8 ms·
.zip is now available as a TLD
- 8organicbits 3y agoAfter we combined the search bar and address bar some queries turn into page loads. So before typing example.zip would perform a search, but now it leaks the terms out to my DNS server, usually in plaintext. For TLDs that match popular file extensions, this risk is pretty high. Enabling separate search and URL fields is one of the first things I do when setting up a browser, along with defaulting to DDG search.
- rgrmrts 3y agoWhy would it leak terms to the DNS in plaintext? Aren't most DNS servers encrypted between the client and server? I know that's true for DNS over HTTPS but I thought it was generally true as well these days
- packetlost 3y agohahaha no. You have to go out of your way to use DNS-over-HTTPs or DNSSEC.
- jeroenhd 3y agoDNSSEC only provides signatures, it doesn't encrypt your queries. How much you need to go out if your way depends. Firefox enables DoH by default in some areas, for example. Windows and Chrome will try to use it if your DNS server of choice supports it (i.e. if you've set up 1.1.1.1 or 8.8.8.8). Android has Private DNS enabled by default, I believe. Some manufacturers may turn it off, I don't remember the setting my devices shipped with.
- packetlost 3y agoOh! I always thought DNSSEC was encrypted, thanks for the correction
- 8organicbits 3y agoI believe DoH rollout is still ongoing. The last I see from Chrome is https://blog.chromium.org/2020/05/a-safer-and-more-private-browsing-DoH.html https://blog.chromium.org/2020/05/a-safer-and-more-private-b... and the last I see from Firefox is https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https Those changes are driving up the adoption rate, but it's not complete. I suspect most DNS is still unencrypted at this point, but I can't confirm.
- gaudat 3y agoSome of the old ccTLDs are offenders too. Too many times have I pasted a shell script's file name into the url bar and it starts loading a search result page. For more sensitive use cases a better default will disabling search in the "omnibar" altogether like in ungoogled-chromium.
- CydeWeys 3y agoI would say it's the other way around, no? Common file extensions are offenders for copying ccTLDs that already existed.
- jorams 3y agoThe .sh ccTLD was registered in 1997[1]. I can't quickly find a reference for when the .sh file extension was first used, but I'd be surprised if it weren't older. [1]: https://www.iana.org/domains/root/db/sh.html https://www.iana.org/domains/root/db/sh.html
- CydeWeys 3y agoYes, I was more talking about the older ccTLDs for more real countries.
- nequo 3y agoFor these situations, it is useful to type ?example.zip and force the browser to perform a search.
- crazygringo 3y agoWow, here I am having used Chrome and Firefox for a decade and a half, and I never knew the "?" trick. That is super-useful, thanks.
- bmacho 3y agoWhy not "g example.zip"? It is faster to type, also configurable what to do. Or ctrl+e, ctrl+v, if your left hand is there.
- crazygringo 3y agoI don't understand. "?" already works. "g" doesn't do anything, no matter if I follow it with a space or a tab. It's also not faster to type, since "?" doesn't need to be followed by whitespace.
- CydeWeys 3y agog and space are both home finger keys though. Question mark is not nearly so easy to type. I think "g " might win out. To get it to work I think you need to configure g as a bookmark shortcut though, so it's not built-in.
- sp332 3y agoIn Chrome, you can change the shortcut for each search engine in the settings. The default shortcut for google is "google.com".
- bmacho 3y ago"g " does whatever you want, and it has cross browser support. "?" does whatever the browser you use happen to do. Typing-wise you may be right, it depends how do you type, or where are your hands.
- version_five 3y agoThere are 8: .dad, .phd, .prof, .esq, .foo, .zip, .mov and .nexus
- est 3y ago.av1 .mp4 when?
- jug 3y agoI want .rar or .mkv to happen and have it be conquered by warez groups :3
- qubyte 3y agoSomeone already snapped up torment(dot)nexus.
- alpaca128 3y agoLooks like the next Metaverse will get more exciting.
- fdschonborn 3y agoMetaverse? That's so last year. AI in the other hand...
- partiallypro 3y agoI know, but I posted about .zip because it's a common file extension (you could make an argument for .mov as well though that's dated.) This seems to break name spaces and could be a nightmare for OpSec and also break local search in some instances (with Windows, OSX, etc launching the TLD instead of the file.) Seems like a bad thing which bad actors will take full advantage of.
- version_five 3y agoI can picture a file.zip squatting site that shows a windows-styled "unzipping" window and says "file is protected, please enter <whatever information> here to unlock"
- TZubiri 3y agoThis is unfortunate. I hope apps don't interpret file names as domain names, much less as directions to an http server
- adsfoiu1 3y agoI guess this could be a more common issue with zip, but any TLD could also be a file extension so in that sense this isn't a new problem
- gary_0 3y agoYes, but TLDs like this increase the attack surface of the system, making it easier for bad actors to exploit bugs in networked software or craft phishing-style attacks (including more opportunities for typosquatting). While com/net/org/country only was too spartan, I see the modern TLD free-for-all as a Bad Thing.
- sashk 3y agoah, unzip.zip is taken.
- Whinner 3y agoso is un.zip
- codethief 3y agoso are winrar.zip and g.zip
- CydeWeys 3y agoun.zip isn't registered, it's a globally reserved term on all gTLDs for the United Nations. You can query WHOIS/RDAP to see that it's not registered.
- bloqs 3y agoSorry, i might be being stupid, but this doesnt seem to be the case for me via who.is and its not on the icann list in the other child comment, any ideas?
- adzm 3y agoThat's something I never knew existed. I found a list here: https://www.icann.org/sites/default/files/packages/reserved-names/ReservedNames.xml https://www.icann.org/sites/default/files/packages/reserved-...
- donmcronald 3y agobitcoin.zip is available for only $1100 / year. Scamming is high margin, so I bet a scammer will buy that from the scammers for scamming. bitcoin-wallet.zip is available for <$15 / year if you're scamming on a budget.
- MrZander 3y agoWell, that seems like a bad idea. Out of curiosity, does anyone know what happens if I have: `<a href="google.zip">Link</a>`? Will the browser navigate to an external site or will it try to download google.zip?
- herpderperator 3y agoYou need a http:// http:// or https:// https:// prefix to tell the browser to navitage to another site, otherwise the request defaults to being a relative path.
- MrZander 3y agoI see, I assume that is true for all TLDs? (Can you tell I don't do much web front-end lol)
- iforgotpassword 3y agoOr just //
- AgentME 3y agoThis behavior doesn't depend on TLDs. A href will be to the local origin unless it starts with a protocol ("https://example.com https://example.com") or two slashes (protocol-relative link, like "//example.com"). (The rest of the rules are that if an href starts with a single slash, then it will be a domain-relative link, otherwise it will be relative to the current URL's path.)
- nevi-me 3y ago
- wild_pointer 3y agosighun.zip
- jeroenhd 3y agoHow long until .exe, .app, .apk, and .ipa follow? I don't really get why you'd pick a popular file extension as a TLD. It was bad enough when .java got registered, though that's worse because Oracle decided that the name of an island inhabiting over 150 million people was actually theirs to register (and ICANN want along with it).
- rozularen 3y agodidn't know about the .java tld. maybe because tld are assigned to countries and not provinces?
- TheSpiceIsLife 3y agogTLDs are not assigned to countries.
- jeroenhd 3y agoTLDs have been assigned to cities (.amsterdam, .london, .nyc) and provinces (.frl). They're not ccTLDs though, but TLDs bought by a registrar.
- CydeWeys 3y ago> They're not ccTLDs though, but TLDs bought by a registrar. Registry, not registrar.
- dragonwriter 3y ago> How long until .exe, .app, .apk, and .ipa follow? Well, we’ve had .com, for a while (though its no longer that popular as a file extension, but…), so…
- crazygringo 3y agoI can't imagine those would ever be made available. Fortunately, .zip seems less worrisome from a security perspective -- you don't execute a zip file. (Unless I'm missing where clicking on .zip files is an intermediary step in a common exploit?) It's more just confusing from a usability perspective. Like, I don't want domains ending in .jpg or .mp4 or .doc or .txt either, you know? It's a benefit to be able to look at a string and usually be able to reason with high confidence whether it's a domain name or filename. It definitely feels weird to me.
- atonse 3y agoI just tried to buy some and the prices varied wildly depending on how common the words might be (from $30/year to $750/year). Is this a common thing, where registrars (like Google) basically are now acting like squatters for domains that are actually open?
- fckgw 3y agoYes, most newer TLDs have "premium domain" pricing.
- atonse 3y agoSo why is ICANN ok with this? I suspect enough people dangled tons of money in front of them. Yes I understand that it's likely that squatters would've taken this instead. But instead of coming up with a solution for that (like, if you don't use it for X amount of time, then it's lost), they instead decided "why don't we just take that money"
- fckgw 3y agoICANN does not dictate pricing on nTLDs. ICANN gets an (very large) initial fee to approve the nTLD and gets a small cut of every domain sold, while the registry is free to set their own pricing and terms.
- krger 3y ago>if you don't use it for X amount of time, then it's lost Okay, now come up with a definition of "use" that effectively eliminates squatting-for-profit that doesn't also eliminate legitimate uses for having multiple domains that don't look like they're "being used"
- donmcronald 3y ago> Yes I understand that it's likely that squatters would've taken this instead. The squatters are actually better in some cases. If they're selling a non-premium domain that you can renew cheaply, the up front price can be more tolerable than the long term cost of a premium domain. It looks like the premium domains for .zip are about $550 USD on Porkbun. I'd way rather pay $5k up front for a .com compared to $5.5k over 10 years for a .zip.
- superfrank 3y agoI'd love a .api TLD
- adzm 3y agoWould be great for bee enthusiasts
- whoomp12342 3y agothis tweet suggest that google was like "boop I made a TLD" but it really happens with icann, right?
- kkwtflz 3y agoTried to grab nudes.zip... As always, someone else did it first.
- jrmg 3y agoIs this actually a permitted use of the TLDs? I guess the answer is a de-facto ‘yes, because it’s done now and we’d have to revoke registrations to undo it, which is too unpalatable’, but at least some of these are not in accordance with the TLD applications: From https://icannwiki.org/.nexus https://icannwiki.org/.nexus: The mission of the proposed gTLD, .nexus, is to provide a dedicated domain space in which Google can enact second-level domains that relate to Nexus-related products and⁄or services. Specifically, the new gTLD will provide Google with greater ability to categorize its Nexus offerings online, and in-turn provide a more recognizable, branded, trusted web space to the general Internet population. … Charleston Road Registry believes that given its intended use by Google, the .nexus gTLD will best add value to the gTLD space by remaining completely closed for the sole use of Google. … Second-level domain names within the proposed gTLD are intended for registration and use by Google only, and domain names under the new gTLD will not be available to the general public for purchase, sale, or registration. As such, Charleston Road Registry intends to apply for an exemption to the ICANN Registry Operator Code of Conduct as Google is intended to be the sole registrar and registrant.
- CydeWeys 3y agoFun fact about the application details is that they aren't binding, and ICANN actually encourages taking formerly closed domains and opening them up for general registration.
- godzillabrennus 3y agoI can't help but feel like the United States letting ICANN become an international body is the reason for this.
- dang 3y agoRelated ongoing thread: The .zip TLD sucks - https://news.ycombinator.com/item?id=35920336 https://news.ycombinator.com/item?id=35920336 - May 2023 (254 comments)
- senectus1 3y agoso can we assume this is a honeypot TLD?
- jo-m 3y agoto be fair, .com also used to be a common file name extension..
- rtvkiz 3y agowhy is .zip a bad idea?