11 ms·

I can't believe this situation. This is a guy who, by his own admission, wants it to go to Microsoft, but is also holding an auction. He could just quote Micro

• xvector 7y ago
  I am totally OK with the sale of this domain to anyone. He owns the domain and he has the right to sell it. Perhaps the fallout would be good for computer security, as it would stop corporations from making boneheaded security decisions. Pain seems to be the only way to make corporations evolve anyways.
  • gumby 7y ago
    I would agree except he is quoted as “fearing” it won’t go to Microsoft. He could just make that happen.
    • newnewpdro 7y ago
      Microsoft has deep enough pockets to make that happen.
    • CydeWeys 7y ago
      But it's very valuable and he wants (needs?) the money for his retirement. Microsoft may not be willing to pay up.
      • gpm 7y ago
        What right does he have to 1.7 million dollars? The fact that he was the first person to register a domain? That's ridiculous. He did no work for it. He did not do anything to benefit society. His is just trying to extort society for that money by threatening to help criminals if we don't give it to him.
        • huffmsa 7y ago
          He has an asset that he values at $1.7 million. His right is that he owns it and can sell it as he see fit. He has no obligation to M$FT or any of their customers.
          • gpm 7y ago
            What asset? He has an informal agreement with a informal group of organizations to respect his decision of what records to return in response to DNS requests. No one is obligated to follow that agreement. This form of abuse of that informal agreement should result in the group of organizations unilaterally terminating that agreement.
            • JumpCrisscross 7y ago
              > He has an informal agreement It’s a legally binding agreement. I guess we should start yanking peoples’ homes because all they have is an “informal agreement” with the seller?
              • gpm 7y ago
                No it's not. He has no legal agreement with my DNS provider for them to do jack shit. He has some legal agreement with his registrar, and maybe indirectly with ICAAN, but that legal agreement means jack shit to DNS providers, who are the ones that ultimately matter. For an example of DNS providers already using this fact for the public good, see AdGuard DNS
                • 7y ago
    • wongarsu 7y ago
      Not if Microsoft wasn't willing to buy it at a reasonable price. For all we know he offered, they refused, and this is O'Connor's attempt to publicly pressure Microsoft into buying it at his asking price.
      • 013a 7y ago
        Microsoft's willingness to buy it is, in my opinion, irrelevant in this discussion. If everything this "security team" from the article has said is true, this domain is Persona Non Grata. Its an armed nuclear warhead. There is no positive outcome for this story that begins with "And then the domain was bought by". Its Microsoft's "responsibility" to "clean up after their mess". No; We're beyond fighting about who should take responsibility. Throw the ball in Microsoft's court and they'll offer $20k. Throw the ball back to O'Conner and he'll say it's worth far more. He throws the ball to the market. Terrorists notice that, wait, actually, that ball is a nuke. Cool, its at auction; Microsoft now has to pay millions of dollars. So our two options are: Microsoft buys the thing and we're safe, or they don't and we're fucked, and a couple people on reddit are mad at Microsoft for cheaping out, but they live on like it never happened, and we all forget for 18 months until, one day, at the top of hackernews we get a nice new HaveIBeenPwned. At this point, this domain is like example.com; IANA owns that one. Its too generic. Its used in documentation. People mistake it for being meaningful. The only reason it hasn't caused issues is because the owner has, all thanks to him, not intended to cause harm to the public. But we're now in a place where we can do something about it, and this domain should be removed from public registration.
        • codegladiator 7y ago
          > Its Microsoft's "responsibility" to "clean up after their mess". No; We're beyond fighting about who should take responsibility. I feel opposite. It is definitely MS's responsibility, but they don't care because they are not going to be pawned. Its the poor users who MS suggested to use corp as their AD domain without buying that domain in the first place. Every time any corp fks up, the people have to pay for it (maybe by getting hacked, or being saved by state) and corps don't care. > Its too generic Right, and who chose it ? This domain is like example.com except it ain't because people don't mistake it for being meaningful, MS advised people to use it explicitly.
  • tcd 7y ago
    Except what's the human cost of this? If there is a stream of sensitive info, real people will be impacted. Big corps are not usually the ones that are affected the most.
    • deleted 7y ago
      [deleted]
  • trehalose 7y ago
    Would it be the corporation experiencing the pain of identity theft and fraud? Is it just the people in charge of Microsoft whose personal data is being waved around?
    • ethbro 7y ago
      If a third party got burned, they should turn around and sue Microsoft. MS deserves some responsibility for causing this. And "take your entire AD network down for some amount of time and break backwards compatibility" is not a reasonably fix.
      • soneca 7y ago
        I don't see why those third parties wouldn't sue the owner that sold this domain to unknown parties fully aware of the security risk.
        • crooked-v 7y ago
          Sue on what grounds? He has no legal obligation of any kind towards them, and they're the ones who incorrectly sent their traffic to him. Microsoft certainly screwed up here, but all this guy did was... exist.
          • ethbro 7y ago
            Technically, the domain owner probably has grounds to sue Microsoft. By effectively configuring AD / Windows to DDoS the domain, on multiple protocols, MS deprived him of usability. Seems pretty open & shut on loss of value.
            • totalZero 7y ago
              That configuration is the only reason the seller is able to publicly demand such a high price without the universe laughing at him in concert. To put it in perspective, dating.com sold for 1.75m.
  • bosswipe 7y ago
    He doesn't own shit. DNS is a centralized database entrusted to a non profit to serve the good of the internet.
    • ryanlol 7y ago
      Verisign is a nonprofit now?
      • bosswipe 7y ago
        Verisign has a business contract with ICANN to operate as a registry for .com. The contract has a bunch of legalese clauses which can be interpreted in a bunch of ways. They all encourage treating names as property because it makes them alot of money but it's bullshit, you get a limited "license" to a row in the database with a bunch of legal clauses and exceptions. The ultimate guidance for ICANN is supposed to be to protect the health of the internet, though they mostly focus on making money these days.
  • senderista 7y ago
    As I've said before, this is like saying that nuclear war is a good thing because it demonstrates the danger of nuclear weapons.
    • james_s_tayler 7y ago
      Isn't that true though?
      • __s 7y ago
        Let's not & say we did
      • iameli 7y ago
        no
        • james_s_tayler 7y ago
          Why not?
    • int_19h 7y ago
      I do wonder sometimes just how effective nukes would have been as a deterrent, if Hiroshima and Nagasaki weren't there as a case in point on just how devastating they are to civilians specifically.
  • 013a 7y ago
    He does not have the right to sell it. He has the Privilege of selling it. Be very careful about that use of language; your rights, as a citizen of whatever country you live in, are generally limited and legally defined. Domain name ownership certainly does not qualify as a Right.
• jrandm 7y ago
  I think an extreme circumstance would be someone hijacking microsoft.com and trying to ransom it off but I'm not really familiar with ICANN's specific powers. Why should everyone in the world not get to use a thing because Microsoft has some naming scheme? These places have been shouting whatever data at a random (edit: unintentional and uncontrolled rather than random) spot on the internet for years and that's a huge problem. Opening up an auction is a nice way to draw attention to the problem, get MS to literally&figuratively pay for it (even if the price 10x'd it's not like M$ couldn't handle $17MM), and make it no longer the seller's problem.
• Jestar342 7y ago
  Because if he'd have done that, this wouldn't be news, it wouldn't be on HN, and this somewhat invisible security hole would remain in the shadows. Perhaps O'connor would be just fine with ICANN ripping this away from him, but perhaps that bluff needs calling.
• Thorrez 7y ago
  The story is not fully clear. It's possible he already tried to contact Microsoft and tried to sell it to them. They might have refused. But the idea of it going on an auction might pressure them into buying it. Brian did contact Microsoft for comment, and their response doesn't mention that they want to buy it. I consider it bad reporting that Brian doesn't mention whether Mike already contacted Microsoft or not.
  • gist 7y ago
    > I consider it bad reporting that Brian doesn't mention whether Mike already contacted Microsoft or not. To my other comment you say 'contact Microsoft' as if there is a phone line which goes directly to the decision maker for this type of 'purchase'.
    • Thorrez 7y ago
      Brian could have said Mike tried or that Mike didn't know how to contact Microsoft. And Brian contacted Microsoft, so they could have offered the deal to them at that time, but the article doesn't mention it.
      • crooked-v 7y ago
        My BigCorp experiences make me picture events happening this way: somebody made Microsoft an offer, got told "let me ask my manager about that", and then the message got lost in twelve layers of management and/or just outright discarded by one of the human spam filters in one of those layers of management.
    • 013a 7y ago
      It's incredibly easy to find someone at a company like Microsoft who would know who the person is to make a decision like this. For example; I'd start on Linkedin or Twitter, searching for someone with a title that contains "Security", "Senior", "Distinguished", "Manager", etc. You'll find a dozen people. Send a few messages out that outline the situation. They're not the person who makes that decision, but they'll know where to direct it, and if its serious, they'll direct it. No, there's no phone line. No one calls anyone anymore. Find an entry into their corporate graph, and let them resolve it internally. Or, get an article published on a high-profile blog outlining why they should buy it, and they'll be calling by Monday. Its not that hard.
• gist 7y ago
  > I wonder what kind of authority ICANN has in revoking domain name registrations in extreme circumstances. Not even close to the way this works ICANN does not 'revoke' domain names. There are ways to take possession of a domain name but that would not be the process (nor should it be). > He could just quote Microsoft $2M and be done with this whole thing. If you think selling anything and in particular a domain name is that easy you should try to sell a domain name to a large corporation and report back the results. It's not trivial and to a large corporation in particular and further for any amount (much less way less) not assured in any way.
• cfitz 7y ago
  Perspectives like this and others are one of the many reasons I greatly enjoy HN. I didn’t even consider the situation in this way, yet is makes much more sense than what I constructed in my head. Thank you for that. What a persona this paints of the seller. Would like to add that I also share your wonder. To me, this needs to evolve to anecessity for them (ICANN, in terms of ability) rather than just an “if”. Please forgive me my lack of context surrounding this, but would love to learn more about why Corp.com is being sent various data (some sensitive, as mentioned in the article) from various parties in the first place. Did it use to serve a purpose for MS or other?
  • ryanlol 7y ago
    > What a persona this paints of the seller. Yeah! How dare he care about his own livelihood rather than “security”?!? What an asshole!
    • shawnz 7y ago
      It's hard for me to have sympathy for him "protecting his livelihood" when we are talking about a lucky gamble that appreciated by 140000x, he's already successfully sold several of them, and almost the entire value is driven by scamming opportunities
      • ryanlol 7y ago
        > and almost the entire value is driven by scamming opportunities That’s a bizarre claim. Maybe you should read up on previous high value domain name sales before making such statements. The asking price is perfectly reasonable even if you disregard all the “scamming opportunities”.
        • crooked-v 7y ago
          Pretty much any four-letter .com domain (even gibberish) would sell for upwards of a million dollars these days, too. $1.7 million for a recognizable four-letter domain is if anything substantially lowballing it.
• ryanlol 7y ago
  Why bring up ICANN? They don’t control .com, verisign does.
• ConcernedCoder 7y ago
  Am I wrong, or does one update from Microsoft make this whole drama go away and the "problem" a moot point?
  • sillysaurusx 7y ago
    Can't update old windows boxes that refuse to update. And there are a lot of those.
    • ethbro 7y ago
      We're not just talking about Windows boxes. We're talking about entire Active Directory networks. In this sense, it's more like the ipv4 -> ipv6 migration.
• SahAssar 7y ago
  You're saying a domain ownership should be revoked based on a third party having bad defaults and the owner talking up the value of the domain?
  • zamadatix 7y ago
    Certainly, it's a squatted domain the owner has never had any interest in actually using and is now no longer even interested in holding. If what is in the article is true then I don't even think Microsoft should necessarily own the domain let alone put it out for public bid to see if a good guy is willing to pay more than a bad guy could make off of it. The guy even claims "I don’t really need the money. I’m basically auctioning off a chemical waste dump because I don’t want to pass it on to my kids and burden them with it." so revocation and locking seems perfect, it's exactly what he wants.
    • SahAssar 7y ago
      You're putting up two completely different arguments here: 1. The domain was squatted and the owner did not put it to good use. 2. Because of a third party the domain is so toxic that it should be disabled for eternity. Those are very different reasons, which one warrants a revocation? The first one is true for very many domains and probably a large reason that ICANN and registrys have large revenues. The second one is probably unprecedented under a gTLD. If this was under a cTLD I would agree that it would be okay, if accordance under that countries laws and a proper legal process, but under a gTLD I think these measures should not be taken.
      • zamadatix 7y ago
        Two arguments yes but they aren't presented independent as you pose. Scenarios where 1 xor 2 is true is a much more complicated conversation that we don't need to get into in this case. Is there a general solution to those scenarios independently? Maybe but I don't know for sure in that case. What I do know is an inactive domain the owner wants to get rid of because it's a massive burden due to being so toxic should be revoked and locked not sold to the highest bidder. I don't know what we should do if it were an active domain and the security question were posed or what we should do about squatting in general (though I will say the money from the sale does not go to ICANN or the registrar).
• lisper 7y ago
  > He could just quote Microsoft $2M and be done with this whole thing. He could but MS would laugh in his face. The auction and publicity are the only way to establish the domain's actual market value and to pressure MS to pay it.
• mnm1 7y ago
  Why not take microsoft.com then in the same way. One could argue the software there has led to a ton of criminal activity. Since we've now decided that private property laws don't matter anymore, then this domain should be blocked from registration for 100 years. Let's throw in google.com. That has led to tons of crimes too, just from the malware ads, let alone everything else. Obviously all these suggestions are equally ludicrous.
• takeda 7y ago
  Also if this is such a big issue, you can simply configure your local DNS server to point that domain to whatever you want and ignore its original SOA. If everyone would do that the domain would be worthless.