6 ms·

This is great news! Have you consulted a lawyer? It seems that the Shadowsecurity Foundation did act recklessly. But you'd need to prove monetary damages. Bu

This is great news! Have you consulted a lawyer? It seems that the Shadowsecurity Foundation did act recklessly. But you'd need to prove monetary damages. But perhaps they'd settle to avoid the hassle. Edit: This is an admission of guilt: > He explained in his email that my domain name was sinkholed accidentally as part of their Avalanche operation.

ovi256 7y ago
Yes, sue them, and incentivize a worse, slower (because lawyers involved) and less transparent resolution of errors.
- deleted 7y ago
  [deleted]
susam 7y ago
Thank you for this comment. I have not consulted a lawyer. I have not suffered any monetary loss due to this yet. I use this domain name only to run a small personal blog (the one linked to in this post) and an Exim4 MTA. The fact that the MTA became unreachable via the domain name did mean that some emails sent to it must have bounced back. The primary loss I suffered was in terms of time. In fact, I appreciate the efforts of the Shadowserver Foundation in depriving Avalanche malware families of their command and control infrastructure by sinkholing the domain names generated by the malware domain generation algorithms. I understand false-positives like this can happen. It comes with the territory. It just sucks that the domain name I was using happened to be a false positive. In this case, it ended well because the Shadowserver Foundation (along with Namecheap) acted quickly on my issue and asked NIXI to have the domain transfer undone. Having said that, I do believe that you make a very good point. Actions like this should be taken with a lot more care. What if it were not a personal blog but a small business? Depending on the nature of the business, an inadvertent domain transfer like this could have affected the business seriously. The Shadowsecurity Foundation did say that they are improving their processes. I am not very concerned about this particular foundation when I talk about this. But I am concerned about the systemic issue in the domain name management system that allowed a mistake like this to occur. There could be some type of peer review before a domain transfer like this is executed. I don't think there is a general and popular solution for this problem in the near future. I am hoping that the recent work that is going on in consensus protocols based on cryptography might pave the way to a more decentralized network and more decentralized name management that also become popular and mainstream.
- dorfsmay 7y ago
  The scariest part is that it looks like this got resolved quickly only because your tweet got noticed and retweeted. I wonder how long it would have taken otherwise.
- mirimir 7y ago
  Yes, I get that the Shadowserver Foundation does good work. And that they acted quickly, after being pointed to your tweet. However, if your tweet hadn't gotten traction, and if Namecheap hadn't been proactive, you'd likely have never gotten the domain back. I mean, you had the Namecheap CEO on the case! And for a business losing a domain like that, it'd probably be fatal. I get that many think that Americans are hugely too litigious. But there is the argument that there ought to be compensation for damages. You say that "[t]he primary loss I suffered was in terms of time". But arguably your time is worth something. Such as your customary billing rate, times three. Edit: Or just send them an invoice. At perhaps 50% over your customary billing rate, given that it was a rush job.
  - maroonblazer 7y ago
    >But arguably your time is worth something. Such as your customary billing rate, times three. Wouldn't the legal fees and time spent litigating exceed the winnings?
    - mirimir 7y ago
      Yes, that's a good point. But maybe some attorney might do it pro bono.
      - Godel_unicode 7y ago
        You know, for the exposure.
        roywiggins 7y ago
        Or just on contingency, if it's an open-and-shut case.

ovi256 7y ago

Yes, sue them, and incentivize a worse, slower (because lawyers involved) and less transparent resolution of errors.

deleted 7y ago
[deleted]

susam 7y ago

Thank you for this comment. I have not consulted a lawyer. I have not suffered any monetary loss due to this yet. I use this domain name only to run a small personal blog (the one linked to in this post) and an Exim4 MTA. The fact that the MTA became unreachable via the domain name did mean that some emails sent to it must have bounced back. The primary loss I suffered was in terms of time. In fact, I appreciate the efforts of the Shadowserver Foundation in depriving Avalanche malware families of their command and control infrastructure by sinkholing the domain names generated by the malware domain generation algorithms. I understand false-positives like this can happen. It comes with the territory. It just sucks that the domain name I was using happened to be a false positive. In this case, it ended well because the Shadowserver Foundation (along with Namecheap) acted quickly on my issue and asked NIXI to have the domain transfer undone. Having said that, I do believe that you make a very good point. Actions like this should be taken with a lot more care. What if it were not a personal blog but a small business? Depending on the nature of the business, an inadvertent domain transfer like this could have affected the business seriously. The Shadowsecurity Foundation did say that they are improving their processes. I am not very concerned about this particular foundation when I talk about this. But I am concerned about the systemic issue in the domain name management system that allowed a mistake like this to occur. There could be some type of peer review before a domain transfer like this is executed. I don't think there is a general and popular solution for this problem in the near future. I am hoping that the recent work that is going on in consensus protocols based on cryptography might pave the way to a more decentralized network and more decentralized name management that also become popular and mainstream.

dorfsmay 7y ago
The scariest part is that it looks like this got resolved quickly only because your tweet got noticed and retweeted. I wonder how long it would have taken otherwise.
mirimir 7y ago
Yes, I get that the Shadowserver Foundation does good work. And that they acted quickly, after being pointed to your tweet. However, if your tweet hadn't gotten traction, and if Namecheap hadn't been proactive, you'd likely have never gotten the domain back. I mean, you had the Namecheap CEO on the case! And for a business losing a domain like that, it'd probably be fatal. I get that many think that Americans are hugely too litigious. But there is the argument that there ought to be compensation for damages. You say that "[t]he primary loss I suffered was in terms of time". But arguably your time is worth something. Such as your customary billing rate, times three. Edit: Or just send them an invoice. At perhaps 50% over your customary billing rate, given that it was a rush job.
- maroonblazer 7y ago
  >But arguably your time is worth something. Such as your customary billing rate, times three. Wouldn't the legal fees and time spent litigating exceed the winnings?
  - mirimir 7y ago
    Yes, that's a good point. But maybe some attorney might do it pro bono.
    - Godel_unicode 7y ago
      You know, for the exposure.
      - roywiggins 7y ago
        Or just on contingency, if it's an open-and-shut case.