8 ms·

New TLDs: Not Bad

98 points by NavinF 3y ago

charcircuit 3y ago
>However, what if I sent an email to my family saying, “hey, check out VacationPhotos.zip” with a ZIP file of that name attached to my email Nothing was stopping people from doing that before. hey, check out <a href="https://example.com">VacationPhotos.zip</a>
- sebzim4500 3y ago
  Ok, now do that in a tweet.
  - zamadatix 3y ago
    Doesn't Twitter still have automatic forced link shortening via their t.co service?
    - charcircuit 3y ago
      But it does show you the url in the tweet. But if you use opengraph the image for your link is more prominent so I bet not as many people look at the domain for it.
      - zamadatix 3y ago
        Ah that's right, up to some length for the display.
- smileybarry 3y ago
  But that's intentional malicious linking. Auto-hyperlinking "VacationPhotos.zip" or even just "photos.zip" can mean clicking into a malvertising page, or in some worse-designed cases, your email program prefetching a malvertising page.
- Volundr 3y ago
  The concern here is that someone could say write something like "look in assets.zip for our marketing assets." in an email, repository, etc and a parser automatically turns that into a link. The reader, trusting the source and seeing the link reasonably assumes it's a link to said assets, and clicks it. All a malicious actor needs to do is register assets.zip and wait for people to make this (I'd argue soon to be common) mistake. The malicious actor doesn't need to be in the loop at all. Similar to typosquatting.
echelon 3y ago
.horse is still the best TLD.
- pavlov 3y ago
  I have my (sadly inactive) blog on app.rodeo only because I bought this domain a decade ago, and sunk cost fallacy dictates I have to use it for something after so many years of paying fees. If a rich Texan rodeo entrepreneur showed up in my email inbox wanting to buy this unique domain, I wouldn’t say no. But I’d ask for a pony.
  - MrGilbert 3y ago
    app.rodeo sounds like the perfect name for a app review site...
  - CrampusDestrus 3y ago
    notmyfirst.rodeo
- BeFlatXIII 3y ago
  Charlie.horse
datavirtue 3y ago
Parking needs nerfed.
- chungy 3y ago
  While maintaining a free market, the course of action is to not reward people that park domains. Don't pay the asking price, just let them expire.
flatline 3y ago
“Normal humans” may not type these for personal use, but I do for work all the time and it is a frequent source of confusion, even if not an attack. It’s not just .zip and .mov, but .txt, .js, more.
chunk_waffle 3y ago
I shipped an international package with USPS today and there was an option to add an email. I used my email address with a .family TLD. They couldn't add the email, they said the system was telling them it was an invalid email. Inaccurate email validation in the wild... I suspect the system has a list of known TLDs and that didn't exist when their system was created. Or even worse, they have some hardcoded list of known email providers...
- alpaca128 3y ago
  > Or even worse, they have some hardcoded list of known email providers... I still remember humblebundle rejecting my mailbox.org email as invalid, I'm guessing because of that. They fixed it at some point, fortunately.
- sixstringtheory 3y ago
  Or a regex with a \.[a-z]{2,3} suffix. I’ve had similar problems with my email at a newer TLD.
  - pwdisswordfishc 3y ago
    This wouldn’t even let in .info…
    - marcosdumay 3y ago
      Yes... You didn't make a point, so I'm guessing it's just an observation. Or, seriously, not supporting .info won't stop a lot of people from adopting and keeping a system, not a lot of developers from doing things this way.
      - jjeaff 3y ago
        You'd be surprised. Especially if you are building B2B and users want to use their company emails. Blocking any non-standard TLDs will create a customer service pain for any reasonably large business.
    - 3y ago
crazygringo 3y ago
I just think it's annoying that if I see a reference to "foo.zip" or "foo.mov" it's not immediately clear anymore whether it's a file or a domain. The fact that file extensions and TLD's were roughly the same length in the same format wasn't a big issue, when it's generally understood that ".com" and ".edu" are domains, while ".jpg" and ".mp4" are files. (And as the author states ".com" files are rarely seen by users anymore.) But if the .zip TLD takes off, it's just adding a little bit more cognitive load. Sure, hopefully it's usually clear whether somebody's discussing a filename or a domain name from context. But not always, and that's annoying and anti-user. Conventions have value, and this decreases that value. So really, it's just like... of all the possible TLD's, is there really any benefit to picking ones that are also common filename extensions? Is our economy really going to suffer if we say, hey let's not make things like .txt and .doc into domains as well? There are tons of other TLD's we can create instead.
- mc32 3y ago
  Yeah I think there is potential for confusion given users have been warned for years not to download zipped files as they could harbor malicious payloads, now they have to think is it a link to a file or a tld?
- toomim 3y ago
  So if it's a domain, you should fully qualify it: https://foo.zip https://foo.zip. Over time, this can become a convention. Part of the price you pay in using a .zip domain will be that software doesn't auto-linkify it unless you prefix it with http(s)://.
  - mike503 3y ago
    And with chrome leading it (IIRC) and other browsers following, end users don't even see http or https:// https:// prefixes in their browser bar anymore. Further adding to confusion. I don't see a reason for adding these new TLDs other than a cash grab.
    - em-bee 3y ago
gkoberger 3y ago
If "not bad, actually" is the best praise we can give these new TLDs, then it still feels like the downsides far outweigh the potential issues. Google bought these TLDs. Google also owns Chrome. When you type "something.zip" into the Chrome toolbar, it used to search for it. Now it takes you to a URL. Is that the most widespread vector for attack? Probably not. But at the very least, it's super annoying for people searching for a certain file. I'm yet to see a single compelling reason why they should exist; the best defense has been "well yeah there's a ton of issues but _maybe_ it's not as bad as we think".
- Volundr 3y ago
  > Is that the most widespread vector for attack? Probably not. Yeah one big issue I had with the article was the assertion that telling people to open a file like VacationPhotos.zip isn't something humans do. Is it common? Probably not, but there are a LOT of humans. Even 1% of them doing something makes for a huge attack surface. The vacation photos example is also probably not a very good one. How many README.md files are there out there telling someone to look in assets.zip for the webserver assets, or docs.zip for documentation? Someone seeing this is a link would likely reasonably assume it's a link to the file in the repository, and I'm sure someone more creative than me could get up to all sorts of interesting shenanigans with that (incorrect) assumption.
  - hfkwer 3y ago
    I guess we should revoke Molvoda's TLD then. One could think that readme.md is a file and not a domain.
    - Volundr 3y ago
      Guess which is older, Moldova's .md TLD or markdown? Just because we aren't going to go retroactively revoking TLDs doesn't mean we should actively make the problem worse. For the same reason we probably shouldn't start using the COM file extension for something again.
- waboremo 3y ago
d--b 3y ago
It may not be that terrible security-wise, but it’s just plain stupid to add .zip and .mov as tlds. I mean WHY?! Why the fuck do we need more tlds? And even if we needed new tlds, in the billions of possible choices, why would you choose something that confusing?!
- danlugo92 3y ago
  [flagged]
- sillysaurusx 3y ago
  Money, honey. https://youtu.be/7HxXFi2IGoc https://youtu.be/7HxXFi2IGoc
  - em-bee 3y ago
    reading your comment i first thought of a different song: https://www.youtube.com/watch?v=ETxmCCsMoD0 https://www.youtube.com/watch?v=ETxmCCsMoD0
  - Animats 3y ago
    Right. Network Solutions keeps gifting me with unwanted domains in strange TLDs. Then they add "privacy protection" and other unwanted services for which they try to bill. I have to transfer those domains to another registrar to stop that.
- toast0 3y ago
  where else was I supposed to put this? https://badday.mov/ https://badday.mov/
- rattlesnakedave 3y ago
  .zip is not an inherent security risk.
xg15 3y ago
The arguments in that blog feel very much like a Google press release. The main argument against domain confusion is basically that the author doesn't personally see it as an issue, underlined with a bunch of strawman arguments of things that could theoretically appear in urls but never do in practice. But none of that matters, because thanks to forced HSTS, there will surely never ever be a malicious domain on those new TLDs. This is because, though the new domains may make security harder for users, forced HSTS makes security easier for certain other parties which are not users. So users just have to rely on the smooth operation of those theoretical other parties and everything will work out.
- tptacek 3y ago
  This is not a Google press release.
  - xg15 3y ago
    Which is why I wrote "feels very much like" one. But sorry, I did think the author was a Googler, but apparently he works at Microsoft instead.
    - tptacek 3y ago
      The guidelines ask us not to write things like that, because they lead to really bad threads.
      - xg15 3y ago
        On second read, that was a bit much sarcasm. Apologies.
teddyh 3y ago
This only strengthens the argument against overmatching autolinkers. The URL RFCs recommend using less-than and greater-than characters to denote URLs in text, like so: <https://www.example.com/ https://www.example.com/>. I welcome a return to this practice.
mike503 3y ago
I'm just waiting for clownpenis.fart or horsedick.mpeg, anything else is irrelevant.
silisili 3y ago
I wish more TLDs did what travel, tel, and US did(or tried to do, in the latter's case). Travel vetted each applicant, so you'd know that you were probably not visiting a scam site. Tel was a little different, and more of a registry, but again...not malicious. Us was more standard, only requiring that you be a US resident to register. But because it was a govt contract, any whisper of a domain being used maliciously was met with an audit that would shut it down if you couldn't provide a passport. It wasn't perfect, but better than nothing. It would be nice if more TLDs audited registrants or restricted registrations in some way. A TLD that gains trust is more likely to gain adoption, IMO, even if it is a gTLD. Instead, it seems to be a giant money grab from all parties involved, which has greatly hurt both trust and adoption.
- thomc 3y ago
  This was attempted with the .trust TLD but did not catch on.
russellbeattie 3y ago
The horse is already out of the barn on this one, but .zip really is a moronic TLD and I'm surprised it was inflicted on us. Pedantically it shouldn't matter, but in practice it seems like a real headache. We can all think of common usage and edge cases where it could lead to real issues, from automatic link detection to malware spread. At this point all we can do is shake our heads at the stupidity and prepare ourselves for the worst.
motohagiography 3y ago
The internet was designed around a very specific human readable taxonomy of distinct objects, namely hosts, files, and users. We technically could cause the host and file namespaces to collide on purpose, but other than creating a market for products and services that unknot the mess this makes, what makes it a good idea? I think it's probably time to abandon the platform dominated internet for new cryptographic protocols, as the beneficiaries of this inconsistency are the intermediaries who will charge you to manage the chaos and inconsistency they have themselves created. If you have to do file scanning in email or do any security/governance work at all, TLDs that collide with filenames look like a disaster. An example would be, given a string in a file draft.temp.zip, does it refer to a local filename or a domain? I'd even suggest muddying the namespace like this is a kind of subversion of the internet, which was effectively a social contract about consistency and end to end connectivity. Breaking internet namespaces like this separates the user and person from the network and makes them completely dependent on mediation in the OS for reasoning about basic endpoints. If there is no distinction between files on your machine and on platform company machines, you are in a walled garden. Adding well known file extensions as TLDs will add a fundamental inconsistency that is just injecting chaos as a means to manage it. Yes, MSFT always had .com files and the internet survived, but that's an exception from a company that has never solved a problem they hadn't first caused.
weinzierl 3y ago
"but it is fair to say that .com files are rarely seen by users any more; on Windows, .com has mostly been supplanted by .exe except in some exotic situations." Now "rarely", "mostly" and exotic situations" made me curious. Is there any chance at all to get a *.com file running on a any windows not older than two decades?
- ericlaw 3y ago
  .com files still work fine on Windows; Visual Studio installs devenv.com, for example (IIRC, it's there for a somewhat wacky reason. See %PATHEXT%)
- disconcision 3y ago
  out of curiosity i checked my relatively recent windows 10 installation. i see 102 files ending in .com; 13 if filtered to unique files names. 12 in the windows folder, and 1 in a game folder. most of the windows folder ones are in System32m WinSXS, and SysWow64 subdirs, as well as some windows update subfolders. so it looks like mostly for win32 compatibility. i tried running system32/tree.com in powershell and it works fine
throwaway22032 3y ago
I don't understand the kerfuffle here at all. If you have a file it's after a /. Usually it's after multiple /'s.
burglins 3y ago
> There are now 40 such TLDs: android, app, bank, chrome, dev, foo, gle, gmail, google, hangout, insurance, meet, page, play, search, youtube, esq, fly, eat, nexus, ing, meme, phd, prof, boo, dad, day, channel, hotmail, mov, zip, windows, skype, azure, office, bing, xbox, microsoft Interesting how Google and M$ added their own TLDs (and a fairly large amount of them). (Edit: .meme and .dad are also google, so it's all forgiven)
- CydeWeys 3y ago
  We announced we were doing this way back in 2017 and have stuck to it. It's just surprising that so few others have joined us. https://security.googleblog.com/2017/09/broadening-hsts-to-secure-more-of-web.html https://security.googleblog.com/2017/09/broadening-hsts-to-s...
  - bullen 3y ago
    Can you stop redirecting http to https if there is nothing on port 443 please. Also zip does not execute.
    - CydeWeys 3y ago
      http is insecure and should not be used. Not always using https would defeat the entire purpose of the added security, not least because a MitM attacker could block only the https packets and then force a silent downgrade to insecure http. It needs to always be https, never anything else.
      - jackweirdy 3y ago
        I know this is good for the internet, but not all HTTP is the internet. I have to upload TLS certificates to a printer. A printer! The printer doesn’t even have a sensible tls algorithms, because its firmware was written at least a decade ago. And the likelihood of someone, anyone, MITMing my printer is 0
        3y ago
sam_goody 3y ago
Apple finder mixes web results with local results. Search for file.zip and if it doesn't find a local copy, it will look for a similar result on the web. If you clicked enter before looking (say, you had a typo but meant another file), Safari happily opens the page. I believe that if the page serves a zip, it downloads and unzips it in the background. This TLD sounds like a terrible idea for Mac security, at the least. mov and app is similar, but requires more configuration - and .app by default will not run when downloaded, and .mov is harder to exploit.
OrvalWintermute 3y ago
I don't know that the diagram is correct. Where it indicates "scheme" - that is actually protocol to be used.
- omoikane 3y ago
  According to RFC 1738, that part is called "scheme". https://www.rfc-editor.org/rfc/rfc1738 https://www.rfc-editor.org/rfc/rfc1738
dehrmann 3y ago
I can't tell if TLDs or emojois are trying harder to stay relevant.

98 points by NavinF 3y ago

>However, what if I sent an email to my family saying, “hey, check out VacationPhotos.zip” with a ZIP file of that name attached to my email Nothing was stopping people from doing that before. hey, check out <a href="https://example.com">VacationPhotos.zip</a>

sebzim4500 3y ago
Ok, now do that in a tweet.
- zamadatix 3y ago
  Doesn't Twitter still have automatic forced link shortening via their t.co service?
  - charcircuit 3y ago
    But it does show you the url in the tweet. But if you use opengraph the image for your link is more prominent so I bet not as many people look at the domain for it.
    - zamadatix 3y ago
      Ah that's right, up to some length for the display.
smileybarry 3y ago
But that's intentional malicious linking. Auto-hyperlinking "VacationPhotos.zip" or even just "photos.zip" can mean clicking into a malvertising page, or in some worse-designed cases, your email program prefetching a malvertising page.
Volundr 3y ago
The concern here is that someone could say write something like "look in assets.zip for our marketing assets." in an email, repository, etc and a parser automatically turns that into a link. The reader, trusting the source and seeing the link reasonably assumes it's a link to said assets, and clicks it. All a malicious actor needs to do is register assets.zip and wait for people to make this (I'd argue soon to be common) mistake. The malicious actor doesn't need to be in the loop at all. Similar to typosquatting.

echelon 3y ago

.horse is still the best TLD.

pavlov 3y ago
I have my (sadly inactive) blog on app.rodeo only because I bought this domain a decade ago, and sunk cost fallacy dictates I have to use it for something after so many years of paying fees. If a rich Texan rodeo entrepreneur showed up in my email inbox wanting to buy this unique domain, I wouldn’t say no. But I’d ask for a pony.
- MrGilbert 3y ago
  app.rodeo sounds like the perfect name for a app review site...
- CrampusDestrus 3y ago
  notmyfirst.rodeo
BeFlatXIII 3y ago
Charlie.horse

datavirtue 3y ago

Parking needs nerfed.

chungy 3y ago
While maintaining a free market, the course of action is to not reward people that park domains. Don't pay the asking price, just let them expire.

flatline 3y ago

“Normal humans” may not type these for personal use, but I do for work all the time and it is a frequent source of confusion, even if not an attack. It’s not just .zip and .mov, but .txt, .js, more.

chunk_waffle 3y ago

I shipped an international package with USPS today and there was an option to add an email. I used my email address with a .family TLD. They couldn't add the email, they said the system was telling them it was an invalid email. Inaccurate email validation in the wild... I suspect the system has a list of known TLDs and that didn't exist when their system was created. Or even worse, they have some hardcoded list of known email providers...

alpaca128 3y ago
> Or even worse, they have some hardcoded list of known email providers... I still remember humblebundle rejecting my mailbox.org email as invalid, I'm guessing because of that. They fixed it at some point, fortunately.
sixstringtheory 3y ago
Or a regex with a \.[a-z]{2,3} suffix. I’ve had similar problems with my email at a newer TLD.
- pwdisswordfishc 3y ago
  This wouldn’t even let in .info…
  - marcosdumay 3y ago
    Yes... You didn't make a point, so I'm guessing it's just an observation. Or, seriously, not supporting .info won't stop a lot of people from adopting and keeping a system, not a lot of developers from doing things this way.
    - jjeaff 3y ago
      You'd be surprised. Especially if you are building B2B and users want to use their company emails. Blocking any non-standard TLDs will create a customer service pain for any reasonably large business.
  - 3y ago

crazygringo 3y ago

I just think it's annoying that if I see a reference to "foo.zip" or "foo.mov" it's not immediately clear anymore whether it's a file or a domain. The fact that file extensions and TLD's were roughly the same length in the same format wasn't a big issue, when it's generally understood that ".com" and ".edu" are domains, while ".jpg" and ".mp4" are files. (And as the author states ".com" files are rarely seen by users anymore.) But if the .zip TLD takes off, it's just adding a little bit more cognitive load. Sure, hopefully it's usually clear whether somebody's discussing a filename or a domain name from context. But not always, and that's annoying and anti-user. Conventions have value, and this decreases that value. So really, it's just like... of all the possible TLD's, is there really any benefit to picking ones that are also common filename extensions? Is our economy really going to suffer if we say, hey let's not make things like .txt and .doc into domains as well? There are tons of other TLD's we can create instead.

mc32 3y ago
Yeah I think there is potential for confusion given users have been warned for years not to download zipped files as they could harbor malicious payloads, now they have to think is it a link to a file or a tld?
toomim 3y ago
So if it's a domain, you should fully qualify it: https://foo.zip https://foo.zip. Over time, this can become a convention. Part of the price you pay in using a .zip domain will be that software doesn't auto-linkify it unless you prefix it with http(s)://.
- mike503 3y ago
  And with chrome leading it (IIRC) and other browsers following, end users don't even see http or https:// https:// prefixes in their browser bar anymore. Further adding to confusion. I don't see a reason for adding these new TLDs other than a cash grab.
  - em-bee 3y ago

gkoberger 3y ago

If "not bad, actually" is the best praise we can give these new TLDs, then it still feels like the downsides far outweigh the potential issues. Google bought these TLDs. Google also owns Chrome. When you type "something.zip" into the Chrome toolbar, it used to search for it. Now it takes you to a URL. Is that the most widespread vector for attack? Probably not. But at the very least, it's super annoying for people searching for a certain file. I'm yet to see a single compelling reason why they should exist; the best defense has been "well yeah there's a ton of issues but _maybe_ it's not as bad as we think".

Volundr 3y ago
> Is that the most widespread vector for attack? Probably not. Yeah one big issue I had with the article was the assertion that telling people to open a file like VacationPhotos.zip isn't something humans do. Is it common? Probably not, but there are a LOT of humans. Even 1% of them doing something makes for a huge attack surface. The vacation photos example is also probably not a very good one. How many README.md files are there out there telling someone to look in assets.zip for the webserver assets, or docs.zip for documentation? Someone seeing this is a link would likely reasonably assume it's a link to the file in the repository, and I'm sure someone more creative than me could get up to all sorts of interesting shenanigans with that (incorrect) assumption.
- hfkwer 3y ago
  I guess we should revoke Molvoda's TLD then. One could think that readme.md is a file and not a domain.
  - Volundr 3y ago
    Guess which is older, Moldova's .md TLD or markdown? Just because we aren't going to go retroactively revoking TLDs doesn't mean we should actively make the problem worse. For the same reason we probably shouldn't start using the COM file extension for something again.
waboremo 3y ago

d--b 3y ago

It may not be that terrible security-wise, but it’s just plain stupid to add .zip and .mov as tlds. I mean WHY?! Why the fuck do we need more tlds? And even if we needed new tlds, in the billions of possible choices, why would you choose something that confusing?!

danlugo92 3y ago
[flagged]
sillysaurusx 3y ago
Money, honey. https://youtu.be/7HxXFi2IGoc https://youtu.be/7HxXFi2IGoc
- em-bee 3y ago
  reading your comment i first thought of a different song: https://www.youtube.com/watch?v=ETxmCCsMoD0 https://www.youtube.com/watch?v=ETxmCCsMoD0
- Animats 3y ago
  Right. Network Solutions keeps gifting me with unwanted domains in strange TLDs. Then they add "privacy protection" and other unwanted services for which they try to bill. I have to transfer those domains to another registrar to stop that.
toast0 3y ago
where else was I supposed to put this? https://badday.mov/ https://badday.mov/
rattlesnakedave 3y ago
.zip is not an inherent security risk.

xg15 3y ago

The arguments in that blog feel very much like a Google press release. The main argument against domain confusion is basically that the author doesn't personally see it as an issue, underlined with a bunch of strawman arguments of things that could theoretically appear in urls but never do in practice. But none of that matters, because thanks to forced HSTS, there will surely never ever be a malicious domain on those new TLDs. This is because, though the new domains may make security harder for users, forced HSTS makes security easier for certain other parties which are not users. So users just have to rely on the smooth operation of those theoretical other parties and everything will work out.

tptacek 3y ago
This is not a Google press release.
- xg15 3y ago
  Which is why I wrote "feels very much like" one. But sorry, I did think the author was a Googler, but apparently he works at Microsoft instead.
  - tptacek 3y ago
    The guidelines ask us not to write things like that, because they lead to really bad threads.
    - xg15 3y ago
      On second read, that was a bit much sarcasm. Apologies.

teddyh 3y ago

This only strengthens the argument against overmatching autolinkers. The URL RFCs recommend using less-than and greater-than characters to denote URLs in text, like so: <https://www.example.com/ https://www.example.com/>. I welcome a return to this practice.

mike503 3y ago

I'm just waiting for clownpenis.fart or horsedick.mpeg, anything else is irrelevant.

silisili 3y ago

I wish more TLDs did what travel, tel, and US did(or tried to do, in the latter's case). Travel vetted each applicant, so you'd know that you were probably not visiting a scam site. Tel was a little different, and more of a registry, but again...not malicious. Us was more standard, only requiring that you be a US resident to register. But because it was a govt contract, any whisper of a domain being used maliciously was met with an audit that would shut it down if you couldn't provide a passport. It wasn't perfect, but better than nothing. It would be nice if more TLDs audited registrants or restricted registrations in some way. A TLD that gains trust is more likely to gain adoption, IMO, even if it is a gTLD. Instead, it seems to be a giant money grab from all parties involved, which has greatly hurt both trust and adoption.

thomc 3y ago
This was attempted with the .trust TLD but did not catch on.

russellbeattie 3y ago

The horse is already out of the barn on this one, but .zip really is a moronic TLD and I'm surprised it was inflicted on us. Pedantically it shouldn't matter, but in practice it seems like a real headache. We can all think of common usage and edge cases where it could lead to real issues, from automatic link detection to malware spread. At this point all we can do is shake our heads at the stupidity and prepare ourselves for the worst.

motohagiography 3y ago

The internet was designed around a very specific human readable taxonomy of distinct objects, namely hosts, files, and users. We technically could cause the host and file namespaces to collide on purpose, but other than creating a market for products and services that unknot the mess this makes, what makes it a good idea? I think it's probably time to abandon the platform dominated internet for new cryptographic protocols, as the beneficiaries of this inconsistency are the intermediaries who will charge you to manage the chaos and inconsistency they have themselves created. If you have to do file scanning in email or do any security/governance work at all, TLDs that collide with filenames look like a disaster. An example would be, given a string in a file draft.temp.zip, does it refer to a local filename or a domain? I'd even suggest muddying the namespace like this is a kind of subversion of the internet, which was effectively a social contract about consistency and end to end connectivity. Breaking internet namespaces like this separates the user and person from the network and makes them completely dependent on mediation in the OS for reasoning about basic endpoints. If there is no distinction between files on your machine and on platform company machines, you are in a walled garden. Adding well known file extensions as TLDs will add a fundamental inconsistency that is just injecting chaos as a means to manage it. Yes, MSFT always had .com files and the internet survived, but that's an exception from a company that has never solved a problem they hadn't first caused.

weinzierl 3y ago

"but it is fair to say that .com files are rarely seen by users any more; on Windows, .com has mostly been supplanted by .exe except in some exotic situations." Now "rarely", "mostly" and exotic situations" made me curious. Is there any chance at all to get a *.com file running on a any windows not older than two decades?

ericlaw 3y ago
.com files still work fine on Windows; Visual Studio installs devenv.com, for example (IIRC, it's there for a somewhat wacky reason. See %PATHEXT%)
disconcision 3y ago
out of curiosity i checked my relatively recent windows 10 installation. i see 102 files ending in .com; 13 if filtered to unique files names. 12 in the windows folder, and 1 in a game folder. most of the windows folder ones are in System32m WinSXS, and SysWow64 subdirs, as well as some windows update subfolders. so it looks like mostly for win32 compatibility. i tried running system32/tree.com in powershell and it works fine

throwaway22032 3y ago

I don't understand the kerfuffle here at all. If you have a file it's after a /. Usually it's after multiple /'s.

burglins 3y ago

> There are now 40 such TLDs: android, app, bank, chrome, dev, foo, gle, gmail, google, hangout, insurance, meet, page, play, search, youtube, esq, fly, eat, nexus, ing, meme, phd, prof, boo, dad, day, channel, hotmail, mov, zip, windows, skype, azure, office, bing, xbox, microsoft Interesting how Google and M$ added their own TLDs (and a fairly large amount of them). (Edit: .meme and .dad are also google, so it's all forgiven)

CydeWeys 3y ago
We announced we were doing this way back in 2017 and have stuck to it. It's just surprising that so few others have joined us. https://security.googleblog.com/2017/09/broadening-hsts-to-secure-more-of-web.html https://security.googleblog.com/2017/09/broadening-hsts-to-s...
- bullen 3y ago
  Can you stop redirecting http to https if there is nothing on port 443 please. Also zip does not execute.
  - CydeWeys 3y ago
    http is insecure and should not be used. Not always using https would defeat the entire purpose of the added security, not least because a MitM attacker could block only the https packets and then force a silent downgrade to insecure http. It needs to always be https, never anything else.
    - jackweirdy 3y ago
      I know this is good for the internet, but not all HTTP is the internet. I have to upload TLS certificates to a printer. A printer! The printer doesn’t even have a sensible tls algorithms, because its firmware was written at least a decade ago. And the likelihood of someone, anyone, MITMing my printer is 0
      - 3y ago

sam_goody 3y ago

Apple finder mixes web results with local results. Search for file.zip and if it doesn't find a local copy, it will look for a similar result on the web. If you clicked enter before looking (say, you had a typo but meant another file), Safari happily opens the page. I believe that if the page serves a zip, it downloads and unzips it in the background. This TLD sounds like a terrible idea for Mac security, at the least. mov and app is similar, but requires more configuration - and .app by default will not run when downloaded, and .mov is harder to exploit.

OrvalWintermute 3y ago

I don't know that the diagram is correct. Where it indicates "scheme" - that is actually protocol to be used.

omoikane 3y ago
According to RFC 1738, that part is called "scheme". https://www.rfc-editor.org/rfc/rfc1738 https://www.rfc-editor.org/rfc/rfc1738

dehrmann 3y ago

I can't tell if TLDs or emojois are trying harder to stay relevant.