11 ms·

.io considered harmful

249 points by pantalaimon 3y ago

teddyh 3y ago
I would go further and say this: Never treat foreign ccTLD’s (two-letter domains) as anything you can just register and use a domain in. You should only ever use a ccTLD of your own country or region you actually have your main presence in. Your domain name is often your most secure key to your entire online identity, and you want that to be on as a secure legal footing as possible. Older discussion here: <https://news.ycombinator.com/item?id=32797286#32801880 https://news.ycombinator.com/item?id=32797286#32801880> Disclaimer: I work at a domain name registrar.
- meowface 3y ago
  I know this is good advice, but I simply value vanity TLDs too much to ever stop. I've got all of my projects' domains on absurd gTLDs and I'd never have it any other way. My users enjoy it and so do I.
  - teddyh 3y ago
    One thing to consider is to have your publicly-visible web sites on vanity domain/domains, but all your server infrastructure on a domain in your local stable ccTLD.
    - michaelmior 3y ago
      I recall a HN post within the past few years of an issue with a particular TLD (I think it may have been .io) that resulted in an outage and the conclusion was exactly this. Use whatever nice-looking domain you want for marketing, but stick with something stable for infrastructure.
    - yjftsjthsd-h 3y ago
      Why does it even matter what domain your servers use internally? Most servers I've ever seen were actually using raw IPs, and the few exceptions used an internal DNS system that couldn't have cared less what the internet thought their domain was.
      - organsnyder 3y ago
        Evolving such an infrastructure is incredibly painful. Want to move to a zero-trust security model? How about migrating only some services to a different provider? Set it up right from the start with a domain name you control (or one that is reserved for private use in an RFC). You can still use internal DNS if you want the additional layer of obscurity.
      - teddyh 3y ago
        Personally, I prefer to use the internet as it is and not build up and maintain my own parallell infrastructure.
      - vidarh 3y ago
        Not internally, but API endpoints for customers.
  - gumby 3y ago
    what is vain about having a domain?
    - teddyh 3y ago
      <https://en.wikipedia.org/w/index.php?title=Vanity_domain&oldid=1157988064 https://en.wikipedia.org/w/index.php?title=Vanity_domain&old...>
      - Modified3019 3y ago
        About as useful as calling someone vain because they wear clothes.
        bigstrat2003 3y ago
        "Vanity domain" is based on the common (in US English) term for custom license plates, "vanity plates". Neither is meant to indicate an accusation against the person's character, it's just a figure of speech.
  - NewJazz 3y ago
    Newer / weird gTLDs are not as problematic as ccTLDs in unstable jurisdictions, by any means. If they really are gTLDs, I wouldn't worry.
    - account42 3y ago
      Newer gTLDs can start price gouging you at any time. Don't use them.
- column 3y ago
  what about .me ?
  - teddyh 3y ago
    Are you a citizen of Montenegro? If you are, feel free to use it! Otherwise, I suggest that you use something else.
    - alexvitkov 3y ago
      Hello, I am an official representarive of the Balkan countries. A non-negligable chunk of our GDP is based on random Rust projects using Serbia's .rs and of course .me. If you stop using our TLDs our ecobomies will collapse. Kind regards, The Balkans
      - WesolyKubeczek 3y ago
        Serbians should really let go of the idea they can speak for all Balkan nations. -- Sincerely, Everyone Else
        munk-a 3y ago
        Suddenly Bismark's remark about bad things coming "[...] out of some damned foolish thing in the Balkans" is echoing in my head.
      - benatkin 3y ago
        Fine by me. Old article about how big of an export it is: https://techcrunch.com/2017/01/10/me-10-years-and-two-percent-of-exports/ https://techcrunch.com/2017/01/10/me-10-years-and-two-percen...
    - benatkin 3y ago
      "feel free to use it" I feel free with my .co domain and I'm not a citizen of Colombia TYVM.
- Klaster_1 3y ago
  Not the best advice for authoritarian countries, where you domain can be seized for any reason or subjected to random repressive policies.
  - teddyh 3y ago
    Of course, there are exceptions. In some places, your only viable alternative might be .onion.
- oooyay 3y ago
  > Your domain name is often your most secure key to your entire online identity, and you want that to be on as a secure legal footing as possible. No, it absolutely isn't. Domain names are rented from a TLD registrar, someone who literally just controls a bunch of DNS servers and some automated systems that's approved by and has paid ICANN. They can reject your renewal for any reason and there's nothing you can do about it from an ICANN or court perspective. Worse, what walks in domains is money, which is why registrars can sell "premium" domains that aren't owned for exorbitant prices. Ordering from your own country maybe ups the ante from a civil court perspective if you have money to sue a registrar and the time to go to court for it.
  - agwa 3y ago
    You really don't know what you're talking about. First, you've confused registrars and registries - registrars don't operate DNS servers for TLDs; registries do. This isn't a pedantic point; understanding the distinction is absolutely key for understanding how domain registrations work. Second, registries (for gTLDs) have agreements with ICANN that provide legal protections for domain registrants - including protections against denying renewals or jacking up renewal pricing. You can see the agreements here: https://www.icann.org/en/registry-agreements https://www.icann.org/en/registry-agreements This is not the case with ccTLDs; each ccTLD registry can operate as arbitrarily and capriciously as they want, which is why teddyh's advice to avoid foreign ccTLDs is quite sound.
    - oooyay 3y ago
      > You really don't know what you're talking about. I used the wrong word and suddenly I don't know what I'm talking about, but somehow I know how that system works. ICANN defers to the courts and doesn't differentiate between a registrar and a registry in dispute resolution: https://www.icann.org/resources/pages/help/dndr/udrp-en https://www.icann.org/resources/pages/help/dndr/udrp-en https://www.icann.org/resources/pages/name-holder-faqs-2017-10-10-en https://www.icann.org/resources/pages/name-holder-faqs-2017-...
  - teddyh 3y ago
    > Ordering from your own country maybe ups the ante from a civil court perspective if you have money to sue a registrar and the time to go to court for it. Yes, that’s my point. If your local government and associated court system is completely unworkable for you (corruption, onerous fees, etc.), then some other TLD might be preferable. But a local citizen will almost always have a large advantage in a dispute with some foreign entity. Therefore, you should almost always try to get this advantage by using your local ccTLD.
- preommr 3y ago
  > You should only ever use a ccTLD of your own country or region you actually have your main presence in. Don't do this either. Countries have rules and regulations around who can own certain domains. It's really annoying when there's a million problems to fix and a business restructure potentially affects whether there even has to be a conversation on if it affects the use of a domain name.
  - teddyh 3y ago
    Heaven forbid a tech company should be forced to obey applicable laws and regulations. Those strict regulations are part of your brand; if you register, say, a .de domain, a user can be reasonably sure that you’re not some weird fly-by night operation whose real company name is something else entirely. This is an asset for you.
    - wavemode 3y ago
      As someone who owns a .de domain (for random reasons) and has never even been to Germany, I would argue "reasonably sure" should be more like "hopeful" ...
- thiht 3y ago
  I used to work at a registrar and I completely agree with you. This is exactly my take as well (with a small exception for .eu, just don't use it) For your online identity (ie email address) I'd even go as far as suggesting not using a ccTLD at all, no matter if you check all the boxes. No fancy gTLD either, just use a .com. I don't think any TLD is remotely as reliable as this one (maybe .net because they're both Verisign, but that's it)
  - teddyh 3y ago
    I’d say that it depends on your situation and TLD registry. For argument’s sake, if I was a company in, say, India, would I be able to trust that Verisign would keep my .com or .us domain rights against, say, Google? Probably not, so I’d probably prefer a .in domain in that case, since an Indian authority or registrar would be more amenable to arguments and reasoned discourse with me, an Indian company.
    - thiht 3y ago
      For a company yeah, I would definitely consider the ccTLD. As an individual, not so much
  - ozyschmozy 3y ago
    What's wrong with .eu domains?
    - Fnoord 3y ago
      Nothing, but Brits had to quit their .eu domains due to Brexit. Which seems reasonable to me. Of course, Brexit wasn't; it was manipulated by the Russians.
      - lxgr 3y ago
        Wow, TIL .eu had a residency/domicile requirement! That indeed disqualifies it for many use cases.
- captn3m0 3y ago
  Strong agree. I use my country’s ccTLD as my primary domain, and my domain was stuck in limbo for 6 years where I could not move registrars because the Registry decided to do a hostile takeover of all domains managed by a specific registrar. The lawsuit and arbitration took 4-5 years, and the registry had to apologise in the end. But that limbo was quite scary to deal with, not being able to change my nameserver or renew the domain. I’ve documented it here: https://gist.github.com/captn3m0/3ca2752f1394ef779d0e0bd0e04435fc https://gist.github.com/captn3m0/3ca2752f1394ef779d0e0bd0e04...
- ak217 3y ago
  People look at me like I'm crazy when I suggest that Notion's use of the Somalia TLD is a security concern that should give pause to anyone looking to store confidential data. This includes Notion's own recruiters. I still think that's probably the biggest mistake that company has made. It seems baked in to their architecture now. But I think any company using a vanity domain in this manner is acting irresponsibly. FWIW I don't think the "colonialism" argument makes sense for this or other vanity domains. But the use of vanity ccTLDs is still a huge, underappreciated security concern. Companies willingly expose themselves to the risk of their domain being hijacked (or "legally" taken away) with zero recourse - or worse, putting their government in a situation where they have to choose between trying to intervene or having a bunch of their citizens' data compromised. It betrays a security naivete, oblivious to what state-sponsored APTs out there are capable of once enough is at stake.
- vidarh 3y ago
  24 years ago, my then startup bought about 60,000 domain names. For many.of the TLDs in question it represented the largest chunk of income they'd had. We had about $1m in funding at that stage. Put another way: Many of these TLDs bring in little enough that it'd likely take a really small funding round to go to some of these registries and make them a nice offer to tighten rules so that e.g. all registrants outside the country needs a licensed representative in the country, and convince them to license only you. Price by revenue or number of employees or something and give kickbacks to the right people.
- belorn 3y ago
  I would generalize this into avoiding any TLD which controlling entity does not deserve long term trust. Goverments of other countries are one kind, and I would add to that list companies such as google who could at any day put a gTLD into its graveyard. We have already seen some of the new gTLD that shortly after being created was then abandon by their operator (https://news.ycombinator.com/item?id=17624158 https://news.ycombinator.com/item?id=17624158). .io for example should be considered harmful because their operator Ethos Capita has a history of incompetence, corruption and mismanage. They forgot to renew some of the nameservers for the TLD, allowing security researchers to take partial control of the TLD! They also had major outages like randomly giving NXDOMAIN for long periods, prompting articles like https://hackernoon.com/stop-using-io-domain-names-for-production-traffic-b6aa17eeac20 https://hackernoon.com/stop-using-io-domain-names-for-produc.... Ethos Capita was also the company behind the infamous attempt to buy .org and the associated insider dealing. Registering a domain name is a long term partnership, and the cost of breaking that partnership is usually much more costly than people realize until the point when forced to do it.
- lylo 3y ago
  I anlway prefer using OG .com and .net for business/apps, and .org for personal. These are all general purpose and open for anything. You gotta get creative with the naming though!
mym1990 3y ago
Isn’t funding .uk and .us domains just as bad then, if you’re going by the amount of blood that is on a countries hands(regarding this particular piece of history, or all of it)?
- dwardu 3y ago
  The article is clearly a virtue signal. If the person developing the solution doesnt want to pay for the .io domain, then so be it. They don't have to get the morality into it.
  - zogrodea 3y ago
    Why, if not for the person's morals, would they want to avoid the .io domain? What benefit would they have through that action?
    - otachack 3y ago
      Saving money is another good reason. IO domains are inflated due to popularity, at least last time I checked.
    - mym1990 3y ago
      TLDs can disappear under certain circumstances, so long term there is a small risk of that. Depending on the TLD, it can also be less recognizable or downright fishy to some. .io has become popularized by the tech scene, but without context it is not very descriptive.
  - durkie 3y ago
    how is it a "virtue signal"? what are they signalling? i'm curious where morality fits in to anything in your worldview if telling the (well-documented) history of a forcible displacement of a people is "virtue signalling" and "getting the morality into it".
    - riffic 3y ago
      a signal of competence, by fundamentally understanding how domains work.
jackcviers3 3y ago
Here's a thought -- TLD's shouldn't be coupled to countries at all and should just be a string pointer to an IP address. But that's none of my business...
- riffic 3y ago
  the IETF and ICANN have codified the underlying principles that tie ccTLDs to countries and your "here's a thought" won't do any good to change that.
- mikeocool 3y ago
  Someone's gotta control the list of domains under a TLD and arbitrate who actually owns them and what their name servers are. When that's a private company they are subject to laws of the countries they operate in (and if it's international consortium, whatever country holds the most power within the consortium). I imagine there are a few countries and companies that'd prefer the control of their internet presence not be strictly in the hands of the US government. Though certainly there are folks who don't totally think through whose in control of their domain, see: https://techcrunch.com/2011/04/04/letter-ly-abrupt-ly-loses-domain-name-as-a-result-of-the-war-in-libya/ https://techcrunch.com/2011/04/04/letter-ly-abrupt-ly-loses-...
- innocenat 3y ago
  No, thank you. I like to know that .go(v?).ccTLD are the official website of the government of my country.
- gowld 3y ago
  We lack a single world government. You can make your own TLDs, like the Etherium folks do, but you have to convince other people to trust the name resolvers.
omginternets 3y ago
Wait until you hear about the .de domain.
- linster 3y ago
  What about the .de TLD?
  - jtvjan 3y ago
    It stands for Delgium.
  - jhardy54 3y ago
    What does the D in TLD stand for?
    - jonathankoren 3y ago
      The D is silent
    - Hamuko 3y ago
      DNS.
- riffic 3y ago
  wait until I what about?
  - anononaut 3y ago
    the whole .de
  - omginternets 3y ago
    I'd tell you, but I accidentally a word.
- a3w 3y ago
  So far, no takeover of .pl from .de, and even .fr is not fighting us[1]. Much. [1] Citation: Reddit.
penneallagricia 3y ago
USA and UK performing/supporting ethnic cleansing, nothing new here. Still the story is truly heart breaking to read.
- TimTheTinker 3y ago
  It's heartbreaking, but not entirely true. The UK purchased the archipelago for $3M, a detail that was left out of the article.
  - mrbadguy 3y ago
    Just because money was paid to someone doesn’t make it legitimate. Certainly, even if the purchase were legal, then that doesn’t also confer the right to ethnic cleansing, so it’s kind of a moot point. There was a UN resolution in 2019 that holds that the colonisation of the islands by the UK was illegal. https://press.un.org/en/2019/ga12146.doc.htm https://press.un.org/en/2019/ga12146.doc.htm
thih9 3y ago
I wonder what’s going to happen with https://notion.so https://notion.so > Oof, sorry about this We chose .so when we were starting out (lots of other companies named Notion, and .so was available). Does it help that we own notion.com now? Automatic redirect for now, but we'll be switching to .com as soon as our engineering team has the bandwidth. Source: https://old.reddit.com/r/Notion/comments/f6x9mk/why_the_so_domain/fi8l82f/ https://old.reddit.com/r/Notion/comments/f6x9mk/why_the_so_d... (3 years ago)
- jihadjihad 3y ago
  I never really thought about the fact it was Somalia's TLD, or that it was (seemingly) a random choice because it happened to be available. I always thought it was a play on shared objects (.so files).
  - pingiun 3y ago
    every two letter tld is from some country
  - yrro 3y ago
    FYI: https://en.wikipedia.org/wiki/Country_code_top-level_domain https://en.wikipedia.org/wiki/Country_code_top-level_domain
- ak217 3y ago
  I think Notion was wild to make that choice, and has yet to reap the full consequences of it.
NeoTar 3y ago
Apparently the UK government does not get any income from .io sales: Wikipedia - .io - https://en.wikipedia.org/wiki/.io https://en.wikipedia.org/wiki/.io > In 2014, Kane claimed that "profits are distributed to the authorities for them to operate services as they see fit" and that "Each of the overseas territories has an account and the funds are deposited there because obviously the territories have expenses that they incur and it’s offsetting that." However the UK government has repeatedly stated that this is untrue: “There is no agreement between the UK Government and ICB regarding the administration of the .io domain” and "the Government receives no revenues from the sales or administration of this domain." So, you aren't funding the UK government, just a 'British entrepreneur' who bought the rights to multiple TLDs... I'm not sure that's better, but it's different.
- KomoD 3y ago
  > just a 'British entrepreneur' who bought the rights to multiple TLDs Not anymore, instead an American private equity firm
  - nly 3y ago
    Bloody UK government can't hang on to anything
    - pelagicAustral 3y ago
      > Falkland Islands entered the chat
    - brodouevencode 3y ago
      > the United States entered the chat
      - mardifoufs 3y ago
        Are you from 1775?
    - ethbr1 3y ago
oscribinn 3y ago
[flagged]
KaiserPro 3y ago
The article starts with "everything is FACT" then ends with: Every .io domain you buy funds a government committing crimes against humanity. Every .io domain you renew legitimises and reinforces the continued exile of the Chagossians. which is hyperbole at best, and bollocks at worst. .io isn't sold or owned by the british (or US) government Most people don't understand what .io is for, moreover the UK goverment has almost no idea what .io stands for. so to say that its supporting crimes against humanity is somewhat of a stretch. Thats like saying that watching pakistan play cricket is supporting the deportation of 1.4 million afghan refugees.
- KronisLV 3y ago
  > Every .io domain you renew legitimises and reinforces the continued exile of the Chagossians. The history there is unfortunate (although the history lesson itself is welcome), but at the same time this is akin to saying: you should boycott products and services from the UK/US. If you feel that way, you can try to do that, but I get the feeling that purely logistically that would get pretty difficult to do. Looking at every piece of food you buy at the store, to see where it's from, looking at every website of the companies that you want to do business with. You might lose access to a lot of hardware, appliances and even the majority of the websites out there to make a stand. I get why one might single out the .io domains for symbolic reasons, but at the same time most people probably think of something like I/O and haven't even heard of Chagos Archipelago, ergo there's not a lot of intentional legitimization/reinforcement of any kind going on.
  - ethbr1 3y ago
    Well, the thought process is that cents from every .io registration go to a private equity firm. And none of that money goes to the people who historically lived there and were displaced. So... that's a pretty shitty thing to support (as someone registering a domain), when the alternative is simply "Pick a different TLD." Tbh, ICANN/IANA should either (a) dissolve the TLD as-is, as there is no independent country it covers (and the UK already has one and doesn't want it) or (b) switch it to Chagossian ownership, so they financially benefit. The current situation and ownership is indefensible.
CivBase 3y ago
Let me get this straight... the UK and US did some awful stuff and you're asking us to respond by boycotting a TLD which has no meaningful connection to said awful stuff? Thanks for letting me know about the Chagossian tragedy, but this boycot just sounds silly to me.
varispeed 3y ago
This sounds like someone who couldn't buy their desired .io domain and now sounds bitter about it trying to spoil it for everyone.
- rpigab 3y ago
  It's so wierd how I expected the article to be about something linked to the io TLD, but it's completely unrelated to computers, in fact the article would be way more relevant if it dropped the title and conclusion, because I learned something, but not that some TLDs are considered harmful.
- WorldMaker 3y ago
  It's directly at the bottom of the article: it is someone who could and did buy their desired .io domain and now feel guilty about it, having learned new things about why .io domains are the way they are.
  - varispeed 3y ago
    First world problems...
orliesaurus 3y ago
you could say the same (or similar) about .so domains and funding corruption in a foreign unstable gov
wessorh 3y ago
Bottomless outrage seems to be the outlet for a life unlived, unfulfilled. Do something constructive by ignoring thoughts that beg for influence and abuse logic.
bob1029 3y ago
> For my part, I'm working on migrating all my email from @cariad.io to @cariad.earth. It's a pain, but it's worth it. I use a .io domain for my personal email as well. I did not reach the same conclusion though. Hyperbolic pieces like this make me want to double down even further on whatever it is they are so against.
benrutter 3y ago
Boycotting a TLD is one thing, but does anyone have recommendations for a TLD that they'd recommend? I.E. One where the revenue is likely to have a positive impact somewhere.
revel 3y ago
this fits well with my vision: every website will have unskippable land acknowledgement prompts that list the entire history of that nation
jakub_g 3y ago
Talking about exotic TLDs: An overlooked aspect is that some of them may be way slower to resolve on DNS level: https://blog.nameshield.com/blog/2020/04/30/choosing-the-right-tld-based-on-dns-performance/ https://blog.nameshield.com/blog/2020/04/30/choosing-the-rig... For example .io is about 50ms slower than .com on p50 and p85 percentiles (2020 data). If you have a "serious" domain you may not want it on a "slow" TLD.
IceHegel 3y ago
This is so washed up as a take. Let’s go to mars instead of pouring energy into blaming the British for everything.
- organsnyder 3y ago
  This post is perhaps extreme (I don't know enough about the history to comment), but not only can we both learn from history while looking forward, but we should do so—best to put our most self-aware foot forward as we hope to expand beyond our planet.
  - IceHegel 3y ago
    In agree in the abstract. In practice, we are very over-indexed on these deconstruction type issues by selectively reopening old wounds, often along racial lines, which isn't leading anywhere good, defiantly not to mars.
    - organsnyder 3y ago
      Many of these wounds have never closed for the people affected by them.
      - someidiot123 3y ago
        [dead]
    - deleted 3y ago
      [deleted]
- cool_dude85 3y ago
  No argument, just "old news"? The British did do this. They ethnically cleansed the Chagos islands. Don't like it, argue your point.
  - leadingthenet 3y ago
jmbwell 3y ago
The Wikipedia article captures relevant facts from the blog post, in a tone consistent with Wikipedia's standards, for what that's worth. https://en.wikipedia.org/wiki/.io https://en.wikipedia.org/wiki/.io I admit I never considered the provenance of .io and its geopolitical history. I also use some .me domains that I now think I should have considered more carefully. Reading about it now, I take the original article's point that a geo TLD that seems cute or fun or clever in one culture could have a very different connotation in another culture. It may or may not be an ethics issue, depending on perspective, but that ambiguity might at the very least be an optics issue, since there is a moral question for at least some reasonable observers. It appears that foreign use of these geo TLDs says something one way or another about a site/service/brand, whether that's support for the country or some sort of colonialism or something else altogether.
abhinai 3y ago
Ouch. That was a very sad read. History is full of so many injustices! It’s just sad all round.
efitz 3y ago
The back story makes my blood boil.
andrew_ 3y ago
This has "Pumpkin Spice is Violence" [0] vibes. [0]: https://www.washingtonpost.com/history/2023/10/06/history-pumpkin-spice-colonialsim-dutch/ https://www.washingtonpost.com/history/2023/10/06/history-pu...
yieldcrv 3y ago
Wait till people find out about .af domains Wait till the Taliban finds out how we all use .af domains
nickdothutton 3y ago
Ah yes the Noble Savage trope. It never dies does it?
hnarayanan 3y ago
But it sounds cool, and isn‘t that what counts?
ocdtrekkie 3y ago
It's really convenient that you posted this, because I was going to reference a 2014 article about it in a blog post I am working on, but that article has also fallen off the Internet.
irishgeoff22 3y ago
[dead]
brodouevencode 3y ago
"considered harmful" is considered harmful. It's always an opinion, which is fine, but too many of them are half baked, in my opinion.
- lxgr 3y ago
  We've been there: https://news.ycombinator.com/item?id=9744916 https://news.ycombinator.com/item?id=9744916
greatNespresso 3y ago
Interesting thread! This got me curious about the .ai TLD, and the difference with .io, is that Anguilla Island are actually receiving the profit from every domain sold. And it accounts for a large part of their revenue, around $3 million according to Wikipedia https://en.m.wikipedia.org/wiki/.ai https://en.m.wikipedia.org/wiki/.ai
Bjemslev 3y ago
this read convinced me more that .blog domains are harmful, rather than .io domains...
pedroluis 3y ago
[dead]
pedroluis 3y ago
[dead]
pipeline_peak 3y ago
Don’t care, will continue to use .io
deleted 3y ago
[deleted]
dikaio 3y ago
Garbage article. Do people even read this stuff before upvoting…
weddpros 3y ago
Now I want to put a banner on my .io website to remind visitors of this story

249 points by pantalaimon 3y ago

I would go further and say this: Never treat foreign ccTLD’s (two-letter domains) as anything you can just register and use a domain in. You should only ever use a ccTLD of your own country or region you actually have your main presence in. Your domain name is often your most secure key to your entire online identity, and you want that to be on as a secure legal footing as possible. Older discussion here: <https://news.ycombinator.com/item?id=32797286#32801880 https://news.ycombinator.com/item?id=32797286#32801880> Disclaimer: I work at a domain name registrar.

meowface 3y ago
I know this is good advice, but I simply value vanity TLDs too much to ever stop. I've got all of my projects' domains on absurd gTLDs and I'd never have it any other way. My users enjoy it and so do I.
- teddyh 3y ago
  One thing to consider is to have your publicly-visible web sites on vanity domain/domains, but all your server infrastructure on a domain in your local stable ccTLD.
  - michaelmior 3y ago
    I recall a HN post within the past few years of an issue with a particular TLD (I think it may have been .io) that resulted in an outage and the conclusion was exactly this. Use whatever nice-looking domain you want for marketing, but stick with something stable for infrastructure.
  - yjftsjthsd-h 3y ago
    Why does it even matter what domain your servers use internally? Most servers I've ever seen were actually using raw IPs, and the few exceptions used an internal DNS system that couldn't have cared less what the internet thought their domain was.
    - organsnyder 3y ago
      Evolving such an infrastructure is incredibly painful. Want to move to a zero-trust security model? How about migrating only some services to a different provider? Set it up right from the start with a domain name you control (or one that is reserved for private use in an RFC). You can still use internal DNS if you want the additional layer of obscurity.
    - teddyh 3y ago
      Personally, I prefer to use the internet as it is and not build up and maintain my own parallell infrastructure.
    - vidarh 3y ago
      Not internally, but API endpoints for customers.
- gumby 3y ago
  what is vain about having a domain?
  - teddyh 3y ago
    <https://en.wikipedia.org/w/index.php?title=Vanity_domain&oldid=1157988064 https://en.wikipedia.org/w/index.php?title=Vanity_domain&old...>
    - Modified3019 3y ago
      About as useful as calling someone vain because they wear clothes.
      - bigstrat2003 3y ago
        "Vanity domain" is based on the common (in US English) term for custom license plates, "vanity plates". Neither is meant to indicate an accusation against the person's character, it's just a figure of speech.
- NewJazz 3y ago
  Newer / weird gTLDs are not as problematic as ccTLDs in unstable jurisdictions, by any means. If they really are gTLDs, I wouldn't worry.
  - account42 3y ago
    Newer gTLDs can start price gouging you at any time. Don't use them.
column 3y ago
what about .me ?
- teddyh 3y ago
  Are you a citizen of Montenegro? If you are, feel free to use it! Otherwise, I suggest that you use something else.
  - alexvitkov 3y ago
    Hello, I am an official representarive of the Balkan countries. A non-negligable chunk of our GDP is based on random Rust projects using Serbia's .rs and of course .me. If you stop using our TLDs our ecobomies will collapse. Kind regards, The Balkans
    - WesolyKubeczek 3y ago
      Serbians should really let go of the idea they can speak for all Balkan nations. -- Sincerely, Everyone Else
      - munk-a 3y ago
        Suddenly Bismark's remark about bad things coming "[...] out of some damned foolish thing in the Balkans" is echoing in my head.
    - benatkin 3y ago
      Fine by me. Old article about how big of an export it is: https://techcrunch.com/2017/01/10/me-10-years-and-two-percent-of-exports/ https://techcrunch.com/2017/01/10/me-10-years-and-two-percen...
  - benatkin 3y ago
    "feel free to use it" I feel free with my .co domain and I'm not a citizen of Colombia TYVM.
Klaster_1 3y ago
Not the best advice for authoritarian countries, where you domain can be seized for any reason or subjected to random repressive policies.
- teddyh 3y ago
  Of course, there are exceptions. In some places, your only viable alternative might be .onion.
oooyay 3y ago
> Your domain name is often your most secure key to your entire online identity, and you want that to be on as a secure legal footing as possible. No, it absolutely isn't. Domain names are rented from a TLD registrar, someone who literally just controls a bunch of DNS servers and some automated systems that's approved by and has paid ICANN. They can reject your renewal for any reason and there's nothing you can do about it from an ICANN or court perspective. Worse, what walks in domains is money, which is why registrars can sell "premium" domains that aren't owned for exorbitant prices. Ordering from your own country maybe ups the ante from a civil court perspective if you have money to sue a registrar and the time to go to court for it.
- agwa 3y ago
  You really don't know what you're talking about. First, you've confused registrars and registries - registrars don't operate DNS servers for TLDs; registries do. This isn't a pedantic point; understanding the distinction is absolutely key for understanding how domain registrations work. Second, registries (for gTLDs) have agreements with ICANN that provide legal protections for domain registrants - including protections against denying renewals or jacking up renewal pricing. You can see the agreements here: https://www.icann.org/en/registry-agreements https://www.icann.org/en/registry-agreements This is not the case with ccTLDs; each ccTLD registry can operate as arbitrarily and capriciously as they want, which is why teddyh's advice to avoid foreign ccTLDs is quite sound.
  - oooyay 3y ago
    > You really don't know what you're talking about. I used the wrong word and suddenly I don't know what I'm talking about, but somehow I know how that system works. ICANN defers to the courts and doesn't differentiate between a registrar and a registry in dispute resolution: https://www.icann.org/resources/pages/help/dndr/udrp-en https://www.icann.org/resources/pages/help/dndr/udrp-en https://www.icann.org/resources/pages/name-holder-faqs-2017-10-10-en https://www.icann.org/resources/pages/name-holder-faqs-2017-...
- teddyh 3y ago
  > Ordering from your own country maybe ups the ante from a civil court perspective if you have money to sue a registrar and the time to go to court for it. Yes, that’s my point. If your local government and associated court system is completely unworkable for you (corruption, onerous fees, etc.), then some other TLD might be preferable. But a local citizen will almost always have a large advantage in a dispute with some foreign entity. Therefore, you should almost always try to get this advantage by using your local ccTLD.
preommr 3y ago
> You should only ever use a ccTLD of your own country or region you actually have your main presence in. Don't do this either. Countries have rules and regulations around who can own certain domains. It's really annoying when there's a million problems to fix and a business restructure potentially affects whether there even has to be a conversation on if it affects the use of a domain name.
- teddyh 3y ago
  Heaven forbid a tech company should be forced to obey applicable laws and regulations. Those strict regulations are part of your brand; if you register, say, a .de domain, a user can be reasonably sure that you’re not some weird fly-by night operation whose real company name is something else entirely. This is an asset for you.
  - wavemode 3y ago
    As someone who owns a .de domain (for random reasons) and has never even been to Germany, I would argue "reasonably sure" should be more like "hopeful" ...
thiht 3y ago
I used to work at a registrar and I completely agree with you. This is exactly my take as well (with a small exception for .eu, just don't use it) For your online identity (ie email address) I'd even go as far as suggesting not using a ccTLD at all, no matter if you check all the boxes. No fancy gTLD either, just use a .com. I don't think any TLD is remotely as reliable as this one (maybe .net because they're both Verisign, but that's it)
- teddyh 3y ago
  I’d say that it depends on your situation and TLD registry. For argument’s sake, if I was a company in, say, India, would I be able to trust that Verisign would keep my .com or .us domain rights against, say, Google? Probably not, so I’d probably prefer a .in domain in that case, since an Indian authority or registrar would be more amenable to arguments and reasoned discourse with me, an Indian company.
  - thiht 3y ago
    For a company yeah, I would definitely consider the ccTLD. As an individual, not so much
- ozyschmozy 3y ago
  What's wrong with .eu domains?
  - Fnoord 3y ago
    Nothing, but Brits had to quit their .eu domains due to Brexit. Which seems reasonable to me. Of course, Brexit wasn't; it was manipulated by the Russians.
    - lxgr 3y ago
      Wow, TIL .eu had a residency/domicile requirement! That indeed disqualifies it for many use cases.
captn3m0 3y ago
Strong agree. I use my country’s ccTLD as my primary domain, and my domain was stuck in limbo for 6 years where I could not move registrars because the Registry decided to do a hostile takeover of all domains managed by a specific registrar. The lawsuit and arbitration took 4-5 years, and the registry had to apologise in the end. But that limbo was quite scary to deal with, not being able to change my nameserver or renew the domain. I’ve documented it here: https://gist.github.com/captn3m0/3ca2752f1394ef779d0e0bd0e04435fc https://gist.github.com/captn3m0/3ca2752f1394ef779d0e0bd0e04...
ak217 3y ago
People look at me like I'm crazy when I suggest that Notion's use of the Somalia TLD is a security concern that should give pause to anyone looking to store confidential data. This includes Notion's own recruiters. I still think that's probably the biggest mistake that company has made. It seems baked in to their architecture now. But I think any company using a vanity domain in this manner is acting irresponsibly. FWIW I don't think the "colonialism" argument makes sense for this or other vanity domains. But the use of vanity ccTLDs is still a huge, underappreciated security concern. Companies willingly expose themselves to the risk of their domain being hijacked (or "legally" taken away) with zero recourse - or worse, putting their government in a situation where they have to choose between trying to intervene or having a bunch of their citizens' data compromised. It betrays a security naivete, oblivious to what state-sponsored APTs out there are capable of once enough is at stake.
vidarh 3y ago
24 years ago, my then startup bought about 60,000 domain names. For many.of the TLDs in question it represented the largest chunk of income they'd had. We had about $1m in funding at that stage. Put another way: Many of these TLDs bring in little enough that it'd likely take a really small funding round to go to some of these registries and make them a nice offer to tighten rules so that e.g. all registrants outside the country needs a licensed representative in the country, and convince them to license only you. Price by revenue or number of employees or something and give kickbacks to the right people.
belorn 3y ago
I would generalize this into avoiding any TLD which controlling entity does not deserve long term trust. Goverments of other countries are one kind, and I would add to that list companies such as google who could at any day put a gTLD into its graveyard. We have already seen some of the new gTLD that shortly after being created was then abandon by their operator (https://news.ycombinator.com/item?id=17624158 https://news.ycombinator.com/item?id=17624158). .io for example should be considered harmful because their operator Ethos Capita has a history of incompetence, corruption and mismanage. They forgot to renew some of the nameservers for the TLD, allowing security researchers to take partial control of the TLD! They also had major outages like randomly giving NXDOMAIN for long periods, prompting articles like https://hackernoon.com/stop-using-io-domain-names-for-production-traffic-b6aa17eeac20 https://hackernoon.com/stop-using-io-domain-names-for-produc.... Ethos Capita was also the company behind the infamous attempt to buy .org and the associated insider dealing. Registering a domain name is a long term partnership, and the cost of breaking that partnership is usually much more costly than people realize until the point when forced to do it.
lylo 3y ago
I anlway prefer using OG .com and .net for business/apps, and .org for personal. These are all general purpose and open for anything. You gotta get creative with the naming though!

mym1990 3y ago

Isn’t funding .uk and .us domains just as bad then, if you’re going by the amount of blood that is on a countries hands(regarding this particular piece of history, or all of it)?

dwardu 3y ago
The article is clearly a virtue signal. If the person developing the solution doesnt want to pay for the .io domain, then so be it. They don't have to get the morality into it.
- zogrodea 3y ago
  Why, if not for the person's morals, would they want to avoid the .io domain? What benefit would they have through that action?
  - otachack 3y ago
    Saving money is another good reason. IO domains are inflated due to popularity, at least last time I checked.
  - mym1990 3y ago
    TLDs can disappear under certain circumstances, so long term there is a small risk of that. Depending on the TLD, it can also be less recognizable or downright fishy to some. .io has become popularized by the tech scene, but without context it is not very descriptive.
- durkie 3y ago
  how is it a "virtue signal"? what are they signalling? i'm curious where morality fits in to anything in your worldview if telling the (well-documented) history of a forcible displacement of a people is "virtue signalling" and "getting the morality into it".
  - riffic 3y ago
    a signal of competence, by fundamentally understanding how domains work.

jackcviers3 3y ago

Here's a thought -- TLD's shouldn't be coupled to countries at all and should just be a string pointer to an IP address. But that's none of my business...

riffic 3y ago
the IETF and ICANN have codified the underlying principles that tie ccTLDs to countries and your "here's a thought" won't do any good to change that.
mikeocool 3y ago
Someone's gotta control the list of domains under a TLD and arbitrate who actually owns them and what their name servers are. When that's a private company they are subject to laws of the countries they operate in (and if it's international consortium, whatever country holds the most power within the consortium). I imagine there are a few countries and companies that'd prefer the control of their internet presence not be strictly in the hands of the US government. Though certainly there are folks who don't totally think through whose in control of their domain, see: https://techcrunch.com/2011/04/04/letter-ly-abrupt-ly-loses-domain-name-as-a-result-of-the-war-in-libya/ https://techcrunch.com/2011/04/04/letter-ly-abrupt-ly-loses-...
innocenat 3y ago
No, thank you. I like to know that .go(v?).ccTLD are the official website of the government of my country.
gowld 3y ago
We lack a single world government. You can make your own TLDs, like the Etherium folks do, but you have to convince other people to trust the name resolvers.

omginternets 3y ago

Wait until you hear about the .de domain.

linster 3y ago
What about the .de TLD?
- jtvjan 3y ago
  It stands for Delgium.
- jhardy54 3y ago
  What does the D in TLD stand for?
  - jonathankoren 3y ago
    The D is silent
  - Hamuko 3y ago
    DNS.
riffic 3y ago
wait until I what about?
- anononaut 3y ago
  the whole .de
- omginternets 3y ago
  I'd tell you, but I accidentally a word.
a3w 3y ago
So far, no takeover of .pl from .de, and even .fr is not fighting us[1]. Much. [1] Citation: Reddit.

penneallagricia 3y ago

USA and UK performing/supporting ethnic cleansing, nothing new here. Still the story is truly heart breaking to read.

TimTheTinker 3y ago
It's heartbreaking, but not entirely true. The UK purchased the archipelago for $3M, a detail that was left out of the article.
- mrbadguy 3y ago
  Just because money was paid to someone doesn’t make it legitimate. Certainly, even if the purchase were legal, then that doesn’t also confer the right to ethnic cleansing, so it’s kind of a moot point. There was a UN resolution in 2019 that holds that the colonisation of the islands by the UK was illegal. https://press.un.org/en/2019/ga12146.doc.htm https://press.un.org/en/2019/ga12146.doc.htm

thih9 3y ago

I wonder what’s going to happen with https://notion.so https://notion.so > Oof, sorry about this We chose .so when we were starting out (lots of other companies named Notion, and .so was available). Does it help that we own notion.com now? Automatic redirect for now, but we'll be switching to .com as soon as our engineering team has the bandwidth. Source: https://old.reddit.com/r/Notion/comments/f6x9mk/why_the_so_domain/fi8l82f/ https://old.reddit.com/r/Notion/comments/f6x9mk/why_the_so_d... (3 years ago)

jihadjihad 3y ago
I never really thought about the fact it was Somalia's TLD, or that it was (seemingly) a random choice because it happened to be available. I always thought it was a play on shared objects (.so files).
- pingiun 3y ago
  every two letter tld is from some country
- yrro 3y ago
  FYI: https://en.wikipedia.org/wiki/Country_code_top-level_domain https://en.wikipedia.org/wiki/Country_code_top-level_domain
ak217 3y ago
I think Notion was wild to make that choice, and has yet to reap the full consequences of it.

NeoTar 3y ago

Apparently the UK government does not get any income from .io sales: Wikipedia - .io - https://en.wikipedia.org/wiki/.io https://en.wikipedia.org/wiki/.io > In 2014, Kane claimed that "profits are distributed to the authorities for them to operate services as they see fit" and that "Each of the overseas territories has an account and the funds are deposited there because obviously the territories have expenses that they incur and it’s offsetting that." However the UK government has repeatedly stated that this is untrue: “There is no agreement between the UK Government and ICB regarding the administration of the .io domain” and "the Government receives no revenues from the sales or administration of this domain." So, you aren't funding the UK government, just a 'British entrepreneur' who bought the rights to multiple TLDs... I'm not sure that's better, but it's different.

KomoD 3y ago
> just a 'British entrepreneur' who bought the rights to multiple TLDs Not anymore, instead an American private equity firm
- nly 3y ago
  Bloody UK government can't hang on to anything
  - pelagicAustral 3y ago
    > Falkland Islands entered the chat
  - brodouevencode 3y ago
    > the United States entered the chat
    - mardifoufs 3y ago
      Are you from 1775?
  - ethbr1 3y ago

oscribinn 3y ago

[flagged]

KaiserPro 3y ago

The article starts with "everything is FACT" then ends with: Every .io domain you buy funds a government committing crimes against humanity. Every .io domain you renew legitimises and reinforces the continued exile of the Chagossians. which is hyperbole at best, and bollocks at worst. .io isn't sold or owned by the british (or US) government Most people don't understand what .io is for, moreover the UK goverment has almost no idea what .io stands for. so to say that its supporting crimes against humanity is somewhat of a stretch. Thats like saying that watching pakistan play cricket is supporting the deportation of 1.4 million afghan refugees.

KronisLV 3y ago
> Every .io domain you renew legitimises and reinforces the continued exile of the Chagossians. The history there is unfortunate (although the history lesson itself is welcome), but at the same time this is akin to saying: you should boycott products and services from the UK/US. If you feel that way, you can try to do that, but I get the feeling that purely logistically that would get pretty difficult to do. Looking at every piece of food you buy at the store, to see where it's from, looking at every website of the companies that you want to do business with. You might lose access to a lot of hardware, appliances and even the majority of the websites out there to make a stand. I get why one might single out the .io domains for symbolic reasons, but at the same time most people probably think of something like I/O and haven't even heard of Chagos Archipelago, ergo there's not a lot of intentional legitimization/reinforcement of any kind going on.
- ethbr1 3y ago
  Well, the thought process is that cents from every .io registration go to a private equity firm. And none of that money goes to the people who historically lived there and were displaced. So... that's a pretty shitty thing to support (as someone registering a domain), when the alternative is simply "Pick a different TLD." Tbh, ICANN/IANA should either (a) dissolve the TLD as-is, as there is no independent country it covers (and the UK already has one and doesn't want it) or (b) switch it to Chagossian ownership, so they financially benefit. The current situation and ownership is indefensible.

CivBase 3y ago

Let me get this straight... the UK and US did some awful stuff and you're asking us to respond by boycotting a TLD which has no meaningful connection to said awful stuff? Thanks for letting me know about the Chagossian tragedy, but this boycot just sounds silly to me.

varispeed 3y ago

This sounds like someone who couldn't buy their desired .io domain and now sounds bitter about it trying to spoil it for everyone.

rpigab 3y ago
It's so wierd how I expected the article to be about something linked to the io TLD, but it's completely unrelated to computers, in fact the article would be way more relevant if it dropped the title and conclusion, because I learned something, but not that some TLDs are considered harmful.
WorldMaker 3y ago
It's directly at the bottom of the article: it is someone who could and did buy their desired .io domain and now feel guilty about it, having learned new things about why .io domains are the way they are.
- varispeed 3y ago
  First world problems...

orliesaurus 3y ago

you could say the same (or similar) about .so domains and funding corruption in a foreign unstable gov

wessorh 3y ago

Bottomless outrage seems to be the outlet for a life unlived, unfulfilled. Do something constructive by ignoring thoughts that beg for influence and abuse logic.

bob1029 3y ago

> For my part, I'm working on migrating all my email from @cariad.io to @cariad.earth. It's a pain, but it's worth it. I use a .io domain for my personal email as well. I did not reach the same conclusion though. Hyperbolic pieces like this make me want to double down even further on whatever it is they are so against.

benrutter 3y ago

Boycotting a TLD is one thing, but does anyone have recommendations for a TLD that they'd recommend? I.E. One where the revenue is likely to have a positive impact somewhere.

revel 3y ago

this fits well with my vision: every website will have unskippable land acknowledgement prompts that list the entire history of that nation

jakub_g 3y ago

Talking about exotic TLDs: An overlooked aspect is that some of them may be way slower to resolve on DNS level: https://blog.nameshield.com/blog/2020/04/30/choosing-the-right-tld-based-on-dns-performance/ https://blog.nameshield.com/blog/2020/04/30/choosing-the-rig... For example .io is about 50ms slower than .com on p50 and p85 percentiles (2020 data). If you have a "serious" domain you may not want it on a "slow" TLD.

IceHegel 3y ago

This is so washed up as a take. Let’s go to mars instead of pouring energy into blaming the British for everything.

organsnyder 3y ago
This post is perhaps extreme (I don't know enough about the history to comment), but not only can we both learn from history while looking forward, but we should do so—best to put our most self-aware foot forward as we hope to expand beyond our planet.
- IceHegel 3y ago
  In agree in the abstract. In practice, we are very over-indexed on these deconstruction type issues by selectively reopening old wounds, often along racial lines, which isn't leading anywhere good, defiantly not to mars.
  - organsnyder 3y ago
    Many of these wounds have never closed for the people affected by them.
    - someidiot123 3y ago
      [dead]
  - deleted 3y ago
    [deleted]
cool_dude85 3y ago
No argument, just "old news"? The British did do this. They ethnically cleansed the Chagos islands. Don't like it, argue your point.
- leadingthenet 3y ago

jmbwell 3y ago

The Wikipedia article captures relevant facts from the blog post, in a tone consistent with Wikipedia's standards, for what that's worth. https://en.wikipedia.org/wiki/.io https://en.wikipedia.org/wiki/.io I admit I never considered the provenance of .io and its geopolitical history. I also use some .me domains that I now think I should have considered more carefully. Reading about it now, I take the original article's point that a geo TLD that seems cute or fun or clever in one culture could have a very different connotation in another culture. It may or may not be an ethics issue, depending on perspective, but that ambiguity might at the very least be an optics issue, since there is a moral question for at least some reasonable observers. It appears that foreign use of these geo TLDs says something one way or another about a site/service/brand, whether that's support for the country or some sort of colonialism or something else altogether.

abhinai 3y ago

Ouch. That was a very sad read. History is full of so many injustices! It’s just sad all round.

efitz 3y ago

The back story makes my blood boil.

andrew_ 3y ago

This has "Pumpkin Spice is Violence" [0] vibes. [0]: https://www.washingtonpost.com/history/2023/10/06/history-pumpkin-spice-colonialsim-dutch/ https://www.washingtonpost.com/history/2023/10/06/history-pu...

yieldcrv 3y ago

Wait till people find out about .af domains Wait till the Taliban finds out how we all use .af domains

nickdothutton 3y ago

Ah yes the Noble Savage trope. It never dies does it?

hnarayanan 3y ago

But it sounds cool, and isn‘t that what counts?

ocdtrekkie 3y ago

It's really convenient that you posted this, because I was going to reference a 2014 article about it in a blog post I am working on, but that article has also fallen off the Internet.

irishgeoff22 3y ago

[dead]

brodouevencode 3y ago

"considered harmful" is considered harmful. It's always an opinion, which is fine, but too many of them are half baked, in my opinion.

lxgr 3y ago
We've been there: https://news.ycombinator.com/item?id=9744916 https://news.ycombinator.com/item?id=9744916

greatNespresso 3y ago

Interesting thread! This got me curious about the .ai TLD, and the difference with .io, is that Anguilla Island are actually receiving the profit from every domain sold. And it accounts for a large part of their revenue, around $3 million according to Wikipedia https://en.m.wikipedia.org/wiki/.ai https://en.m.wikipedia.org/wiki/.ai

Bjemslev 3y ago

this read convinced me more that .blog domains are harmful, rather than .io domains...

pedroluis 3y ago

[dead]

pedroluis 3y ago

[dead]

pipeline_peak 3y ago

Don’t care, will continue to use .io

deleted 3y ago

[deleted]

dikaio 3y ago

Garbage article. Do people even read this stuff before upvoting…

weddpros 3y ago

Now I want to put a banner on my .io website to remind visitors of this story