4 ms·

> I suspect that IANA would prioritise not breaking millions of domain names over trying to police ccTLDs. I'm surprised this wouldn't be the default behavior

> I suspect that IANA would prioritise not breaking millions of domain names over trying to police ccTLDs. I'm surprised this wouldn't be the default behavior for existing owners? Kinda making me re-think buying an IO domain for my personal stuff. Are gTLDs the safest option?

drpossum 2y ago
You should always be aware of political risks when buying a ccTLD. There's precedent that these have caused serious issues for domain holders, one notable example https://www.theverge.com/2024/2/12/24071036/queer-af-mastodon-taliban-shut-down-afghanistan https://www.theverge.com/2024/2/12/24071036/queer-af-mastodo...
- Avamander 2y ago
  Outages and poor management are one possibility. Other is the fact that you have to trust the country running the ccTLD with DNSSEC keys. This might rule out things like using TLSA/DANE or SSHFP records.
  - EE84M3i 2y ago
    I think more relevantly than DNSSEC, couldn't they issue TLS certificates using DNS-01 validation? You have to trust your DNS registry.
    - Avamander 2y ago
      They could, but WebPKI things get logged, doing split-horizon DNS for your victims doesn't.
cesarb 2y ago
The gTLDs are also subject to the whims of a foreign country (usually the USA). The safest option is probably your own country's ccTLD, since any dispute would go solely through your own country's laws and courts (to which you're already subjected, by virtue of living there).
- tacitusarc 2y ago
  Unfortunately, the .us TLD prevents hiding whois, even partially. So registering a domain under that TLD is just asking for perpetual spam.
  - Sanzig 2y ago
    Which is weird! In contrast, .ca hides whois by default for personal registrations.
    - iggldiggl 2y ago
      And .de is schizophrenic, because a few years back there was a big kerfuffle about WHOIS data being public, as a result of which it is now hidden, however almost all German websites remain subject to mandatory imprint regulations. (The only true exceptions are things of limited public value, such as the log-in pages to password-protected stuff, or at most galleries of holiday snaps for family and friends, although ideally those should rather be password-protected, too. Anything else that's intended for the regular general public is at least in a grey area, even if it remains strictly non-commercial.)

drpossum 2y ago

You should always be aware of political risks when buying a ccTLD. There's precedent that these have caused serious issues for domain holders, one notable example https://www.theverge.com/2024/2/12/24071036/queer-af-mastodon-taliban-shut-down-afghanistan https://www.theverge.com/2024/2/12/24071036/queer-af-mastodo...

Avamander 2y ago
Outages and poor management are one possibility. Other is the fact that you have to trust the country running the ccTLD with DNSSEC keys. This might rule out things like using TLSA/DANE or SSHFP records.
- EE84M3i 2y ago
  I think more relevantly than DNSSEC, couldn't they issue TLS certificates using DNS-01 validation? You have to trust your DNS registry.
  - Avamander 2y ago
    They could, but WebPKI things get logged, doing split-horizon DNS for your victims doesn't.

cesarb 2y ago

The gTLDs are also subject to the whims of a foreign country (usually the USA). The safest option is probably your own country's ccTLD, since any dispute would go solely through your own country's laws and courts (to which you're already subjected, by virtue of living there).

tacitusarc 2y ago
Unfortunately, the .us TLD prevents hiding whois, even partially. So registering a domain under that TLD is just asking for perpetual spam.
- Sanzig 2y ago
  Which is weird! In contrast, .ca hides whois by default for personal registrations.
  - iggldiggl 2y ago
    And .de is schizophrenic, because a few years back there was a big kerfuffle about WHOIS data being public, as a result of which it is now hidden, however almost all German websites remain subject to mandatory imprint regulations. (The only true exceptions are things of limited public value, such as the log-in pages to password-protected stuff, or at most galleries of holiday snaps for family and friends, although ideally those should rather be password-protected, too. Anything else that's intended for the regular general public is at least in a grey area, even if it remains strictly non-commercial.)