3 ms·

Microsoft's willingness to buy it is, in my opinion, irrelevant in this discussion. If everything this "security team" from the article has said is true, this

by 013a 7y ago

Microsoft's willingness to buy it is, in my opinion, irrelevant in this discussion. If everything this "security team" from the article has said is true, this domain is Persona Non Grata. Its an armed nuclear warhead. There is no positive outcome for this story that begins with "And then the domain was bought by". Its Microsoft's "responsibility" to "clean up after their mess". No; We're beyond fighting about who should take responsibility. Throw the ball in Microsoft's court and they'll offer $20k. Throw the ball back to O'Conner and he'll say it's worth far more. He throws the ball to the market. Terrorists notice that, wait, actually, that ball is a nuke. Cool, its at auction; Microsoft now has to pay millions of dollars. So our two options are: Microsoft buys the thing and we're safe, or they don't and we're fucked, and a couple people on reddit are mad at Microsoft for cheaping out, but they live on like it never happened, and we all forget for 18 months until, one day, at the top of hackernews we get a nice new HaveIBeenPwned. At this point, this domain is like example.com; IANA owns that one. Its too generic. Its used in documentation. People mistake it for being meaningful. The only reason it hasn't caused issues is because the owner has, all thanks to him, not intended to cause harm to the public. But we're now in a place where we can do something about it, and this domain should be removed from public registration.

codegladiator 7y ago
> Its Microsoft's "responsibility" to "clean up after their mess". No; We're beyond fighting about who should take responsibility. I feel opposite. It is definitely MS's responsibility, but they don't care because they are not going to be pawned. Its the poor users who MS suggested to use corp as their AD domain without buying that domain in the first place. Every time any corp fks up, the people have to pay for it (maybe by getting hacked, or being saved by state) and corps don't care. > Its too generic Right, and who chose it ? This domain is like example.com except it ain't because people don't mistake it for being meaningful, MS advised people to use it explicitly.
dageshi 7y ago
Microsoft have the money, 1.7mil is a rounding error for them. They could've paid the money, solved their problem and nobody would be discussing this on HN now. Instead everybody now knows how incompetent/boneheaded Microsoft are around this issue and they'll probably still end up buying the damned thing. More to your point, this domain is now "too generic" because Microsoft made it so. example.com is going to be used by a wide collection of people, "corp.com" really only has this issue because of Microsoft, there's no generic reason why people would use "corp.com" in the same way they use "example.com". Microsoft created this situation and effectively made that domain toxic, surely it's on them to fix it?

by 013a 7y ago

codegladiator 7y ago

> Its Microsoft's "responsibility" to "clean up after their mess". No; We're beyond fighting about who should take responsibility. I feel opposite. It is definitely MS's responsibility, but they don't care because they are not going to be pawned. Its the poor users who MS suggested to use corp as their AD domain without buying that domain in the first place. Every time any corp fks up, the people have to pay for it (maybe by getting hacked, or being saved by state) and corps don't care. > Its too generic Right, and who chose it ? This domain is like example.com except it ain't because people don't mistake it for being meaningful, MS advised people to use it explicitly.

dageshi 7y ago

Microsoft have the money, 1.7mil is a rounding error for them. They could've paid the money, solved their problem and nobody would be discussing this on HN now. Instead everybody now knows how incompetent/boneheaded Microsoft are around this issue and they'll probably still end up buying the damned thing. More to your point, this domain is now "too generic" because Microsoft made it so. example.com is going to be used by a wide collection of people, "corp.com" really only has this issue because of Microsoft, there's no generic reason why people would use "corp.com" in the same way they use "example.com". Microsoft created this situation and effectively made that domain toxic, surely it's on them to fix it?