5 ms·

There are some compelling use cases for .brand TLDs, especially when a given brand is a large company that has lots of different websites. Take Barclays for ex

There are some compelling use cases for .brand TLDs, especially when a given brand is a large company that has lots of different websites. Take Barclays for example. They're a bank, so they're obviously especially sensitive to security issues, and they run a bunch of different websites. Just using websites of the form barclaysfoo.co.uk is obviously unsafe, because it's rife with phishing opportunities since you're training customers to accept these kinds of domains and then some phisher goes out and registers barclaysblah.co.uk and users don't think twice about entering their credentials there. Subdomains off barclays.co.uk are also not great, because cookies can be shared up to the domain level (intentionally or accidentally), and you don't want any risk of your potentially less secure marketing websites being compromised through CRSF or something and leaking access to sensitive login cookies on the actual bank's website. So the best solution here really is to get and use the .barclays TLD. That way, there's no possible cookie/session-sharing security exploits since every website is truly a different domain, and only Barclays itself can register .barclays domains so customers can have trust when they see a .barclays domain that it is actually the bank they're dealing with. Additionally, there's fun security things you can do at the TLD level, like globally applying HSTS preloading, that Barclays isn't doing (but should be) and that we are. And as for open TLDs, the existing generic namespaces like .com are heavily mined out and it's very expensive to acquire a decent domain name in them. So having all these other alternatives available now makes it much easier to get a decent domain for a reasonable cost, which is good for users (and bad for domainers, who I have no sympathy for). For example, I managed to pick up cyde.dev at the base registration cost, which I'll be putting some real content on at some point in the future. I think that's a pretty darn good, short, domain-specific domain name, and much better than anything I could've gotten on .com. cyde.com, by contrast, was registered way back in 2002, 4 years before I ended up going with my second choice of cydeweys.com. But I like cyde.dev better, so I'll be migrating stuff over to it. Full disclosure, I run .dev (but not .barclays!).

deleted 7y ago
[deleted]
hobs 7y ago
I'd agree with this except that they are not selling those TLDs for 10 bucks or 12 bucks - if they like the dictionary word for it or its short enough the .dev tld will charge you 720 dollars per year flat even though there's no pressure on the demand of a million different tlds. Just checked google for a word earlier this morning that was free and balked at how stupid this TLD land grab is, unless you own or manage one.
- gist 7y ago
  Stupid? Why is it 'stupid'? Because to you it's of no interest or need or the cost is more than you would like to spend? So therefore it's 'stupid'?
  - anoncake 7y ago
    Because this is pure rent-seeking.
- CydeWeys 7y ago
  If that domain didn't cost that much it's not like you'd be able to buy it for $12 now anyway. Instead, some domainer would've bought it milliseconds after launch, along with thousands of other speculative domains, and you'd be looking at a parking page right now with a listed sale price of 4-5 figures. Domainers play a VC-style game; one sale needs to cover the cost of lots of losers, and there are lots of big players out there with deep pockets and specific needs, so prices are high. Economically speaking, an auction is the best way to fairly and efficiently allocate scarce resources.
  - hobs 7y ago
    It's not scarce though, its completely artificial scarcity. Just because an auction means that people cant buy up every domain doesnt help anyone at the end of the system - it just ensures that domain name registrars capture the "value" instead of the scammers, the end user still gets a shitty deal. So yeah, its stupid, and the system has only been fixed enough to keep getting itself paid.
anoncake 7y ago
> Just using websites of the form barclaysfoo.co.uk is obviously unsafe, because it's rife with phishing opportunities since you're training customers to accept these kinds of domains and then some phisher goes out and registers barclaysblah.co.uk and users don't think twice about entering their credentials there. This is a case for a better structured web, not for giving up meaningful hierarchies altogether. It shouldn't be possible to register a .co.uk domain unless you are a company that is registered in the UK and can be sued. Ideally companies also shouldn't be allowed to use TLD not designated for them so barclays.awesome etc. is suspicious. A namespace like .bank.uk would be even more secure. > Subdomains off barclays.co.uk are also not great, because cookies can be shared up to the domain level (intentionally or accidentally), There is no reason we can't treat barclays.co.uk like a top level domain for some purposes, using a mechanism like the public suffix list. > But I like cyde.dev better, so I'll be migrating stuff over to it. So the new TLDs encourage people to migrate, thus changing URLs and frequently breaking them by not bothering with redirects.
- CydeWeys 7y ago
  I'm not following this argument, because the kind of reorganization you're asking for here is impossible, whereas simply creating new TLDs is relatively easily and has thus actually occurred. There are how many millions of already-existing .co.uk sites that aren't companies registered in the UK, so how is your suggestion even possible? This horse has long left the barn.
  - anoncake 7y ago
    Creating .bank.uk is not impossible. Nor is cleaning up .co.uk -- it would be painful, of course, but sometimes you have to rip off the band-aid.
    - CydeWeys 7y ago
      You are proposing linkrot on an unimaginable scale. You're talking about breaking the Web, on purpose. It will never happen, and for damn good reasons. This horse left the barn several decades ago.
Angostura 7y ago
Sounds to me as if the best solution would be a well run .bank tld.
- CydeWeys 7y ago
  So, what, barclaysfoo.bank, barclaysbar.bank, etc.? It's still clunky, and is still training users to accept an even more insecure naming pattern (because now they need to look for the barclays prefix and the .bank TLD; if either of those is off, it could be an attacker's site). Plus, is Barclays supposed to secure some assurance from the TLD operator that the prefix "barclays" is theirs alone, and that no other such domains will be created for other entities? That sure sounds like a namespace of its own at this point, except without the syntax making that obvious. Never mind that Barclays provides more services than just banking, so a lot of their existing websites aren't suitable for .bank, and now you're gonna have their Web presence scattered to the winds across various TLDs.
labawi 7y ago
> There are some compelling use cases .. It's interesting how you count organizational complexity, incompetence and (minor) technological shortcomings as a reason to create a whole new TLD. It's convenient for the brand, but not a good reason to pollute the global namespace, especially as it sets the expectation that every organization worth something should have one. > the existing generic namespaces like .com are heavily mined out True, and the proper solution is to clear some up. The name authorities need some shaking up. Squatting should be made illegal/against terms and actually prosecuted/applied. Registering domains by 100s or even 100'000s you should not get discounts - you should get unaffordable price hikes. On ccTLDs maybe people could get a few free domains and then have to pay for everything extra?
- CydeWeys 7y ago
  > but not a good reason to pollute the global namespace What does that even mean though? In what way is the global namespace being "polluted"? Adding more TLDs doesn't affect the existing ones. It's not adding scale problems that DNS can't handle. This seems to be a subjective concern; some people don't like that there are more valid TLDs now than there used to be. That's not pollution though. > Squatting should be made illegal/against terms and actually prosecuted/applied. Be very careful about asking for increased enforcement. It's a great way for the authorities to abuse their newfound power. Most people involved in this field do not remotely want more of this. Also, domains are gonna have to cost $100s/year to fund all of this increased enforcement. How do you even define squatting? How do you prosecute it? This isn't remotely workable. > Registering domains by 100s or even 100'000s you should not get discounts - you should get unaffordable price hikes. How? TLD registries typically no longer even know the identity of the registrants. This would leave enforcement up to the registrars. How does a registrar solve the problem of people using multiple accounts to register domains? How do you solve the global problem that there are thousands of accredited registrars, and that people could register domains through many different ones? Without massive centralization, this is not a remotely workable solution, and massive centralization would be a "cure" much worse than the disease. > On ccTLDs maybe people could get a few free domains Free, or even low cost, domains are guaranteed to lead to abuse. Also, how do you individually allocate free domains to people?

deleted 7y ago

[deleted]

hobs 7y ago

I'd agree with this except that they are not selling those TLDs for 10 bucks or 12 bucks - if they like the dictionary word for it or its short enough the .dev tld will charge you 720 dollars per year flat even though there's no pressure on the demand of a million different tlds. Just checked google for a word earlier this morning that was free and balked at how stupid this TLD land grab is, unless you own or manage one.

gist 7y ago
Stupid? Why is it 'stupid'? Because to you it's of no interest or need or the cost is more than you would like to spend? So therefore it's 'stupid'?
- anoncake 7y ago
  Because this is pure rent-seeking.
CydeWeys 7y ago
If that domain didn't cost that much it's not like you'd be able to buy it for $12 now anyway. Instead, some domainer would've bought it milliseconds after launch, along with thousands of other speculative domains, and you'd be looking at a parking page right now with a listed sale price of 4-5 figures. Domainers play a VC-style game; one sale needs to cover the cost of lots of losers, and there are lots of big players out there with deep pockets and specific needs, so prices are high. Economically speaking, an auction is the best way to fairly and efficiently allocate scarce resources.
- hobs 7y ago
  It's not scarce though, its completely artificial scarcity. Just because an auction means that people cant buy up every domain doesnt help anyone at the end of the system - it just ensures that domain name registrars capture the "value" instead of the scammers, the end user still gets a shitty deal. So yeah, its stupid, and the system has only been fixed enough to keep getting itself paid.

anoncake 7y ago

> Just using websites of the form barclaysfoo.co.uk is obviously unsafe, because it's rife with phishing opportunities since you're training customers to accept these kinds of domains and then some phisher goes out and registers barclaysblah.co.uk and users don't think twice about entering their credentials there. This is a case for a better structured web, not for giving up meaningful hierarchies altogether. It shouldn't be possible to register a .co.uk domain unless you are a company that is registered in the UK and can be sued. Ideally companies also shouldn't be allowed to use TLD not designated for them so barclays.awesome etc. is suspicious. A namespace like .bank.uk would be even more secure. > Subdomains off barclays.co.uk are also not great, because cookies can be shared up to the domain level (intentionally or accidentally), There is no reason we can't treat barclays.co.uk like a top level domain for some purposes, using a mechanism like the public suffix list. > But I like cyde.dev better, so I'll be migrating stuff over to it. So the new TLDs encourage people to migrate, thus changing URLs and frequently breaking them by not bothering with redirects.

CydeWeys 7y ago
I'm not following this argument, because the kind of reorganization you're asking for here is impossible, whereas simply creating new TLDs is relatively easily and has thus actually occurred. There are how many millions of already-existing .co.uk sites that aren't companies registered in the UK, so how is your suggestion even possible? This horse has long left the barn.
- anoncake 7y ago
  Creating .bank.uk is not impossible. Nor is cleaning up .co.uk -- it would be painful, of course, but sometimes you have to rip off the band-aid.
  - CydeWeys 7y ago
    You are proposing linkrot on an unimaginable scale. You're talking about breaking the Web, on purpose. It will never happen, and for damn good reasons. This horse left the barn several decades ago.

Angostura 7y ago

Sounds to me as if the best solution would be a well run .bank tld.

CydeWeys 7y ago
So, what, barclaysfoo.bank, barclaysbar.bank, etc.? It's still clunky, and is still training users to accept an even more insecure naming pattern (because now they need to look for the barclays prefix and the .bank TLD; if either of those is off, it could be an attacker's site). Plus, is Barclays supposed to secure some assurance from the TLD operator that the prefix "barclays" is theirs alone, and that no other such domains will be created for other entities? That sure sounds like a namespace of its own at this point, except without the syntax making that obvious. Never mind that Barclays provides more services than just banking, so a lot of their existing websites aren't suitable for .bank, and now you're gonna have their Web presence scattered to the winds across various TLDs.

labawi 7y ago

> There are some compelling use cases .. It's interesting how you count organizational complexity, incompetence and (minor) technological shortcomings as a reason to create a whole new TLD. It's convenient for the brand, but not a good reason to pollute the global namespace, especially as it sets the expectation that every organization worth something should have one. > the existing generic namespaces like .com are heavily mined out True, and the proper solution is to clear some up. The name authorities need some shaking up. Squatting should be made illegal/against terms and actually prosecuted/applied. Registering domains by 100s or even 100'000s you should not get discounts - you should get unaffordable price hikes. On ccTLDs maybe people could get a few free domains and then have to pay for everything extra?

CydeWeys 7y ago
> but not a good reason to pollute the global namespace What does that even mean though? In what way is the global namespace being "polluted"? Adding more TLDs doesn't affect the existing ones. It's not adding scale problems that DNS can't handle. This seems to be a subjective concern; some people don't like that there are more valid TLDs now than there used to be. That's not pollution though. > Squatting should be made illegal/against terms and actually prosecuted/applied. Be very careful about asking for increased enforcement. It's a great way for the authorities to abuse their newfound power. Most people involved in this field do not remotely want more of this. Also, domains are gonna have to cost $100s/year to fund all of this increased enforcement. How do you even define squatting? How do you prosecute it? This isn't remotely workable. > Registering domains by 100s or even 100'000s you should not get discounts - you should get unaffordable price hikes. How? TLD registries typically no longer even know the identity of the registrants. This would leave enforcement up to the registrars. How does a registrar solve the problem of people using multiple accounts to register domains? How do you solve the global problem that there are thousands of accredited registrars, and that people could register domains through many different ones? Without massive centralization, this is not a remotely workable solution, and massive centralization would be a "cure" much worse than the disease. > On ccTLDs maybe people could get a few free domains Free, or even low cost, domains are guaranteed to lead to abuse. Also, how do you individually allocate free domains to people?