8 ms·

The end of the article the owner talks about why he doesn't just give the domain name to Microsoft for the good of security, and he has imo a good reason - Micr

The end of the article the owner talks about why he doesn't just give the domain name to Microsoft for the good of security, and he has imo a good reason - Microsoft fucked up and should shoulder the responsibility. Even more incredibly is it seems some requests were coming from Microsoft owned machines. He talks about how massive fortune 500 companies may be aware of the issue but unwilling to do anything about it. So it seems, as ALWAYS, we're going to have to wait for state sponsored actors to buy the things, embarrass the shit out of a couple CEOs by posting their dick pics they're inexplicably sending over company mail, and THEN corps will start doing something about it. Why we have to get on and off this merry go round every time is beyond me. Short-sightedness of those with decision making power boggles my mind daily.

beamatronic 7y ago
Pain is required in order for people to make change.
mirimir 7y ago
Indeed, one could argue that Microsoft has been encouraging its customers to effectively spoof the domain. So it's totally obvious that it ought to buy it. Still, this is the funniest thing that I've seen in months.
- deleted 7y ago
  [deleted]
bsder 7y ago
> Why we have to get on and off this merry go round every time is beyond me. Short-sightedness of those with decision making power boggles my mind daily. Because someone will have to cut a 7 digit check. And nobody is going to volunteer their budget for that. Until the bigwigs gets pantsed and command someone to cut the check, it simply won't happen.
ajross 7y ago
A more cynical interpretation is that he almost certainly tried to sell this to MS privately, and they didn't bite at the price he was asking. The public offering at $1.7M is likely an attempt to force their hand. Frankly that doesn't sound to expensive given the context, it's probably less than Microsoft's existing bug bounty budget anyway. I don't know why they couldn't work this out, or why they never bothered to try to address the issue over the multiple decades this guy has been keeping this domain out of dangerous hands. Just write the check, Satya.
- harikb 7y ago
  With a large organization like Microsoft, people who understand this don’t have the power to make this happen. And people who the power will WTF this for 6 months. By the time they make the decision, it will be too late. I doubt Satya will read this. It took me half hour to understand what is going on. Imagine an MS executive
  - mirimir 7y ago
    Sure. But Microsoft has known about his domain, and this issue, since 1997, if not earlier. So they've had over 20 years to think about it.
    - toyg 7y ago
      They’ve just changed default settings to neuter the issue, and hoped the problem with established networks would eventually go away on its own as people upgraded. In fact, I bet that domain was much more valuable in 2005 than it is now.
      - mirimir 7y ago
        Perhaps. But TFA reports a recent test that was frightening enough.
  - deleted 7y ago
    [deleted]
tetha 7y ago
As cynical as I may sound, but cybersecurity threats like this will continue to be ignored until they sufficiently escalate into consequences. And that statement, while obvious, is darker than it seems. Companies going under aren't sufficient consequences (many ransomware cases). Universities going offline isn't enough (look for the uni giessen). The bureaucracy of cities going offline isn't enough (e.g. New Orleans). This is just going to continue to escalate until something really really ugly happens and kills many people. And then we'll be presented with some grand legislation that I don't look forward to.
- deleted 7y ago
  [deleted]
- K0SM0S 7y ago
  Let me share this thought experiment. - most companies are really bad at security - most people do not care about the security of their data, passwords, etc. Based on these facts, I've been operating for a decade now under the assumption that one day within my lifetime, all of our logged online activity may become public after some hack. All of it that's logged somewhere. Chats, pics, posts, history, notes, cloud drives... It may be slightly paranoid, but better safe than sorry. I should add that I live "normally", I don't care about my pics or discussions becoming public when it happens to everyone else too. I just remain cognizant that there's high probability here. As outlandish as this assumption might be, the opposite (that security holds and most of our stuff never gets hacked) seems even more implausible to me. Educated guess, you know, which speaks less of tech/security than it does of human nature (carelessness or laziness, until a real crash happens). Hopefully this is very Western-centric and other cultures are better at long-term wisdom and planning.
  - solotronics 7y ago
    I think this is actually by design. My theory is they built a panopticon intended to move humanity towards being more cooperative and docile. A feature of this is that people become self policing much like in the USSR. You yourself just admitted to what is equivalent to thought policing.
gist 7y ago
> The end of the article the owner talks about why he doesn't just give the domain name to Microsoft for the good of security I can't even take that type of statement (in the article) with a straight face. You have an ordinary person presumably of typical wealth let's say average and he should just give something away for free 'for the good of security'.
- labawi 7y ago
  Maybe he should ask for reimbursement on registration fees and a token manipulation fee? He registered a bunch of short domains, probably with the intent on profiteering and AFAICT he sold off some of them. By what logic or morals is he entitled to profit?
  - gist 7y ago
    Where are you from where do you live? Does not work that way in a capitalistic system in the US. He has the domain and it's lawfully his to decide what to do with it. It's not owned by the public. He's not wrong for selling it for a profit anymore than someone selling their house or car will try to maximize in any legal way they can the amount they can get.
    - labawi 7y ago
      I consider ethics, morals and decency to be a higher authority than law - and I believe many other people do as well. AFAIK DNS was made to serve society, not domain speculators. IMO, domain squatters holding 90%¹ of good domains would be better served with a public whipping rather than monetary reward. Legal and practical status quo is another matter. If I go to <lastname>.com, it says for sale and probably has been since registration. What is the benefit? Would it not be better if those domains were used for a genuine purpose? I wouldn't really mind if someone else was using it. I'm in EU. I had trouble finding exact definition of speculative registration referenced in Terms and Conditions[2]: ".. complaint .. on the basis of speculative or abusive registration, as referred to in Articles 21 and 22(1)(a) of the Public Policy Rules", but here is an excerpt from eurid FAQ [3]: If you want to dispute a domain name (under .eu, ..) registration and you believe that: - you .. hold a trademark, .., family name, etc); and - the current holder has registered or uses the domain name for speculative or abusive purposes, you can challenge its registration via .. (ADR) procedure or in a regular court. AFAICT, domain speculation / squatting are explicitly forbidden, though probably sparsely enforced. I believe I have seen similar wording for applicable ccTLDs, and would not be too surprised to see something similar for .com, .org etc. ¹ Number made up. [2] https://eurid.eu/media/filer_public/f5/d2/f5d22bc1-9d62-4ba9-a81e-1a0292ef215f/terms_and_conditions_en.pdf https://eurid.eu/media/filer_public/f5/d2/f5d22bc1-9d62-4ba9... [3] https://eurid.eu/en/register-a-eu-domain/domain-name-disputes/ https://eurid.eu/en/register-a-eu-domain/domain-name-dispute...
Taek 7y ago
Is just invalidating the domain an problem? DNS exists to serve as a useful tool to society. If a particular domain becomes a public liability, just shut it down. If there's credible reason to believe Microsoft is responsible for the liability, take them to court over it, but don't keep innocents at risk for the sake of trying to get Microsoft to own up to a mistake.
- bscphil 7y ago
  Regardless of whether that's legally possible, saying Microsoft deserves to "pay" for their mistake does not imply that this guy is owed millions of dollars for sitting on this domain for decades. That's silly regardless of what MS did or didn't do.
  - daveFNbuck 7y ago
    He owns the domain, and it's worth millions of dollars because of Microsoft's mistake. He may not deserve to own something so valuable, but he does. If you owned something worth millions of dollars, would you just give it to Microsoft?
    - Zenbit_UX 7y ago
      > He owns the domain, and it's worth millions of dollars because of Microsoft's mistake. I think it's worth millions itself as a 4 character .com. It's value because of the mistake and potential that represents is likely orders of magnitude higher than that.
onetimemanytime 7y ago
>>The end of the article the owner talks about why he doesn't just give the domain name to Microsoft for the good of security, Microsoft should buy it for the good of security. Why gift anything to a Trillion dollar company?
Neil44 7y ago
As a Joe Shmoe I honestly think I would do the same thing as this guy, and I'd sleep OK about it. Should I forgo an 'exit' for me and my loved ones based on feeling some responsibility for the errors in cyber security of various profit seeking corporations owned by someone else?

beamatronic 7y ago

Pain is required in order for people to make change.

mirimir 7y ago

Indeed, one could argue that Microsoft has been encouraging its customers to effectively spoof the domain. So it's totally obvious that it ought to buy it. Still, this is the funniest thing that I've seen in months.

deleted 7y ago
[deleted]

bsder 7y ago

> Why we have to get on and off this merry go round every time is beyond me. Short-sightedness of those with decision making power boggles my mind daily. Because someone will have to cut a 7 digit check. And nobody is going to volunteer their budget for that. Until the bigwigs gets pantsed and command someone to cut the check, it simply won't happen.

ajross 7y ago

A more cynical interpretation is that he almost certainly tried to sell this to MS privately, and they didn't bite at the price he was asking. The public offering at $1.7M is likely an attempt to force their hand. Frankly that doesn't sound to expensive given the context, it's probably less than Microsoft's existing bug bounty budget anyway. I don't know why they couldn't work this out, or why they never bothered to try to address the issue over the multiple decades this guy has been keeping this domain out of dangerous hands. Just write the check, Satya.

harikb 7y ago
With a large organization like Microsoft, people who understand this don’t have the power to make this happen. And people who the power will WTF this for 6 months. By the time they make the decision, it will be too late. I doubt Satya will read this. It took me half hour to understand what is going on. Imagine an MS executive
- mirimir 7y ago
  Sure. But Microsoft has known about his domain, and this issue, since 1997, if not earlier. So they've had over 20 years to think about it.
  - toyg 7y ago
    They’ve just changed default settings to neuter the issue, and hoped the problem with established networks would eventually go away on its own as people upgraded. In fact, I bet that domain was much more valuable in 2005 than it is now.
    - mirimir 7y ago
      Perhaps. But TFA reports a recent test that was frightening enough.
- deleted 7y ago
  [deleted]

tetha 7y ago

As cynical as I may sound, but cybersecurity threats like this will continue to be ignored until they sufficiently escalate into consequences. And that statement, while obvious, is darker than it seems. Companies going under aren't sufficient consequences (many ransomware cases). Universities going offline isn't enough (look for the uni giessen). The bureaucracy of cities going offline isn't enough (e.g. New Orleans). This is just going to continue to escalate until something really really ugly happens and kills many people. And then we'll be presented with some grand legislation that I don't look forward to.

deleted 7y ago
[deleted]
K0SM0S 7y ago
Let me share this thought experiment. - most companies are really bad at security - most people do not care about the security of their data, passwords, etc. Based on these facts, I've been operating for a decade now under the assumption that one day within my lifetime, all of our logged online activity may become public after some hack. All of it that's logged somewhere. Chats, pics, posts, history, notes, cloud drives... It may be slightly paranoid, but better safe than sorry. I should add that I live "normally", I don't care about my pics or discussions becoming public when it happens to everyone else too. I just remain cognizant that there's high probability here. As outlandish as this assumption might be, the opposite (that security holds and most of our stuff never gets hacked) seems even more implausible to me. Educated guess, you know, which speaks less of tech/security than it does of human nature (carelessness or laziness, until a real crash happens). Hopefully this is very Western-centric and other cultures are better at long-term wisdom and planning.
- solotronics 7y ago
  I think this is actually by design. My theory is they built a panopticon intended to move humanity towards being more cooperative and docile. A feature of this is that people become self policing much like in the USSR. You yourself just admitted to what is equivalent to thought policing.

gist 7y ago

> The end of the article the owner talks about why he doesn't just give the domain name to Microsoft for the good of security I can't even take that type of statement (in the article) with a straight face. You have an ordinary person presumably of typical wealth let's say average and he should just give something away for free 'for the good of security'.

labawi 7y ago
Maybe he should ask for reimbursement on registration fees and a token manipulation fee? He registered a bunch of short domains, probably with the intent on profiteering and AFAICT he sold off some of them. By what logic or morals is he entitled to profit?
- gist 7y ago
  Where are you from where do you live? Does not work that way in a capitalistic system in the US. He has the domain and it's lawfully his to decide what to do with it. It's not owned by the public. He's not wrong for selling it for a profit anymore than someone selling their house or car will try to maximize in any legal way they can the amount they can get.
  - labawi 7y ago
    I consider ethics, morals and decency to be a higher authority than law - and I believe many other people do as well. AFAIK DNS was made to serve society, not domain speculators. IMO, domain squatters holding 90%¹ of good domains would be better served with a public whipping rather than monetary reward. Legal and practical status quo is another matter. If I go to <lastname>.com, it says for sale and probably has been since registration. What is the benefit? Would it not be better if those domains were used for a genuine purpose? I wouldn't really mind if someone else was using it. I'm in EU. I had trouble finding exact definition of speculative registration referenced in Terms and Conditions[2]: ".. complaint .. on the basis of speculative or abusive registration, as referred to in Articles 21 and 22(1)(a) of the Public Policy Rules", but here is an excerpt from eurid FAQ [3]: If you want to dispute a domain name (under .eu, ..) registration and you believe that: - you .. hold a trademark, .., family name, etc); and - the current holder has registered or uses the domain name for speculative or abusive purposes, you can challenge its registration via .. (ADR) procedure or in a regular court. AFAICT, domain speculation / squatting are explicitly forbidden, though probably sparsely enforced. I believe I have seen similar wording for applicable ccTLDs, and would not be too surprised to see something similar for .com, .org etc. ¹ Number made up. [2] https://eurid.eu/media/filer_public/f5/d2/f5d22bc1-9d62-4ba9-a81e-1a0292ef215f/terms_and_conditions_en.pdf https://eurid.eu/media/filer_public/f5/d2/f5d22bc1-9d62-4ba9... [3] https://eurid.eu/en/register-a-eu-domain/domain-name-disputes/ https://eurid.eu/en/register-a-eu-domain/domain-name-dispute...

Taek 7y ago

Is just invalidating the domain an problem? DNS exists to serve as a useful tool to society. If a particular domain becomes a public liability, just shut it down. If there's credible reason to believe Microsoft is responsible for the liability, take them to court over it, but don't keep innocents at risk for the sake of trying to get Microsoft to own up to a mistake.

bscphil 7y ago
Regardless of whether that's legally possible, saying Microsoft deserves to "pay" for their mistake does not imply that this guy is owed millions of dollars for sitting on this domain for decades. That's silly regardless of what MS did or didn't do.
- daveFNbuck 7y ago
  He owns the domain, and it's worth millions of dollars because of Microsoft's mistake. He may not deserve to own something so valuable, but he does. If you owned something worth millions of dollars, would you just give it to Microsoft?
  - Zenbit_UX 7y ago
    > He owns the domain, and it's worth millions of dollars because of Microsoft's mistake. I think it's worth millions itself as a 4 character .com. It's value because of the mistake and potential that represents is likely orders of magnitude higher than that.

onetimemanytime 7y ago

>>The end of the article the owner talks about why he doesn't just give the domain name to Microsoft for the good of security, Microsoft should buy it for the good of security. Why gift anything to a Trillion dollar company?

Neil44 7y ago

As a Joe Shmoe I honestly think I would do the same thing as this guy, and I'd sleep OK about it. Should I forgo an 'exit' for me and my loved ones based on feeling some responsibility for the errors in cyber security of various profit seeking corporations owned by someone else?