4 ms·

The world won't burn, but .sh and .zip are different. If I send an email to my (less technically minded) family I may attach photos.zip. If I mention photos.zi

The world won't burn, but .sh and .zip are different. If I send an email to my (less technically minded) family I may attach photos.zip. If I mention photos.zip in the body then the mail client may now convert it to a link. If http[://]photos.zip is a malware site, my family may download malware. I may inadvertently link to a malware site by talking about a zip file. I could also send an email with "install.sh" as an attachment, and mention it in the body. http[://]install.sh could be a malware site too. The differences. Non-technical people send, receive, and talk about zip files much more often. .sh was also registered with a clear reason, it's a ccTLD, it's for a country. .zip is just a vanity gTLD. If Zipland was a country, I'd support .zip or ideally .zp. Without a clear purpose and with clear malicious uses, people are just going to block the TLD. Lots of IT folks talking about implementing it on Reddit.

HelloNurse 3y ago
[dead]
dist-epoch 3y ago
Mail clients will quickly be updated to not convert photos.zip to a link. Even if not, you have the regular browser protections against downloading malware which are always active (deny-lists, reputation, scanning, ...). > Without a clear purpose The clear purpose is freedom of expression. Why should TLDs be limited to country codes? Allowing generic TLDs also relieves pressure on .com and brings down domain costs, since now you can have an interesting.space or cool.site
- 8organicbits 3y ago
  > Why should TLDs be limited to country codes? Google also registered .dad, .prof, .phd, .esq, .foo, .mov, and, .nexus. I've seen similar complaints about .mov, but there's no opposition to the others or gTLDs in general. https://www.blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech/ https://www.blog.google/products/registry/8-new-top-level-do... I support freedom of expression through TLDs but there's a meaningful pre-existing use of .zip. It's not clear to me that the value of the TLD outweighs the phishing risk, the malware risk, the cost of software developers preventing x.zip from rendering as a link, etc. It's possible the TLD ends up on a block lists and eventually gets discontinued.
  - WorldMaker 3y ago
    This orthogonally reminds me of the time when there was a massive kerfuffle when Google registered .dev and then included the entire gTLD in Chrome manifests as HSTS [HTTP-Strict-Transport-Security] required (HTTPS only) and that silently broke a lot of company's LANs and developer environments. (To be fair, don't use gTLDs that don't exist in your LANs, that was always a broken thing to do, Google just made it more obvious in that case.) Google has made some interesting choices in the sorts of gTLDs it has registered since it has had the capability to do so.
  - dist-epoch 3y ago
    > the phishing risk, the malware risk .app is an extension used on MacOS for app installers. Yet the .app TLD didn't seem to materialize phishing/malware risk since it's 2018 introduction. The exact same arguments were made back then: https://news.ycombinator.com/item?id=16974572 https://news.ycombinator.com/item?id=16974572 https://cash.app/ https://cash.app/
    - 8organicbits 3y ago
      Agreed, the same risk does exist. But .zip already has malicious use, so the comparison is moot. What's different is that normal users of all platforms talk about .zip files, only slightly-technical MacOS users talk about .app. That attack base and opportunity is much smaller. https://news.netcraft.com/archives/2023/05/17/phishing-attacks-already-using-the-zip-tld.html https://news.netcraft.com/archives/2023/05/17/phishing-attac...

HelloNurse 3y ago

[dead]

dist-epoch 3y ago

Mail clients will quickly be updated to not convert photos.zip to a link. Even if not, you have the regular browser protections against downloading malware which are always active (deny-lists, reputation, scanning, ...). > Without a clear purpose The clear purpose is freedom of expression. Why should TLDs be limited to country codes? Allowing generic TLDs also relieves pressure on .com and brings down domain costs, since now you can have an interesting.space or cool.site

8organicbits 3y ago
> Why should TLDs be limited to country codes? Google also registered .dad, .prof, .phd, .esq, .foo, .mov, and, .nexus. I've seen similar complaints about .mov, but there's no opposition to the others or gTLDs in general. https://www.blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech/ https://www.blog.google/products/registry/8-new-top-level-do... I support freedom of expression through TLDs but there's a meaningful pre-existing use of .zip. It's not clear to me that the value of the TLD outweighs the phishing risk, the malware risk, the cost of software developers preventing x.zip from rendering as a link, etc. It's possible the TLD ends up on a block lists and eventually gets discontinued.
- WorldMaker 3y ago
  This orthogonally reminds me of the time when there was a massive kerfuffle when Google registered .dev and then included the entire gTLD in Chrome manifests as HSTS [HTTP-Strict-Transport-Security] required (HTTPS only) and that silently broke a lot of company's LANs and developer environments. (To be fair, don't use gTLDs that don't exist in your LANs, that was always a broken thing to do, Google just made it more obvious in that case.) Google has made some interesting choices in the sorts of gTLDs it has registered since it has had the capability to do so.
- dist-epoch 3y ago
  > the phishing risk, the malware risk .app is an extension used on MacOS for app installers. Yet the .app TLD didn't seem to materialize phishing/malware risk since it's 2018 introduction. The exact same arguments were made back then: https://news.ycombinator.com/item?id=16974572 https://news.ycombinator.com/item?id=16974572 https://cash.app/ https://cash.app/
  - 8organicbits 3y ago
    Agreed, the same risk does exist. But .zip already has malicious use, so the comparison is moot. What's different is that normal users of all platforms talk about .zip files, only slightly-technical MacOS users talk about .app. That attack base and opportunity is much smaller. https://news.netcraft.com/archives/2023/05/17/phishing-attacks-already-using-the-zip-tld.html https://news.netcraft.com/archives/2023/05/17/phishing-attac...