4 ms·

Or qualify with "harmless changes", like inserting a TXT entry with your name.

prvit 4y ago
Whats the point? It’s not like it makes any difference. His tweet will not protect you if you choose to make harmful changes to someone else’s stuff.
- throwthere 4y ago
  It may or may not make a difference with what happens in the court system, but I assure you there is a set of people who think the tweet would be permission to hijack a domain. And some of that set overlaps with the group that might accept the $10k challenge. Whether they actually follow-through and are able to, hopefully not. A bug bounty really ought to be thought out carefully.
  - prvit 4y ago
    >I assure you there is a set of people who think the tweet would be permission to hijack a domain. And some of that set overlaps with the group that might accept the $10k challenge. And then from all those people you'd still need to find someone who 1) would successfully pull it off and 2) be stupid enough to demonstrate this in a damaging manner. It’s also worth noting that this offer was made to only one person.
    - throwthere 4y ago
      Arguably the offer was made to everyone. I don't know about your other point because, like I said in my post I think those people may exist. Perhaps you don't, but, you kind of made the initial statement that it doesn't matter, right? So isn't it on you to prove it?
      - prvit 4y ago
        > Arguably the offer was made to everyone How so? It’s clearly a tweet to a single individual.
ok123456 4y ago
Inserting a TXT entry isn't a harmless change these days, because it's one way to authenticate ownership of a domain. Like recovering a google apps admin login.
- arielcostas 4y ago
  It can be used harmfully (as everything) but adding one isn't as harmful as for example deleting an A entry or changing CNAMEs to another domain
toast0 4y ago
Namecheap's primary business is as a domain registrar. Sensible customers don't let their domain registrar act as their authoritative DNS, you'd need to change something else; but maybe mild defacement of the contact name or address in whois would qualify, without being harmful.
- SahAssar 4y ago
  > Sensible customers don't let their domain registrar act as their authoritative DNS Are you saying that based on quality of the service or something else?
  - toast0 4y ago
    You want to be able to switch registrars whenever it's convenient. But if your registrar is also your authoritative DNS and your webhosting, it makes it inconvenient to switch registrars.
    - SahAssar 4y ago
      Switching DNS is not harder than switching registrars, and keeping them in the same place is reasonable if that provider offers good service for both or you want to avoid the additional complexity of an additional vendor. I thought your original comment made it sound like there was some obvious reason for keeping DNS and registrars separate.
      - toast0 4y ago
        Switching DNS is harder than switching registrars, because there's more records, and you have to transfer them, and you ideally want the old service to send NS records pointing to the new service, and the old service should be cancelled only after sufficient DNS traffic has moved to the new service. For a seamless transition, you need a period of time with both services active, but some registrars with included nameservice will cancel your nameservice immediately when a domain is transfered to a new registrar; and you likely can't start service at the new registrar in advance either. Recursive resolvers do cache and use glue records, and 2 day TTLs are common at TLDs. On the other hand, a registrar transfer is usually simple and quick and has no user visible changes. Unlock the domain, get a transfer code, do any confirmation stuff, make sure the glue records didn't change, you're done.

Whats the point? It’s not like it makes any difference. His tweet will not protect you if you choose to make harmful changes to someone else’s stuff.

throwthere 4y ago
It may or may not make a difference with what happens in the court system, but I assure you there is a set of people who think the tweet would be permission to hijack a domain. And some of that set overlaps with the group that might accept the $10k challenge. Whether they actually follow-through and are able to, hopefully not. A bug bounty really ought to be thought out carefully.
- prvit 4y ago
  >I assure you there is a set of people who think the tweet would be permission to hijack a domain. And some of that set overlaps with the group that might accept the $10k challenge. And then from all those people you'd still need to find someone who 1) would successfully pull it off and 2) be stupid enough to demonstrate this in a damaging manner. It’s also worth noting that this offer was made to only one person.
  - throwthere 4y ago
    Arguably the offer was made to everyone. I don't know about your other point because, like I said in my post I think those people may exist. Perhaps you don't, but, you kind of made the initial statement that it doesn't matter, right? So isn't it on you to prove it?
    - prvit 4y ago
      > Arguably the offer was made to everyone How so? It’s clearly a tweet to a single individual.

ok123456 4y ago

Inserting a TXT entry isn't a harmless change these days, because it's one way to authenticate ownership of a domain. Like recovering a google apps admin login.

arielcostas 4y ago
It can be used harmfully (as everything) but adding one isn't as harmful as for example deleting an A entry or changing CNAMEs to another domain

toast0 4y ago

Namecheap's primary business is as a domain registrar. Sensible customers don't let their domain registrar act as their authoritative DNS, you'd need to change something else; but maybe mild defacement of the contact name or address in whois would qualify, without being harmful.

SahAssar 4y ago
> Sensible customers don't let their domain registrar act as their authoritative DNS Are you saying that based on quality of the service or something else?
- toast0 4y ago
  You want to be able to switch registrars whenever it's convenient. But if your registrar is also your authoritative DNS and your webhosting, it makes it inconvenient to switch registrars.
  - SahAssar 4y ago
    Switching DNS is not harder than switching registrars, and keeping them in the same place is reasonable if that provider offers good service for both or you want to avoid the additional complexity of an additional vendor. I thought your original comment made it sound like there was some obvious reason for keeping DNS and registrars separate.
    - toast0 4y ago
      Switching DNS is harder than switching registrars, because there's more records, and you have to transfer them, and you ideally want the old service to send NS records pointing to the new service, and the old service should be cancelled only after sufficient DNS traffic has moved to the new service. For a seamless transition, you need a period of time with both services active, but some registrars with included nameservice will cancel your nameservice immediately when a domain is transfered to a new registrar; and you likely can't start service at the new registrar in advance either. Recursive resolvers do cache and use glue records, and 2 day TTLs are common at TLDs. On the other hand, a registrar transfer is usually simple and quick and has no user visible changes. Unlock the domain, get a transfer code, do any confirmation stuff, make sure the glue records didn't change, you're done.