3 ms·

People are hyperventilating about the "danger". .sh also exists and the world didn't burn. https://get.sh https://get.sh

bell-cot 3y ago
".sh" is not a file extension that Joe User sees much of, to be more vulnerable to oopsies.
Wowfunhappy 3y ago
.sh probably shouldn't exist either. But I think .zip is a much more common file extension than .sh among the general populace.
- orra 3y ago
  .sh legitimately exists as a TLD because it's a ccTLD. ccTLDs are based on ISO country codes. In contrast, .zip only exists as a TLD because of ICANN money grubbing.
Y_Y 3y ago
I'm still annoyed that ICANN approved .org without sparing a thought for the poor users of emacs org-mode which had been released -18 years earlier!
- pantulis 3y ago
  Those rascals must use vim!
RunSet 3y ago
I propose that perhaps the problem is not top level domains but rather a certain operating system family's tendency to conflate file name extensions with file types, despite its default setting being "hide file extensions for known file types".
8organicbits 3y ago
The world won't burn, but .sh and .zip are different. If I send an email to my (less technically minded) family I may attach photos.zip. If I mention photos.zip in the body then the mail client may now convert it to a link. If http[://]photos.zip is a malware site, my family may download malware. I may inadvertently link to a malware site by talking about a zip file. I could also send an email with "install.sh" as an attachment, and mention it in the body. http[://]install.sh could be a malware site too. The differences. Non-technical people send, receive, and talk about zip files much more often. .sh was also registered with a clear reason, it's a ccTLD, it's for a country. .zip is just a vanity gTLD. If Zipland was a country, I'd support .zip or ideally .zp. Without a clear purpose and with clear malicious uses, people are just going to block the TLD. Lots of IT folks talking about implementing it on Reddit.
- HelloNurse 3y ago
  [dead]
- dist-epoch 3y ago
  Mail clients will quickly be updated to not convert photos.zip to a link. Even if not, you have the regular browser protections against downloading malware which are always active (deny-lists, reputation, scanning, ...). > Without a clear purpose The clear purpose is freedom of expression. Why should TLDs be limited to country codes? Allowing generic TLDs also relieves pressure on .com and brings down domain costs, since now you can have an interesting.space or cool.site
  - 8organicbits 3y ago
    > Why should TLDs be limited to country codes? Google also registered .dad, .prof, .phd, .esq, .foo, .mov, and, .nexus. I've seen similar complaints about .mov, but there's no opposition to the others or gTLDs in general. https://www.blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech/ https://www.blog.google/products/registry/8-new-top-level-do... I support freedom of expression through TLDs but there's a meaningful pre-existing use of .zip. It's not clear to me that the value of the TLD outweighs the phishing risk, the malware risk, the cost of software developers preventing x.zip from rendering as a link, etc. It's possible the TLD ends up on a block lists and eventually gets discontinued.

bell-cot 3y ago

".sh" is not a file extension that Joe User sees much of, to be more vulnerable to oopsies.

Wowfunhappy 3y ago

.sh probably shouldn't exist either. But I think .zip is a much more common file extension than .sh among the general populace.

orra 3y ago
.sh legitimately exists as a TLD because it's a ccTLD. ccTLDs are based on ISO country codes. In contrast, .zip only exists as a TLD because of ICANN money grubbing.

Y_Y 3y ago

I'm still annoyed that ICANN approved .org without sparing a thought for the poor users of emacs org-mode which had been released -18 years earlier!

pantulis 3y ago
Those rascals must use vim!

RunSet 3y ago

I propose that perhaps the problem is not top level domains but rather a certain operating system family's tendency to conflate file name extensions with file types, despite its default setting being "hide file extensions for known file types".

8organicbits 3y ago

The world won't burn, but .sh and .zip are different. If I send an email to my (less technically minded) family I may attach photos.zip. If I mention photos.zip in the body then the mail client may now convert it to a link. If http[://]photos.zip is a malware site, my family may download malware. I may inadvertently link to a malware site by talking about a zip file. I could also send an email with "install.sh" as an attachment, and mention it in the body. http[://]install.sh could be a malware site too. The differences. Non-technical people send, receive, and talk about zip files much more often. .sh was also registered with a clear reason, it's a ccTLD, it's for a country. .zip is just a vanity gTLD. If Zipland was a country, I'd support .zip or ideally .zp. Without a clear purpose and with clear malicious uses, people are just going to block the TLD. Lots of IT folks talking about implementing it on Reddit.

HelloNurse 3y ago
[dead]
dist-epoch 3y ago
Mail clients will quickly be updated to not convert photos.zip to a link. Even if not, you have the regular browser protections against downloading malware which are always active (deny-lists, reputation, scanning, ...). > Without a clear purpose The clear purpose is freedom of expression. Why should TLDs be limited to country codes? Allowing generic TLDs also relieves pressure on .com and brings down domain costs, since now you can have an interesting.space or cool.site
- 8organicbits 3y ago
  > Why should TLDs be limited to country codes? Google also registered .dad, .prof, .phd, .esq, .foo, .mov, and, .nexus. I've seen similar complaints about .mov, but there's no opposition to the others or gTLDs in general. https://www.blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech/ https://www.blog.google/products/registry/8-new-top-level-do... I support freedom of expression through TLDs but there's a meaningful pre-existing use of .zip. It's not clear to me that the value of the TLD outweighs the phishing risk, the malware risk, the cost of software developers preventing x.zip from rendering as a link, etc. It's possible the TLD ends up on a block lists and eventually gets discontinued.