8 ms·
I am totally OK with the sale of this domain to anyone. He owns the domain and he has the right to sell it. Perhaps the fallout would be good for computer secu
by xvector 7y ago
I am totally OK with the sale of this domain to anyone. He owns the domain and he has the right to sell it.
Perhaps the fallout would be good for computer security, as it would stop corporations from making boneheaded security decisions. Pain seems to be the only way to make corporations evolve anyways.
- gumby 7y agoI would agree except he is quoted as “fearing” it won’t go to Microsoft. He could just make that happen.
- newnewpdro 7y agoMicrosoft has deep enough pockets to make that happen.
- CydeWeys 7y agoBut it's very valuable and he wants (needs?) the money for his retirement. Microsoft may not be willing to pay up.
- gpm 7y agoWhat right does he have to 1.7 million dollars? The fact that he was the first person to register a domain? That's ridiculous. He did no work for it. He did not do anything to benefit society. His is just trying to extort society for that money by threatening to help criminals if we don't give it to him.
- huffmsa 7y agoHe has an asset that he values at $1.7 million. His right is that he owns it and can sell it as he see fit. He has no obligation to M$FT or any of their customers.
- gpm 7y agoWhat asset? He has an informal agreement with a informal group of organizations to respect his decision of what records to return in response to DNS requests. No one is obligated to follow that agreement. This form of abuse of that informal agreement should result in the group of organizations unilaterally terminating that agreement.
- JumpCrisscross 7y ago> He has an informal agreement It’s a legally binding agreement. I guess we should start yanking peoples’ homes because all they have is an “informal agreement” with the seller?
- gpm 7y agoNo it's not. He has no legal agreement with my DNS provider for them to do jack shit. He has some legal agreement with his registrar, and maybe indirectly with ICAAN, but that legal agreement means jack shit to DNS providers, who are the ones that ultimately matter. For an example of DNS providers already using this fact for the public good, see AdGuard DNS
- crooked-v 7y agoHow is it abuse? Giant companies auction off lots of domains every day.
- 14 7y agoI would argue yes just buying it first is all he needed to do to deserve to be able to set his own price. People buy and sell domain names all the time and the ones who scooped up Nike.com or NBA.com likely sold it for a pretty penny. They didn’t benefit society. I would argue there are lots of profitable ventures that don’t benefit society but we allow them I think smoking right away as one example. He is trying to take advantage of Microsoft mistake from what I understand. In the giant corporate world a mistake only costing 1.7mil seems like pennies and they should just grab it and put it behind them. On a side note what do you think of Bitcoin? I wanted to buy it back when it was less then 100 a coin but was broke. It would have shot up in price me doing absolutely nothing to benefit society and actually maybe one could argue hurting the environment as bitcoin mining is very energy intensive and also some may argue bitcoins facilitate criminal activities. But I would bet most here on HN would be okay with bitcoin as an investment. I see his domain no differently.
- crooked-v 7y ago> take advantage An asking price of $1.7 million is hardly "taking advantage" of a $286 billion company. Microsoft hoist themselves by their own petard here by letting this problem sit for 26 years: that's only about $65,000 per year, which is more than reasonable pay for somebody who's been effectively giving them free IT services that entire time.
- 14 7y agoI completely agree. It is pennies to this company this is no hardship for them. My personal name as a domain is being squatted on the .com domain for several thousand dollars. It is worthless and I can not imaging a time it will be worth something. But I don't complain and think I should get it for free. If I want my name domain I have to pay several thousand dollars. Had I bought it 20 years back it would have been pennies also. Such is life.
- CydeWeys 7y agoI agree that it's not taking advantage of Microsoft, but it's not because of the dollar amounts involved. If I do a fake refund scam to the tune of $20 on Amazon (which is a ~$1T company), that's still "taking advantage" of them. It doesn't matter that it's peanuts compared to their market cap, I'm still doing something wrong. And as an aside, your stated market cap for Microsoft is off by more than a trillion dollars.
- manigandham 7y agoHe owns it and can offer to sell it at any price. And it sounds like he's certainly helped to keep the security issues contained all this time. Your statement is completely ridiculous. There's no requirement to "work" or provide benefit to society before you can sell something you rightfully and legally purchased. Everyone investing in the stock market is the first to buy something at a lower price. Do they not own the stock? What work did they do when it increases in price? Do they have to prove to society that they're a good person when they offer to sell the stock?
- toomuchtodo 7y agoA domain is a registry entry in a database, a contractual right, not property. Sure, some people have treated it as property with IP mechanizations, but it is not an asset in the sense of a house or other tangible. If a decision is made you can't trade in them, or makes it difficult (ARIN with IP block space comes to mind), you're outta luck.
- manigandham 7y agoIntangible virtual items can be legal assets with ownership. This is not a new concept. > "If a decision is made you can't trade in them" Ok, but it hasn't been made. Ownership can be sold and transferred so that's what's happening.
- toomuchtodo 7y agoRegistration information does not equal ownership. My phone number is assigned to my mobile provider account. I do not own my phone number, as it is not tangible property.
- manigandham 7y agoThis is a pedantic argument that I suspect you know is completely irrelevant. The ownership is of the registration itself. When you buy a share of a company, it's also just assigned to you. But you still own it.
- Zenbit_UX 7y agoThere's little difference between this situation an one in which someone buys a property that then becomes famous in a movie or show. Except in my hypothetical example your response makes you sound like some sort of communist outraged by the profit your neighbor made off their house, when you bought the decidedly unfamous one next to it. > His is just trying to extort society for that money by threatening to help criminals if we don't give it to him. Is he? Where's your proof? Perhaps he's just sharing his very novel experience of a property he owns that the world honestly should know about for security reasons. What if this man dies in a few months and we didn't know about this, then his kids sell it to the NSA or Russia, would you rather that?
- bwilliams18 7y agoFrom the article:“It seems to me that Microsoft should stand up and shoulder the burden of the mistake they made,” he said. “But they’ve shown no real interest in doing that, and so I’ve shown no interest in giving it to them. I don’t really need the money. I’m basically auctioning off a chemical waste dump because I don’t want to pass it on to my kids and burden them with it."
- wongarsu 7y agoNot if Microsoft wasn't willing to buy it at a reasonable price. For all we know he offered, they refused, and this is O'Connor's attempt to publicly pressure Microsoft into buying it at his asking price.
- 013a 7y agoMicrosoft's willingness to buy it is, in my opinion, irrelevant in this discussion. If everything this "security team" from the article has said is true, this domain is Persona Non Grata. Its an armed nuclear warhead. There is no positive outcome for this story that begins with "And then the domain was bought by". Its Microsoft's "responsibility" to "clean up after their mess". No; We're beyond fighting about who should take responsibility. Throw the ball in Microsoft's court and they'll offer $20k. Throw the ball back to O'Conner and he'll say it's worth far more. He throws the ball to the market. Terrorists notice that, wait, actually, that ball is a nuke. Cool, its at auction; Microsoft now has to pay millions of dollars. So our two options are: Microsoft buys the thing and we're safe, or they don't and we're fucked, and a couple people on reddit are mad at Microsoft for cheaping out, but they live on like it never happened, and we all forget for 18 months until, one day, at the top of hackernews we get a nice new HaveIBeenPwned. At this point, this domain is like example.com; IANA owns that one. Its too generic. Its used in documentation. People mistake it for being meaningful. The only reason it hasn't caused issues is because the owner has, all thanks to him, not intended to cause harm to the public. But we're now in a place where we can do something about it, and this domain should be removed from public registration.
- codegladiator 7y ago> Its Microsoft's "responsibility" to "clean up after their mess". No; We're beyond fighting about who should take responsibility. I feel opposite. It is definitely MS's responsibility, but they don't care because they are not going to be pawned. Its the poor users who MS suggested to use corp as their AD domain without buying that domain in the first place. Every time any corp fks up, the people have to pay for it (maybe by getting hacked, or being saved by state) and corps don't care. > Its too generic Right, and who chose it ? This domain is like example.com except it ain't because people don't mistake it for being meaningful, MS advised people to use it explicitly.
- tcd 7y agoExcept what's the human cost of this? If there is a stream of sensitive info, real people will be impacted. Big corps are not usually the ones that are affected the most.
- deleted 7y ago[deleted]
- trehalose 7y agoWould it be the corporation experiencing the pain of identity theft and fraud? Is it just the people in charge of Microsoft whose personal data is being waved around?
- ethbro 7y agoIf a third party got burned, they should turn around and sue Microsoft. MS deserves some responsibility for causing this. And "take your entire AD network down for some amount of time and break backwards compatibility" is not a reasonably fix.
- soneca 7y agoI don't see why those third parties wouldn't sue the owner that sold this domain to unknown parties fully aware of the security risk.
- crooked-v 7y agoSue on what grounds? He has no legal obligation of any kind towards them, and they're the ones who incorrectly sent their traffic to him. Microsoft certainly screwed up here, but all this guy did was... exist.
- ethbro 7y agoTechnically, the domain owner probably has grounds to sue Microsoft. By effectively configuring AD / Windows to DDoS the domain, on multiple protocols, MS deprived him of usability. Seems pretty open & shut on loss of value.
- totalZero 7y agoThat configuration is the only reason the seller is able to publicly demand such a high price without the universe laughing at him in concert. To put it in perspective, dating.com sold for 1.75m.
- bosswipe 7y agoHe doesn't own shit. DNS is a centralized database entrusted to a non profit to serve the good of the internet.
- ryanlol 7y agoVerisign is a nonprofit now?
- bosswipe 7y agoVerisign has a business contract with ICANN to operate as a registry for .com. The contract has a bunch of legalese clauses which can be interpreted in a bunch of ways. They all encourage treating names as property because it makes them alot of money but it's bullshit, you get a limited "license" to a row in the database with a bunch of legal clauses and exceptions. The ultimate guidance for ICANN is supposed to be to protect the health of the internet, though they mostly focus on making money these days.
- senderista 7y agoAs I've said before, this is like saying that nuclear war is a good thing because it demonstrates the danger of nuclear weapons.
- james_s_tayler 7y agoIsn't that true though?
- __s 7y agoLet's not & say we did
- iameli 7y agono
- james_s_tayler 7y agoWhy not?
- int_19h 7y agoI do wonder sometimes just how effective nukes would have been as a deterrent, if Hiroshima and Nagasaki weren't there as a case in point on just how devastating they are to civilians specifically.
- 013a 7y agoHe does not have the right to sell it. He has the Privilege of selling it. Be very careful about that use of language; your rights, as a citizen of whatever country you live in, are generally limited and legally defined. Domain name ownership certainly does not qualify as a Right.