4 ms·

New ZIP domains spark debate among cybersecurity experts

25 points by mikece 3y ago

carolinahoward 3y ago
[dead]
mikecoles 3y ago
Why doesn't .com have the same effect? It was a common extension in DOS/Windows years back. I haven't been on those operating systems in decades so has it has been fully replaced by .exe?
- spicybright 3y ago
  It's been completely replaced with .exe since 16-bit computers became common.
  - postalrat 3y ago
    Another comment says Windows still has some. Are they wrong or are you wrong?
    - Delk 3y ago
      At work and not on Windows at the moment, but AFAIK there are some command-line tools that are still named .com to avoid breaking batch files etc. that might call them by full name. They're actually PE executables or whatever, so they're .com in name only. There's probably little potential for confusion with the domain, though, considering that people without significant experience probably never encounter those com executables in the first place and wouldn't even know they exist. Even people who do know enough have to ask if they're even named that way anymore. Edit: Also 16-bit processors weren't the point where com executables became replaced. PCs have been at least 16-bit since the beginning (8086) and actual com executables were still a thing.
- scrapheap 3y ago
  I've had a quick look at a Windows 10 install and while there are still some .com files in there, they all appear to actually be the modern Portable Executable format. This makes sense given the old .com format was really just a binary blob that would be loaded into a single 64k memory segment. Keeping backwards compatibility for running them on modern 64bit processors would be difficult. At the same time Microsoft wouldn't want to break people's batch files if it can be avoided. By replacing the .com file's contents with logically equivalent code in a more modern executable format they can keep those batch files running without having to actually support legacy .com executable format. (note, that's all guesswork, Microsoft could have had a different reasons for doing it :) )
- pixl97 3y ago
  There are a massive number of windows applications that end up with special consideration around .com, and any potentially executable content like .exe, .cpl, .scr and others. Also, .com tld was created around 4 years before the word cybersecurity was coined. So you have really old stuff that was created before the vast majority of modern internet software was written and that ecosystem grew up with the expectation and quirks of the behaviors of the tld. Simply put when .com files were common, internet users were far less common, and generally more experienced computer users, and the number of bad actors was far lower. Way back in the IE3/4/5 days visiting a .com website would commonly leave files with a .com extension in your temporary internet files with random non executable content inside the files, which made anti-virus really happy. Microsoft went about hiding the temporary internet files in more convoluted fashion over time also so the end user would not stumble upon it. Now with the .zip domain, we're getting back into new and fun issues with file:// vs https:// https:// context.
- jahsome 3y ago
  Twitter didn't exist. There was no echo chamber of fear mongering.
rpaddock 3y ago
The popular file archiver 7-Zip has already moved in at "seven.zip".
- jwilk 3y ago
  https://news.ycombinator.com/item?id=35987157 https://news.ycombinator.com/item?id=35987157
spicybright 3y ago
The most important part of the article is at the bottom, google's response when questioned about it: > "The risk of confusion between domain names and file names is not a new one. For example, 3M’s Command products use the domain name command.com, which is also an important program on MS DOS and early versions of Windows. Applications have mitigations for this (such as Google Safe Browsing), and these mitigations will hold true for TLD’s such as .zip. > At the same time, new namespaces provide expanded opportunities for naming such as community.zip and url.zip. Google takes phishing and malware seriously and Google Registry has existing mechanisms to suspend or remove malicious domains across all of our TLDs, including .zip. We will continue to monitor the usage of .zip and other TLDs and if new threats emerge we will take appropriate action to protect users." - Google. Good thing google never gets any of this stuff wrong, and has a great appeal process for people flagged in error /s
- pixl97 3y ago
  "It's not new, it's caused a lot of problems, and we're going to make it worse" What's really stupid about this is a huge number email systems just outright block things like .com and .exe attachments of any kind to avoid direct executable content. Zip content is generally allowed, but typically scanned. Well, not to maximize user confusion we're adding a new context to one of the most common file extensions in email and downloads there is. Yay Google, thank you very much.
  - thesneakin 3y ago
    As a millennial user, wth is a file extension? What's a directory?
aaron695 3y ago
[dead]
ChrisArchitect 3y ago
All of us 'olds' are freaking out naturally but what good are these TLDs anyhow? Zip is useful for what, a few brands where it aligns but it means nothing to many as a word....especially non-english speakers? What is it - a Batman fight sound? Fwack! Biff! Pow! Aieeee! Some of these TLDs are such a cashgrab and so useless. And then there's the fact that the younger generation has such little experience with filesystems and files due also to default hidden file extensions in Windows etc, they wouldn't even know what zip was .... Ends up just down to the browser/OS to block malicious downloads etc if the domains are clicked.
- acdha 3y ago
  > Some of these TLDs are such a cashgrab and so useless. I think this is the primary reason why this is getting so much negativity: it’s something a bunch of people in the internet community will need to spend time thinking about but is mostly an exercise in collecting rent from a handful of companies like 7-Zip and WinZip.
jwilk 3y ago
Previously: https://news.ycombinator.com/item?id=35927509 https://news.ycombinator.com/item?id=35927509 ("The new .zip TLD is going to cause some problems", 80 comments) https://news.ycombinator.com/item?id=35917362 https://news.ycombinator.com/item?id=35917362 (".zip is now available as a TLD", >90 comments) https://news.ycombinator.com/item?id=35920336 https://news.ycombinator.com/item?id=35920336 ("The .zip TLD sucks", >300 comments)

25 points by mikece 3y ago

[dead]

Why doesn't .com have the same effect? It was a common extension in DOS/Windows years back. I haven't been on those operating systems in decades so has it has been fully replaced by .exe?

spicybright 3y ago
It's been completely replaced with .exe since 16-bit computers became common.
- postalrat 3y ago
  Another comment says Windows still has some. Are they wrong or are you wrong?
  - Delk 3y ago
    At work and not on Windows at the moment, but AFAIK there are some command-line tools that are still named .com to avoid breaking batch files etc. that might call them by full name. They're actually PE executables or whatever, so they're .com in name only. There's probably little potential for confusion with the domain, though, considering that people without significant experience probably never encounter those com executables in the first place and wouldn't even know they exist. Even people who do know enough have to ask if they're even named that way anymore. Edit: Also 16-bit processors weren't the point where com executables became replaced. PCs have been at least 16-bit since the beginning (8086) and actual com executables were still a thing.
scrapheap 3y ago
I've had a quick look at a Windows 10 install and while there are still some .com files in there, they all appear to actually be the modern Portable Executable format. This makes sense given the old .com format was really just a binary blob that would be loaded into a single 64k memory segment. Keeping backwards compatibility for running them on modern 64bit processors would be difficult. At the same time Microsoft wouldn't want to break people's batch files if it can be avoided. By replacing the .com file's contents with logically equivalent code in a more modern executable format they can keep those batch files running without having to actually support legacy .com executable format. (note, that's all guesswork, Microsoft could have had a different reasons for doing it :) )
pixl97 3y ago
There are a massive number of windows applications that end up with special consideration around .com, and any potentially executable content like .exe, .cpl, .scr and others. Also, .com tld was created around 4 years before the word cybersecurity was coined. So you have really old stuff that was created before the vast majority of modern internet software was written and that ecosystem grew up with the expectation and quirks of the behaviors of the tld. Simply put when .com files were common, internet users were far less common, and generally more experienced computer users, and the number of bad actors was far lower. Way back in the IE3/4/5 days visiting a .com website would commonly leave files with a .com extension in your temporary internet files with random non executable content inside the files, which made anti-virus really happy. Microsoft went about hiding the temporary internet files in more convoluted fashion over time also so the end user would not stumble upon it. Now with the .zip domain, we're getting back into new and fun issues with file:// vs https:// https:// context.
jahsome 3y ago
Twitter didn't exist. There was no echo chamber of fear mongering.

rpaddock 3y ago

The popular file archiver 7-Zip has already moved in at "seven.zip".

jwilk 3y ago
https://news.ycombinator.com/item?id=35987157 https://news.ycombinator.com/item?id=35987157

spicybright 3y ago

The most important part of the article is at the bottom, google's response when questioned about it: > "The risk of confusion between domain names and file names is not a new one. For example, 3M’s Command products use the domain name command.com, which is also an important program on MS DOS and early versions of Windows. Applications have mitigations for this (such as Google Safe Browsing), and these mitigations will hold true for TLD’s such as .zip. > At the same time, new namespaces provide expanded opportunities for naming such as community.zip and url.zip. Google takes phishing and malware seriously and Google Registry has existing mechanisms to suspend or remove malicious domains across all of our TLDs, including .zip. We will continue to monitor the usage of .zip and other TLDs and if new threats emerge we will take appropriate action to protect users." - Google. Good thing google never gets any of this stuff wrong, and has a great appeal process for people flagged in error /s

pixl97 3y ago
"It's not new, it's caused a lot of problems, and we're going to make it worse" What's really stupid about this is a huge number email systems just outright block things like .com and .exe attachments of any kind to avoid direct executable content. Zip content is generally allowed, but typically scanned. Well, not to maximize user confusion we're adding a new context to one of the most common file extensions in email and downloads there is. Yay Google, thank you very much.
- thesneakin 3y ago
  As a millennial user, wth is a file extension? What's a directory?

aaron695 3y ago

[dead]

ChrisArchitect 3y ago

All of us 'olds' are freaking out naturally but what good are these TLDs anyhow? Zip is useful for what, a few brands where it aligns but it means nothing to many as a word....especially non-english speakers? What is it - a Batman fight sound? Fwack! Biff! Pow! Aieeee! Some of these TLDs are such a cashgrab and so useless. And then there's the fact that the younger generation has such little experience with filesystems and files due also to default hidden file extensions in Windows etc, they wouldn't even know what zip was .... Ends up just down to the browser/OS to block malicious downloads etc if the domains are clicked.

acdha 3y ago
> Some of these TLDs are such a cashgrab and so useless. I think this is the primary reason why this is getting so much negativity: it’s something a bunch of people in the internet community will need to spend time thinking about but is mostly an exercise in collecting rent from a handful of companies like 7-Zip and WinZip.

jwilk 3y ago

Previously: https://news.ycombinator.com/item?id=35927509 https://news.ycombinator.com/item?id=35927509 ("The new .zip TLD is going to cause some problems", 80 comments) https://news.ycombinator.com/item?id=35917362 https://news.ycombinator.com/item?id=35917362 (".zip is now available as a TLD", >90 comments) https://news.ycombinator.com/item?id=35920336 https://news.ycombinator.com/item?id=35920336 ("The .zip TLD sucks", >300 comments)