent litigating exceed the winnings?
      - mirimir 7y ago
        Yes, that's a good point. But maybe some attorney might do it pro bono.
        Godel_unicode 7y ago
        You know, for the exposure.
        roywiggins 7y ago
        Or just on contingency, if it's an open-and-shut case.
mangodwango 7y ago
This is something that can absolutely be decentralized. Problems aside namecoin shows that it can be done. The entire domain name system needs to be overhauled, central certificate authorities need to be avoided. The internet in general is infrastructure, and protocols that are increasingly controlled by governments and organizations in bed with governments.
- ulrikrasmussen 7y ago
  That also has its downsides though. For starters, it would no longer be possible to take down domains used for controlling botnets.
  - asdfasgasdgasdg 7y ago
    Intelligent botnet authors will switch to the decentralized options once they are widely available and stable. While I think there's limited benefit to decentralization for any use case I care about, I don't think centralization is going to stop this trend in the medium term.
  - Karrot_Kream 7y ago
    The GNU Name System https://gnunet.org/en/use.html https://gnunet.org/en/use.html already has a distributed DNS-like system built out.
    - Aeolun 7y ago
      This does not look like something my grandma would use.
      - Karrot_Kream 7y ago
        I don't think she has to. As long as your ISPs run GNS themselves, and offer you DNS via DHCP, then you can just forego the ISP DNS server and drop in your own local GNS. Mount .com and the other TLDs you want from direct from ISP off their pubkey, and overwrite the TLDs you don't care much for.
sumitjami 7y ago
the server is down it seems https://github.com/susam/susam.in/commit/91405150ff3f44fd094e4e8d7671be12bc574922 https://github.com/susam/susam.in/commit/91405150ff3f44fd094...
- susam 7y ago
  The server is up. However, it is possible that at your end "susam.in" is still resolving to a sinkhole address. I have created a mirror of the blog on GitHub Pages for you. Visit https://susam.github.io/blog/sinkholed/ https://susam.github.io/blog/sinkholed/ to read the mirrored blog post.
drcongo 7y ago
This was a really good write up, thank you. And congratulations on getting your domain back.
Abishek_Muthian 7y ago
My guess is since .in is one of the cheapest (if not THE cheapest) ccTLD the malwares/botnets are exploiting them. I received an email couple of years back from a top domain registrar based in India that the govt. requires actual Registrant contact address and not that of any privacy protection service (to protect from WHOIS); I don't remember whether it was only for .in or for any TLD's registered from India. Anyways I've since then stopped buying .in and sticked with .com. I'm glad OP got his domain back, but I'm quite sure it wouldn't have been simple (or even possible) if he had chosen some registrar based in India (due to their incompetence and general nature to not contend with higher authorities) instead of Namecheap; especially since Namecheap's .in domain costs more than that of any registrar based in India.
metasj 7y ago
Thank you for this. We are definitely seeing the declining use of centralized domain-resolution. It has advantages only when it is not _itself_ being gamed, and increasingly companies and governmental orgs have found ways to do just that. At the very least every domain should have dual central + decentral resolutions, and browsers should give you options when the resolutions conflict.

by susam 7y ago

mirimir 7y ago

This is great news! Have you consulted a lawyer? It seems that the Shadowsecurity Foundation did act recklessly. But you'd need to prove monetary damages. But perhaps they'd settle to avoid the hassle. Edit: This is an admission of guilt: > He explained in his email that my domain name was sinkholed accidentally as part of their Avalanche operation.

ovi256 7y ago
Yes, sue them, and incentivize a worse, slower (because lawyers involved) and less transparent resolution of errors.
- deleted 7y ago
  [deleted]
susam 7y ago
Thank you for this comment. I have not consulted a lawyer. I have not suffered any monetary loss due to this yet. I use this domain name only to run a small personal blog (the one linked to in this post) and an Exim4 MTA. The fact that the MTA became unreachable via the domain name did mean that some emails sent to it must have bounced back. The primary loss I suffered was in terms of time. In fact, I appreciate the efforts of the Shadowserver Foundation in depriving Avalanche malware families of their command and control infrastructure by sinkholing the domain names generated by the malware domain generation algorithms. I understand false-positives like this can happen. It comes with the territory. It just sucks that the domain name I was using happened to be a false positive. In this case, it ended well because the Shadowserver Foundation (along with Namecheap) acted quickly on my issue and asked NIXI to have the domain transfer undone. Having said that, I do believe that you make a very good point. Actions like this should be taken with a lot more care. What if it were not a personal blog but a small business? Depending on the nature of the business, an inadvertent domain transfer like this could have affected the business seriously. The Shadowsecurity Foundation did say that they are improving their processes. I am not very concerned about this particular foundation when I talk about this. But I am concerned about the systemic issue in the domain name management system that allowed a mistake like this to occur. There could be some type of peer review before a domain transfer like this is executed. I don't think there is a general and popular solution for this problem in the near future. I am hoping that the recent work that is going on in consensus protocols based on cryptography might pave the way to a more decentralized network and more decentralized name management that also become popular and mainstream.
- dorfsmay 7y ago
  The scariest part is that it looks like this got resolved quickly only because your tweet got noticed and retweeted. I wonder how long it would have taken otherwise.
- mirimir 7y ago
  Yes, I get that the Shadowserver Foundation does good work. And that they acted quickly, after being pointed to your tweet. However, if your tweet hadn't gotten traction, and if Namecheap hadn't been proactive, you'd likely have never gotten the domain back. I mean, you had the Namecheap CEO on the case! And for a business losing a domain like that, it'd probably be fatal. I get that many think that Americans are hugely too litigious. But there is the argument that there ought to be compensation for damages. You say that "[t]he primary loss I suffered was in terms of time". But arguably your time is worth something. Such as your customary billing rate, times three. Edit: Or just send them an invoice. At perhaps 50% over your customary billing rate, given that it was a rush job.
  - maroonblazer 7y ago
    >But arguably your time is worth something. Such as your customary billing rate, times three. Wouldn't the legal fees and time spent litigating exceed the winnings?
    - mirimir 7y ago
      Yes, that's a good point. But maybe some attorney might do it pro bono.
      - Godel_unicode 7y ago
        You know, for the exposure.
        roywiggins 7y ago
        Or just on contingency, if it's an open-and-shut case.

mangodwango 7y ago

This is something that can absolutely be decentralized. Problems aside namecoin shows that it can be done. The entire domain name system needs to be overhauled, central certificate authorities need to be avoided. The internet in general is infrastructure, and protocols that are increasingly controlled by governments and organizations in bed with governments.

ulrikrasmussen 7y ago
That also has its downsides though. For starters, it would no longer be possible to take down domains used for controlling botnets.
- asdfasgasdgasdg 7y ago
  Intelligent botnet authors will switch to the decentralized options once they are widely available and stable. While I think there's limited benefit to decentralization for any use case I care about, I don't think centralization is going to stop this trend in the medium term.
- Karrot_Kream 7y ago
  The GNU Name System https://gnunet.org/en/use.html https://gnunet.org/en/use.html already has a distributed DNS-like system built out.
  - Aeolun 7y ago
    This does not look like something my grandma would use.
    - Karrot_Kream 7y ago
      I don't think she has to. As long as your ISPs run GNS themselves, and offer you DNS via DHCP, then you can just forego the ISP DNS server and drop in your own local GNS. Mount .com and the other TLDs you want from direct from ISP off their pubkey, and overwrite the TLDs you don't care much for.

sumitjami 7y ago

the server is down it seems https://github.com/susam/susam.in/commit/91405150ff3f44fd094e4e8d7671be12bc574922 https://github.com/susam/susam.in/commit/91405150ff3f44fd094...

susam 7y ago
The server is up. However, it is possible that at your end "susam.in" is still resolving to a sinkhole address. I have created a mirror of the blog on GitHub Pages for you. Visit https://susam.github.io/blog/sinkholed/ https://susam.github.io/blog/sinkholed/ to read the mirrored blog post.

drcongo 7y ago

This was a really good write up, thank you. And congratulations on getting your domain back.

Abishek_Muthian 7y ago

My guess is since .in is one of the cheapest (if not THE cheapest) ccTLD the malwares/botnets are exploiting them. I received an email couple of years back from a top domain registrar based in India that the govt. requires actual Registrant contact address and not that of any privacy protection service (to protect from WHOIS); I don't remember whether it was only for .in or for any TLD's registered from India. Anyways I've since then stopped buying .in and sticked with .com. I'm glad OP got his domain back, but I'm quite sure it wouldn't have been simple (or even possible) if he had chosen some registrar based in India (due to their incompetence and general nature to not contend with higher authorities) instead of Namecheap; especially since Namecheap's .in domain costs more than that of any registrar based in India.

metasj 7y ago

Thank you for this. We are definitely seeing the declining use of centralized domain-resolution. It has advantages only when it is not _itself_ being gamed, and increasingly companies and governmental orgs have found ways to do just that. At the very least every domain should have dual central + decentral resolutions, and browsers should give you options when the resolutions conflict.