8 ms·
The new .zip TLD is going to cause some problems
- jwilk 3y agoYesterday: https://news.ycombinator.com/item?id=35920336 https://news.ycombinator.com/item?id=35920336 ("The .zip TLD sucks", >290 comments)
- brookst 3y agoHow is this different from .com, which was also a common file extension?
- ComputerGuru 3y agoThere was no omnibar five decades ago.
- deleted 3y ago[deleted]
- toast0 3y agoAuto linkifying wasn't happening in the olden times. And there was a shortage of octets for tlds in those days, so .com was all that could be spared.
- pavel_lishin 3y ago.com file weren't typically emailed to people, and there was no expectation that clicking on them would do something harmless like display some files or a document.
- gmuslera 3y ago.exe is a more recently used file extension, luckily there isn't (yet) any TLD with that. Belize have .bz (and the domain tar.bz exists), but both the extension used is usually .bz2, and is not so commonly used for transmitting files, .gz would had more impact. But in the end, is about applications, that may be showing/using 2 different things, URLs and filenames, with different namespaces and use cases, in a pretty similar way.
- Aardwolf 3y agoAlso cute is the .sh domain, for when you want to curl your shell scripts
- brudgers 3y agoWhen .com became a common top level domain, search tools did not commingle the file:// and http:// http:// protocols. This was probably for two reasons. Bandwidth was precious. Searching file systems was slow. Maybe business ethics played a role as well. Maybe not.
- Jasper_ 3y agoIt was common to see viruses spread by someone sending an executable attachment called "amazon.com" or similar and have people click the link to open it. Most email providers now flat out strip attachments with .com extensions.
- pornel 3y agoIt's not a commonly used extension, and it's a dangerous file type, so users shouldn't be opening received .com files either way. OTOH .zip is quite common and has legitimate uses.
- xigoi 3y ago.zip files can also be dangerous. https://en.m.wikipedia.org/wiki/Zip_bomb https://en.m.wikipedia.org/wiki/Zip_bomb
- flangola7 3y agoI have never seen a .com file, do you mean html?
- hawski 3y agohttps://en.wikipedia.org/wiki/.COM https://en.wikipedia.org/wiki/.COM
- aaron695 3y ago[dead]
- p4bl0 3y agoFunny that this is said from a .mobi website, which is also a file extension. Granted, .mobi files are much less used and much less standardly shared than .zip files, but still it made me smile.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- anecdotal1 3y ago.com .sh There are many file extension collisions with TLDs and the sky didn't fall yet
- partiallypro 3y agoNeither of those are used by general consumers on a regular basis. Those are used by people that are generally knowledgeable. I don't know why people can't wrap their head around this. .zip is used every day by people that aren't the best at understanding computer security. Massive difference.
- deleted 3y ago[deleted]
- waboremo 3y agoThe category of "tech literate enough to use zips but not enough to know not to blindly click links in emails and also aren't covered by their company's security policy" is a pretty niche group. Your grandpa isn't compressing zips and sending them around to family. Vast vast vaaaaast majority of people just use direct file uploads. This is going to be a problem, but not for the average folk, but rather for IT teams with unstable rules and other software teams like Gmail who are likely to signal larger differences between attachments and just links.
- 3y ago
- gravitronic 3y agoHere's the files you requested: https://attachment.zip https://attachment.zip
- hakube 3y agodamn. You got me
- whoibrar 3y agoThe only good use of this domain.
- sashk 3y agoYouTube ad killed "you got me".
- computerfriend 3y agoUse an ad blocker.
- tialaramex 3y agoOr pay for Premium.
- wand3r 3y agoI'm not sure you can on iOS? Or not in a straightforward way. If you can block YT ads on ios, would love to know
- bityard 3y agoIt's only going to cause problems for software which tries to be too smart for its own good. Applications should not try to guess what the user meant in ambiguous situations because they will often get it wrong.
- pornel 3y agoUntil now they were mostly getting it right, and unintended links were more of a minor annoyance than a risk (e.g. it happens when talking about Perl or Rust files, but programmers aren't an easy phishing target).
- waboremo 3y agoNo, it was mostly so cautious it only worked under very strict conditions (ie https and www had to be present or only certain domains) to the point of being useless. Others got quite a lot wrong such as reddit regularly cutting off valid links that left you having to manually copy the entire link anyways. The same exact security issues that are present here with .zip are also possible with unintended links.
- cobertos 3y agoHad this issue yesterday. Wanted to Google the docs for `console.group` but who would've guessed that .group was a gtld
- prmoustache 3y agoFirst thing I do when configuring a browser is disabling search in the url bar and activating the dedicated search bar. Not only it is less ambiguous but I don't want google/duckduckgo or whichever search engine I am using all the domains, url and possibly credentials I am using and I am pretty sure I will do a typo once in a while. It should be a best practice in any business entity yet I haven't seen any company enforcing this. Apparently everybody is fine leaking internal stuff.
- motoxpro 3y agoSo instead of downloading a malicious file it takes me to… a webpage?
- rickstanley 3y agoNow it may be a malicious webpage gasp
- jchw 3y agoHonestly I think while confusing, this will ultimately not wind up being a big deal. As it is, I have spotted literally hundreds of accidental links across the internet, caused by ccTLDs and gTLDs. Any time someone ends a sentence with a period and doesn't put a space after it it's extremely easy for it to become an accidental link.it isn't that hard to imagine :) Doesn't necessarily mean it's great for ICANN to be granting all of these dumb top-level domain names, but it is a stronger argument against aggressive autolinking. It's always been crappy behavior anyways.
- emodendroket 3y agoI think the problem is that people can squat on "obvious" domains like "financial-report.zip" and put malicious stuff there.
- tbyehl 3y agoWeird how everyone wants to blame the TLD and not the systems that naively convert text into hyperlinks.
- galleywest200 3y agoThis is also a very pertinent point. Side note: Outlook automatically converting addresses into Bing Maps links is quite frustrating when you copy+paste dozens of addresses a day for work.
- Akronymus 3y agoAlso, copy pasting links using the title of the page as the label and putting the actual link behind a "security scan" thingie so that it is incredibly annoying to just get a blank link.
- pornel 3y agoBecause these systems and conventions were first. ICANN should have considered the status quo instead of passing the buck to thousands of other preexisting implementations.
- tbyehl 3y agoThe first TLD / file extension collision is older than that.
- pornel 3y agoAs I've said elsewhere, I don't think any of them was a big deal. Normal people don't send each other .com files, and users of .pl/.sh/.rs files are likely sophisticated enough to spot the difference. But tons of webmail users may click Photos.zip and open whatever it downloads. They already do in whatever phish mail they get, but thanks to autolinking now the boobytrapped links will be everywhere, including trusted sources.
- chrismorgan 3y agoHonestly, I harbour just a smidgeon of hope that cases like this will nudge companies to reevaluate the whole “find text that could be a link with a missing protocol” feature and realise that it’s a terrible idea that causes more trouble than it solves. If you want a link, write a proper URL. The embedded tweet shows another problem, too: > Grrr... Because .zip is a valid TLD, it's impossible to know whether http://t.co/webB2l1Y9w http://t.co/webB2l1Y9w should be a URL or a filename. Twitter mangle your links to use t.co including the presented text, so that embedders have no way to determine that the text was supposed to be “example.zip” without following the link or the tweet link. There may have been some purpose to t.co quite a few years ago, but the reasons justifying it vanished completely a few years ago, leaving behind just something that is completely hostile to users and security common sense. (This also reminds me of Cloudflare’s “email address protection” feature, which catches and mangles (in a you-need-to-run-our-JavaScript sort of way, so it doesn’t actually affect most people) various things that aren’t and can’t be email addresses, like package-name@1.2.3.)
- iforgotpassword 3y agoI've only ever implemented this in hobby projects, but after a while my simple rule to detect links that are missing the protocol prefix became either having a www. prefix or having a slash after what could be a domain name.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- ttoinou 3y agoIsnt that a proof by direct example of what the author wanted to show ?
- dom96 3y agoCan someone describe a concrete vulnerability that this creates?
- deleted 3y ago[deleted]
- hgs3 3y agoMessage someone and mention a file with a .zip extension, like "Go to Trusted Bank and download financials.zip". Since .zip is now a TLD, software could auto-link it to https://financials.zip https://financials.zip. The receiver will think the sender legibility linked to financials.zip for their convivence, but in fact they'll be redirected to a URL with a malicious zip file.
- gcoakes 3y agoAt least with HTML email, I can already link text to an arbitrary link. This whole thing doesn't seem that important to me.
- hgs3 3y ago> At least with HTML email, I can already link text to an arbitrary link. The sender doesn't have to link to anything. Merely writing some non-whitespace characters, followed by a dot, followed by a TLD can trigger client software to automatically create a link, e.g. mentioning "attachments.zip" could cause client software - that is trying to be clever - to create a link to https://attachments.zip https://attachments.zip which might serve a malicious zip file. The receiver will think the sender created the link, but in actuality it was their own software that created it trying to be clever. > This whole thing doesn't seem that important to me. This affects any client software that creates auto-links for TLD's. The "solution" is software must never create an auto-link in the absence of a protocol, e.g. never auto-link "example.com" but "https://example.com https://example.com" is ok.
- neurostimulant 3y agoChat clients like whatsapp don't allow you to link text to an arbitrary link, but instead will automatically turns text "attachment.zip" into a link to http://attachment.zip http://attachment.zip
- gweinberg 3y agoDibs on the .exe domain!
- perk 3y agoimages.zip was available a couple of hours ago, now it's taken.
- c7DJTLrn 3y agoMeh, seems like an overreaction. ICANN being bribed into making company-specific TLDs is a bigger issue that nobody is talking about.
- deleted 3y ago[deleted]
- janalsncm 3y agoDumb question, what exactly is the reason we can’t have arbitrary TLDs? Why shouldn’t I be able to register a domain like ilike.tacos? I’d really like to use my last name as a TLD so I can do firstname.lastname.
- anaganisk 3y agoBecause the big guy in the middle wants $$$. If you are able to achieve worldwide switching DNS, ICANN to another set of rules you could.
- toast0 3y agoArbitrary and numerous TLDs would make the root servers job a lot harder. As-is, the root servers serve a nearly static zone, and high traffic domains are distributed somewhat over several TLD's servers. It wouldn't be impossible to smoosh that all into one cluster, but it would be a bigger challenge than the status quo. You would also have a lot more administrative tension; there are several organizations that each run one or two letters of the root servers; getting them to all coordinate real time changes to a massive zone would be challenging. (I believe all the TLDs, and certainly all the majors are each run by one organization)
- kzrdude 3y agoI assume email clients will be smart and won't linkify random_words.zip.
- kzrdude 3y agoAren't we going to fully replace .zip with something that uses zstd soon anyway?
- hulitu 3y agoWe need an xlsx and docx TLD.
- postalrat 3y agoJust admit you are all jealous of these sweet .zip domains I got.
- 55555 3y agoI scanned a day’s worth of the tweet stream and this seems to be overblown. It’s hard to find even a single problem case in an entire day on Twitter.
- thinking001001 3y agoThere are only 24^3 possible combinations of 3-letter file extensions, 34^3 if we start mixing in numbers. And they potentially will need to be constantly available for decades to come... We should probably use more sparingly to prevent a repeat of the IPv4 situation.
- bdhcuidbebe 3y agoThere is no 3 letter limitation of extensions in any current OS.
- bdhcuidbebe 3y agoSuch a non problem. its file://example.zip vs https:// https:// example.zip