3 ms·

Mail clients will quickly be updated to not convert photos.zip to a link. Even if not, you have the regular browser protections against downloading malware whi

Mail clients will quickly be updated to not convert photos.zip to a link. Even if not, you have the regular browser protections against downloading malware which are always active (deny-lists, reputation, scanning, ...). > Without a clear purpose The clear purpose is freedom of expression. Why should TLDs be limited to country codes? Allowing generic TLDs also relieves pressure on .com and brings down domain costs, since now you can have an interesting.space or cool.site

8organicbits 3y ago
> Why should TLDs be limited to country codes? Google also registered .dad, .prof, .phd, .esq, .foo, .mov, and, .nexus. I've seen similar complaints about .mov, but there's no opposition to the others or gTLDs in general. https://www.blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech/ https://www.blog.google/products/registry/8-new-top-level-do... I support freedom of expression through TLDs but there's a meaningful pre-existing use of .zip. It's not clear to me that the value of the TLD outweighs the phishing risk, the malware risk, the cost of software developers preventing x.zip from rendering as a link, etc. It's possible the TLD ends up on a block lists and eventually gets discontinued.
- WorldMaker 3y ago
  This orthogonally reminds me of the time when there was a massive kerfuffle when Google registered .dev and then included the entire gTLD in Chrome manifests as HSTS [HTTP-Strict-Transport-Security] required (HTTPS only) and that silently broke a lot of company's LANs and developer environments. (To be fair, don't use gTLDs that don't exist in your LANs, that was always a broken thing to do, Google just made it more obvious in that case.) Google has made some interesting choices in the sorts of gTLDs it has registered since it has had the capability to do so.
- dist-epoch 3y ago
  > the phishing risk, the malware risk .app is an extension used on MacOS for app installers. Yet the .app TLD didn't seem to materialize phishing/malware risk since it's 2018 introduction. The exact same arguments were made back then: https://news.ycombinator.com/item?id=16974572 https://news.ycombinator.com/item?id=16974572 https://cash.app/ https://cash.app/
  - 8organicbits 3y ago
    Agreed, the same risk does exist. But .zip already has malicious use, so the comparison is moot. What's different is that normal users of all platforms talk about .zip files, only slightly-technical MacOS users talk about .app. That attack base and opportunity is much smaller. https://news.netcraft.com/archives/2023/05/17/phishing-attacks-already-using-the-zip-tld.html https://news.netcraft.com/archives/2023/05/17/phishing-attac...

8organicbits 3y ago

> Why should TLDs be limited to country codes? Google also registered .dad, .prof, .phd, .esq, .foo, .mov, and, .nexus. I've seen similar complaints about .mov, but there's no opposition to the others or gTLDs in general. https://www.blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech/ https://www.blog.google/products/registry/8-new-top-level-do... I support freedom of expression through TLDs but there's a meaningful pre-existing use of .zip. It's not clear to me that the value of the TLD outweighs the phishing risk, the malware risk, the cost of software developers preventing x.zip from rendering as a link, etc. It's possible the TLD ends up on a block lists and eventually gets discontinued.

WorldMaker 3y ago
This orthogonally reminds me of the time when there was a massive kerfuffle when Google registered .dev and then included the entire gTLD in Chrome manifests as HSTS [HTTP-Strict-Transport-Security] required (HTTPS only) and that silently broke a lot of company's LANs and developer environments. (To be fair, don't use gTLDs that don't exist in your LANs, that was always a broken thing to do, Google just made it more obvious in that case.) Google has made some interesting choices in the sorts of gTLDs it has registered since it has had the capability to do so.
dist-epoch 3y ago
> the phishing risk, the malware risk .app is an extension used on MacOS for app installers. Yet the .app TLD didn't seem to materialize phishing/malware risk since it's 2018 introduction. The exact same arguments were made back then: https://news.ycombinator.com/item?id=16974572 https://news.ycombinator.com/item?id=16974572 https://cash.app/ https://cash.app/
- 8organicbits 3y ago
  Agreed, the same risk does exist. But .zip already has malicious use, so the comparison is moot. What's different is that normal users of all platforms talk about .zip files, only slightly-technical MacOS users talk about .app. That attack base and opportunity is much smaller. https://news.netcraft.com/archives/2023/05/17/phishing-attacks-already-using-the-zip-tld.html https://news.netcraft.com/archives/2023/05/17/phishing-attac...