4 ms·

Companies should really stop collecting domains as Pokémon-cards. Not only are abandoned domains risking to be hijacked, either by the fact that the whole domai

by Puts 5y ago

Companies should really stop collecting domains as Pokémon-cards. Not only are abandoned domains risking to be hijacked, either by the fact that the whole domain expires or that you have records pointing at servers no longer in your control. But also you are teaching your customers to click on phishing-links, because apparently the e-mails you send out to customers contain a new domain every time. Also, a general tip is to treat all domains and subdomains as information assets within your ISMS. Meaning they should have an explicitly assigned responsible owner within the organization.

ryan29 5y ago
> But also you are teaching your customers to click on phishing-links, because apparently the e-mails you send out to customers contain a new domain every time. I've noticed government departments have become bad for this in Canada. It's crazy. Who runs these sites? https://www.ehealthontario.ca https://ehealthontario.on.ca A long time ago everything used to be split provincially and you could register private domains under the `.on.ca` namespace [1], so there's not a guarantee a `.on.ca` site is a government website AFAIK. I don't understand the aversion to subdomains. Assuming the government owns `canada.ca`, I'd rather see things like: ehealth.on.canada.ca ehealth.bc.canada.ca That makes it easier to determine if a website is government run or not by looking at the URL. Also, all the government websites use super expensive OV TLS certificates. I don't get that either. 1. https://en.wikipedia.org/wiki/.ca#Third-level_(provincial)_and_fourth-level_(municipal)_domains https://en.wikipedia.org/wiki/.ca#Third-level_(provincial)_a...
- jcrawfordor 5y ago
  This was a very popular concept in the early days of public DNS, and standardized to a degree in RFC 1480. E.g. in the US there were extensive "designated structures" under the .us ccTLD. For example, Portland's Franklin High School had been franklin.pps.k12.or.us, but now it's pps.net/franklin. Less common were the designated structure for state governments and agencies---it has always been newmexico.gov, not state.nm.us as Postel had once dictated, but more annoyingly santafecountynm.gov rather than co.santafe.nm.us (it is unclear, bureaucratically, how exactly this would interact with ci.santafe.nm.us which is also designated). Ultimately everyone hated those k12.<state>.us domains though. I've heard many people describe them as annoying, ugly, old fashioned, etc. The simple reality is that the massive dominance of the .com gTLD basically established second-level domains as a prestige point if not a basic requirement for a modern website. This is the same effect that lead to a police department using the wonderfully '90s domain name "apdonline.com". You know a website's good when it tells you it's on the internet, in the name. The situation would perhaps be different if the federal government had ever made any serious moves towards using the proposed .fed.us instead of .gov. And perhaps also if "bare" second-level names had been less problematic and not lead to universal use of www, which lead many consumers to view "www" as some sort of universal prefix like http:// http:// and not as an actual particle of the name which could adopt other values. A common practical problem with subdomains today is a tendency of users to stick www. on the beginning, even if it's a third or lower level name, which people with a deeper understanding of the system usually don't expect or account for. Both of these factors sort of discouraged any real understanding of DNS as hierarchical. But as is, consumers seem to strongly associate third-level and lower domain names as being some combination of sketchy and inconvenient. Probably part of it too is that as much as John Postel loved the two-letter abbreviations, I don't think anyone else really did... "ci" instead of "city" does not really seem like that worthwhile of an economy.
andreareina 5y ago
Not just companies. Philippine Embassy requires some documents to be sent to an @gmail address...

by Puts 5y ago

ryan29 5y ago

> But also you are teaching your customers to click on phishing-links, because apparently the e-mails you send out to customers contain a new domain every time. I've noticed government departments have become bad for this in Canada. It's crazy. Who runs these sites? https://www.ehealthontario.ca https://ehealthontario.on.ca A long time ago everything used to be split provincially and you could register private domains under the `.on.ca` namespace [1], so there's not a guarantee a `.on.ca` site is a government website AFAIK. I don't understand the aversion to subdomains. Assuming the government owns `canada.ca`, I'd rather see things like: ehealth.on.canada.ca ehealth.bc.canada.ca That makes it easier to determine if a website is government run or not by looking at the URL. Also, all the government websites use super expensive OV TLS certificates. I don't get that either. 1. https://en.wikipedia.org/wiki/.ca#Third-level_(provincial)_and_fourth-level_(municipal)_domains https://en.wikipedia.org/wiki/.ca#Third-level_(provincial)_a...

jcrawfordor 5y ago
This was a very popular concept in the early days of public DNS, and standardized to a degree in RFC 1480. E.g. in the US there were extensive "designated structures" under the .us ccTLD. For example, Portland's Franklin High School had been franklin.pps.k12.or.us, but now it's pps.net/franklin. Less common were the designated structure for state governments and agencies---it has always been newmexico.gov, not state.nm.us as Postel had once dictated, but more annoyingly santafecountynm.gov rather than co.santafe.nm.us (it is unclear, bureaucratically, how exactly this would interact with ci.santafe.nm.us which is also designated). Ultimately everyone hated those k12.<state>.us domains though. I've heard many people describe them as annoying, ugly, old fashioned, etc. The simple reality is that the massive dominance of the .com gTLD basically established second-level domains as a prestige point if not a basic requirement for a modern website. This is the same effect that lead to a police department using the wonderfully '90s domain name "apdonline.com". You know a website's good when it tells you it's on the internet, in the name. The situation would perhaps be different if the federal government had ever made any serious moves towards using the proposed .fed.us instead of .gov. And perhaps also if "bare" second-level names had been less problematic and not lead to universal use of www, which lead many consumers to view "www" as some sort of universal prefix like http:// http:// and not as an actual particle of the name which could adopt other values. A common practical problem with subdomains today is a tendency of users to stick www. on the beginning, even if it's a third or lower level name, which people with a deeper understanding of the system usually don't expect or account for. Both of these factors sort of discouraged any real understanding of DNS as hierarchical. But as is, consumers seem to strongly associate third-level and lower domain names as being some combination of sketchy and inconvenient. Probably part of it too is that as much as John Postel loved the two-letter abbreviations, I don't think anyone else really did... "ci" instead of "city" does not really seem like that worthwhile of an economy.

andreareina 5y ago

Not just companies. Philippine Embassy requires some documents to be sent to an @gmail address...