Gail, not Gmail | Hacker News Reader

Gail, not Gmail

gail.com

505 pointsrcach001154 comments

Also interesting in this space....

Microsoft vs a High School Kid: https://en.wikipedia.org/wiki/Microsoft_vs._MikeRoweSoft

Google fails to win dispute for oogle.com: http://blog.dnattorney.com/2012/07/google-loses-ooglecom-dom...

Julia Roberts gets control of her namesake domain, but Bruce Springsteen does not: http://www.ivanhoffman.com/bruce.html

Uhh... so don't even try going to oogle.com

It just takes over your browser and makes it impossible to close without killing the PID.

In Chrome, I clicked the "Prevent page from creating additional pop-ups." checkbox, and then closed the page normally. What browser are you using that doesn't have such an option?

Chrome. Mine did not have that experience.

elinks, lynx, w3m. Edge and Firefox have that.

Someone from Bosnia registered http://microsoft.ba/ - and is showing Linux logos there! He's been holding onto the domain for years, now.

That's funny. I guess if they try to make their site look like a legit Microsoft site then they'll be in a lot of trouble.

I once worked with a guy who had a domain that is the name of a major bank in my country (i.e. he owned {bank_name}.xyz and the bank's domain is {bank_name}-bank.xyz). Somehow he managed to hold on to it over the years.

Anyway, he had a catch-all email account for the domain, an sometimes interesting stuff would arrive. One day he showed me an email he had just received from a major investment firm that read more or less like this:

> Hey Jane, what's up?

> So I need to transfer those $50M we talked about over the phone the other day, just wanted to confirm the account. It's 123456789, right? If not, do send me the account number. Thanks!

Of course he didn't even reply, but he said these things happened pretty often.

Smells like phishing to me :)

An email trying to pass as a normal workplace email.

I'm sure a vast majority of it was phishing, but you may be surprised to know how many and how often people send info like that over unencrypted email.

Oh yes I agree, that's why phishing exists in the first place. Because people do it, so someone can take advantage of those people's (bad) habits.

Recently found out that our HR department has been sending all kinds of personal info over email (repeatedly...)

Names, addresses, social security numbers, etc.

I seriously doubt it was, at least not a blanket automated attempt aimed at multiple people.

It was years ago but IIRC, there were actual names and the email was clearly between two people who knew each other personally, contained phone numbers, etc. Also, it wasn't in English, so it wasn't some automated Nigerian scam or something like that for sure.

And if someone went through the trouble of obtaining so much intel (names, phones, company titles, bank branches, etc) - makes no sense they would then get the email wrong.

Also, at most the person sending the email would gain is some business bank account number, that's probably semi public knowledge anyway, without any authentication-enabling information.

This stuff is done by fax in my country to this very day, I'm not surprised at all that such an unencrypted mail was sent.

In most of the world, account numbers aren't at all sensitive, so I'm not sure what would be gained.

It's not the content of the message.

Typically inside a company (like a bank) there's an email client with a preconfigured contacts list linked to an AD server, the email client will write the email address for you.

So the probability of someone mistyping an email address inside the same company is, I'd say, low. Even lower if it's a recuring contact between two persons who know each others.

That's what's smelling here. You don't mispell an email address when you're replying or sending a message to someone you have an ongoing conversation with.

And if you receive that kind of email from outside the company... Well. That's phishing.

It wasn't an internal email, it was from someone at some private investment fund, and emailed to someone at the bank.

Also, for clarification, 12345678 wasn't the actual number, it was something that looked completely legit.

I am not saying your story is fake dvirsky if that's you get from my posts. It's just has all the hallmarks of something I trained people around me to notice.

I didn't think this is what you implied, but having seen the actual email, I also think the security bad practice was on the sender side, and this wasn't a phishing attempt.

Did he check if it was from Nigeria?

The FAQ links to an account of an attempted takeover of the domain that I found fascinating to read: http://www.wipo.int/amc/en/domains/decisions/html/2006/d2006...

Some interesting excerpts:

> vii) it is unlikely that the Respondent was unaware of the Complainant’s trademark considering the fame and tradition of the trademark GAIL

I have personally never heard of GAIL and found it funny that this was part of the complaint. They even move on from "unlikely" to "fact" when accusing the owners of gail.com that they were acting in bad faith:

> Furthermore, because the Respondent registered the domain name exactly when the Complainant increased its sales of GAIL products to the United States, this should be identified as an abusive practice. Lastly, the Respondent knew about the existence of the Complainant and of its GAIL trademark and nevertheless proceeded with the registration of the domain name.

The owners of gail made a counter-claim:

> (d) Reverse Domain Name Hijacking

> The Respondent alleges that the Complainant is using the Policy in bad faith for reverse domain name hijacking.

The arbiters ended up deciding that the owners of gail.com had a "legitimate interest" in operating the domain name, so they didn't comment on GAIL's accusation of bad faith.

(As someone who really detests IP law in its various forms, I've always found it unnerving that domain names can be seized simply based on whether a third party thinks your use is "legitimate" or not.)

It is weird how DNS names can be legally reassigned. It's like being forced to move to a different street or something. Or to give up a neat phone number because another company has the same phoneword.

How else would you deal with cybersquatters?

> I have personally never heard of GAIL and found it funny that this was part of the complaint.

The best part is that the first result for "GAIL" isn't even this company: https://en.wikipedia.org/wiki/GAIL

> Q: I think you're infringing on my trademark...

> A: If you consult with someone well versed in trademark law, they will tell you that you can't have an exclusive trademark on a common word or name. My husband and I successfully defended ourselves against an attempted domain takeover in 2006; see WIPO Case D2006-0655 for more information.

Well, it depends on the jurisdiction. In France, in the infamous "Milka" case, the opposite happened: https://fr.wikipedia.org/wiki/Milka_contre_Kraft_Foods (french)

I remember reading about that case in a web design magazine. Here's a very short article from the BBC: http://news.bbc.co.uk/2/hi/europe/4348585.stm

Even in France that wouldn't fly. Milka lost this case because besides having the milka.fr domains, her webdesign was using a color close to the brand one.

As a result the judges ruled that she was piggybacking on the established brand.

If her design was say green instead of purple, she would likely have won the trial.

Yes, this is one of the reasons cited in the Wikipedia article I linked. Another might be not having the legal resources of a US$ 20-40B company.

> Yes, this is one of the reasons cited in the Wikipedia article I linked.

Which most readers here can't understand. That's why I though it was important to stress it here.

Thanks.

I guess it depends on how common the name in question really is.

In Germany, a lawyer named Dr. Andreas Shell lost a five-year legal dispute against the petrol multinational and had to hand over "shell.de" in 2001. Amazingly, in 1996 Shell actually was offered the domain at cost, but showed no interest.

Source, German only I am afraid: http://www.spiegel.de/netzwelt/web/rechtsstreit-shell-gegen-...

Somewhat related: http://www.purple.com

Also in fun domain-related trivia: http://nissan.com/

So you can have a last name, use it as your trademark first, file all sorts of documents, get two domains, and then be put through the hoops by a forign company?

That's crazy. This guy whould have been awarded damages. He was the first to use Nissan in America before the auto-company in 1984.

The story of nissan.com has always been a fascinating (and angering) case study since domains have been a thing and since the UDRP was put in place.

Nissan (the car company) has been predatory and downright evil in their attempts to wrest nissan.com from Fred.

It's the same reason we don't have Burger King in Australia. We have Hungry Jack's.

When burger king tried to start its brand in Australia way back when, they were unable to register the burger king licence in all states because in one state a man already had a long running burger place by that name.

So instead of having every state bar one with burger kings, they instead opted for a new name entirely.

Love their image advertising pricing.

"For images, the price is 0.10 per pixel per day. So an 88x31 tag (2728 pixels) would cost 272.80 per day."

I am so confused by this. I was even more confused after I read the FAQ. I have so many questions now. One of them is: What's the point?

purple is the point.

So many questions, and so much purple. Also see http://notpurple.com/.

I was so amazed at the load time of this site! They are on to something...

> Q: Are there any games?

> A: You can chase the purple squirrel. He is animated against a purple background. Click on him to win. The game restarts immediately after each win, only the squirrel knows.

That poor squirrel. All those losses, and no one to share them with?

There should be a purple countdown, and if the squirrel makes it to the end of the time limit without being caught/clicked on, the squirrel wins. Then the timer resets and a new game starts. Games that are impossible for one party to win are no fun.

I personally like http://heeeeeeeey.com/

I think you couldn't make much money out of this anyway. 5k daily visitors sounds decent, but they are of low "quality": They quickly leave and would generate bad click-through rates. It would probably yield less than $100 a month.

It would make less than 40 USD month, I guess. I am comparing to a page with similar quantity of unique visitors I have.

How about if you monetised it by phishing, pretending to actually be gmail.com?

How about punching a policeman, instead, and cut down on the time until you are transferred to a cell?

There's nothing wrong with receiving emails.

I don't think it's actually illegal to do that. Just a bit morally off.

Just receiving e-mails would hardly be a way to "monetize it by phishing".

You could probably just redirect all emails to @gmail.com, and most users would be none the wiser. Then you'd be able to trivially do password resets on any accounts that were created with the typo domain.

Or just sell the emails to unsavory people.

They were sent to you, you have a right to sell them (so long as you're in a one-party-consent state when it comes to recording). You're up to snuff law-wise.

Definetly a shady thing to do.

What does phishing have to do with receiving emails?

The DOJ only prosecutes a few hundred of these cases per year. You'd need to do a lot of phishing, or something special in order to get their attention, I suspect.

The entire page is 2501 bytes consisting of 246 words. How do you figure that slow readers are higher quality visitors than the others?

That's not what the parent comment said at all. They're lower quality visitors because they don't have a genuine interest in "gail.com", they most likely wanted to go to "gmail.com" and mistyped (hence the name of the post). Once they see it's not actually Gmail, most will bounce pretty quickly.

I would be tempted to implement a custom SMTP server that accepts every email as if that target mailbox exists and collect them on a nosql db (just for curiosity and technical challenge) though I have no idea if I'd face any legal issues.

It's called Catch-All; I have it set up for my Google For Work account (e.g. I have a gmail that receives @my domain). So, you could use gmail to catch all e-mails to @gail.com; no need for a 'custom SMTP server'.

You can also do this with a real MTA; no need for Google, either.

I know; was just an example of an available 'Catch-All' solution.

Back in the day™ I wrote a C# dll to add the functionality to my Exchange server (was not an option back then; don't know if it's possible out of the box now). There are many solutions once you know what to look for (e.g. the phrase 'Catch-All')

Thanks for the info. I didn't know it was that easy.

I wanted this and I couldn't find it, thanks!

How much spam do you get from the Catch-All?

> though I have no idea if I'd face any legal issues.

Why would you? It's standard practice to set up a catch-all for your domain and you can just configure postfix to do that.

Ignorance of the law isn't an excuse.

Right... And your point is? What law would this break? Or are you ignorant of that as well? If so, why even bother replying?

I think he means that "why would you?" is not good legal advice.

I mean, I agree with you in principle, but I can imagine some backwater judge deciding that Alice Techie was violating the privacy of Bob D. Luddite by accepting emails addressed to bob.d.luddite@alicetechie.com.

> I think he means that "why would you?" is not good legal advice.

It is when it is literally common practice. Similar to if someone were to ask if they'd get in legal trouble for breathing. Why would you?

Or just pretend that you are a gmail mail server and store the credentials that are transmitted when people add the account to their mail app.

Would DMARC not prevent this?

I made a service that does this ( https://disposeamail.com/ ), and I am constantly asking myself if it's worth it. The PostgreSQL database takes up over half the disk space on the VPS I run it on, and that's only after a few months. And of course it's almost all ultra low quality spam.

You're doing the Lord's work, son.

This is a great service/idea. Have you considered a donate button to help support it?

http://www.mailinator.com/ is probably better. They have a ton of domain aliases, see their homepage.

haha amazing - the 'm' key on my keyboard broke a few months ago - I'm fairly sure I account for at least 2% of the hits that month!

So you visited gail.co?

Only if the parent doesn't know about Ctrl+Enter and still waste time trying to type ".com"

What is this shortcut you speak of? And in which browsers is it useful?

Good question - I had probably hit enter for `gail.com` having typed it out at one point - then muscle memory of typing `gmai` + enter -> google suggest = 'gail.com'

I can understand the desire to not cave to "the man" and keep your domain, but why not just sell it for $ludicrous_sum and register another domain?

Especially considering the enormous amount of TLDs now.

This is what I loved about the web back in the day. I remember putting up my first web page and coming across Matt's script archive.

Matt's Script Archive is where it all began for me.

All those years ago a company paid me £15k to build them a website which they could update themselves.

So I turned WWWBoard into a kind of blog/publishing system for them and they loved it. Cha-ching! :)

They must get a lot of mistakenly addressed emails.

Perhaps. They are using ProtonMail. (Found out by using dig.)

If Google was worried about mail being siphoned off (via typos), they'd just have to setup a periodic automatic check.

gail.com don't currently accept email for @gmail.com:

    $ host -t mx gail.com
    gail.com mail is handled by 10 mail.protonmail.ch.

    $ nc -w1 mail.protonmail.ch 25
    220 mail1i.protonmail.ch ESMTP Postfix
    HELO test.com
    250 mail1i.protonmail.ch
    mail from:<test@test.com>
    250 2.1.0 Ok
    rcpt to:<test@gmail.com>
    554 5.7.1 <test@gmail.com>: Relay access denied
    421 4.7.0 mail1i.protonmail.ch Error: too many errors

I'm lost, probably because I know nothing about SMTP and mail routing. If you were worried about typos where they accidentally use @gail.com instead of @gmail.com, why would it not accepting @gmail.com be relevant?

Or are you talking about a typo in the routing config itself?

I want more people like this domain owner in the world

I wonder how many people have sent angry emails to gail.com for not being gmail.com.

You may think I'm joking, but think back to that "some random blog post showed up as the first Google result for 'Facebook'" incident and you'll get what I mean.

The husband in question is a very accomplished engineer and owns his own first name as a domain too :-) https://kevin.org/ - not dot com sadly!

Reminds me of http://www.nissan.com.

I get why it's appealing on a "little guy against big nameless corporation" level, but honestly, it's like an annoying kid who wants attention.

It's not like gail.com or nissan.com are providing any content that 99.999999999% would find remotely interesting or useful, I imagine most are just annoyed to accidentally stumble on some barely-coherent anti-capitalist rambling.

But I get it. It's cool to be a rebel.

I mean... if you walk into my storefront and get annoyed I'm not selling what you expected, because you meant to walk into my neighbor's storefront, why should I feel bad about that? Why should I change anything? Seems like an odd perspective.

My domain doesn't have any content most people would find remotely interesting or useful. If a large corporation names a product similarly to my domain, should I feel pressured into changing?

Cue Office Space Michael Bolton quote.

This comment is what really worries me about domain name disputes. You seem to be under the impression that http is the only use for DNS, and you are very very wrong.

how do you get an account?

Invite only.

they have a very long waitlist, sorry

That is wonderful. If only my common gmail typo (gmamil) was as delightful, instead of being a vector for evil.

gmamil.com takes you places.....

So there's really no way for a company to take over a domain if they have a legitimate reason? My company's dot com shows what looks to be a low value video. I've reached out to the guy a few years ago and he simply replied that there were some things that money couldn't buy... Petal.com if you're interested. I'd love to have that domain, and yeah it's affecting our brand.

Looks like it's no longer loading anything.

Lawyers would take a long, expensive timedefining "legitimate".

Likely it was not enough money %)

There are ways but "I named my company after a common English word, someone already owns the domain for that word and it would benefit me to own it instead" is not a legitimate reason.

Agreed 100%. If your company was founded sometime after 2000 and you picked a name before registering that domain, you have no one to blame but yourself. You could say 2003 if you want to be generous.

I bought my first domain in 1996 for a startup I was doing. I thought I was late to the domain registration game.

There is a process you can go through with ICANN and WIPO if you feel that you both (a) have a legitimate claim to the domain name and (b) the current owner does not have a legitimate claim. If the panel sides with you, then the domain will be transferred to you.

Note that (b) is - intentionally - quite difficult to prove, and is designed to prevent overtly bad-faith cyber-squatting without allowing "he who came late to the game but has more money wins" type of reverse-hijacking.

Since "petal" is a common word that you chose to use, but did not invent or have worldwide common recognition with, you very likely won't have much of a chance of using the dispute resolution process to obtain petal.com.

Interesting article about the early days of domain ownership disputes here:

http://www.americanbar.org/publications/communications_lawye...

I wonder if gmail sends him/her a small check to keep gail.com clean and friendly. No advertising needed.

They really need to conserve bandwidth.

I think they host it on their own home server, or at least did at the time of the WIPO case, since that mentions conserving DSL bandwidth.

They serve around 600MB per month (calculated based on the 2015 traffic numbers and current page size of 4.19KB).

Based on their IP, they are hosted on DigitalOcean where even the cheapest plan provides 1TB of transfer per month, so bandwidth is not an issue.

OVH has a 1MB plan with every domain which has unlimited bandwidth.

It's A 10 MB plan with 1 GB of traffic

And how about this (from the source code):

"<font size="+1" face="ARIAL,HELVETICA">"

The HTML is clearly also from 1996. :)

The site can maybe be used for presenting easy to understand educational content about phishing.

The site is already being used. I don't think they're looking for bright ideas.

Why not show ads and give the money to a charity or any other foundation of your choice?

It appears that they object to ads in principle ("if you feel like you need more ads in your life..."), which is something I respect immensely. I wish more people made a stand against advertising. It is psychological manipulation that we are guilted into accepting for the good of capitalism.

It's not even for the good of capitalism: it transforms the market in to a competition to weaponize psychology instead of creating value -- something most of us would argue is a market inefficiency of the modern system.

Advertisers will eventually strangle capitalism by increasing the irrationality of market actors until the basic mechanism of effective capital allocation breaks down.

Some would argue we're toeing or slightly across that line.

Who is going to advertise on gail.com? The numbers of visitors is meaningless if the vast majority of your visitors take 2 seconds to look at the site and say "Ooops I made a typo, this isn't the page I wanted. Let me fix that." Most visitors probably don't read much of the site at all, let along click an ad on it.

Gail for President

This just made my day. I'm a big believer in karma and you obviously have your shit together :)

I would plaster that shit with ads, it's free money.

Q: Don't you know that you could throw some ads up and make money? A: Yes, I know, thank you. For those who feel they need more advertising in their life, please have a look at our swanky Electronic Frontier Foundation ad below.

Its free money but it makes the world a sader place. Like how enacted liability claims forced lawyers to force organisations to get insurance which forced unprofitable activities that couldn't justify the cost to cease. Like the egg and spoon race in my local town that used to occur for children every year. That ceased around the 2000's.

The late 90's/2000's was when the bad "sue for everything" habit came from over the pond and the thousands of extra lawyers (trained by our desire for more people to go to university) suddenly needed to find work. Also this is when driving insurance premiums skyrocketed because suddenly everyone was claiming for whiplash because it was "free money" that we all have to collectively pay back. Some things that appear free are not really free, I guess that's my point.

I'd probably do it, too.

However check out what the owners say about it:

> Q: Are you interested in monetizing gail.com?

> A: No, but thanks for asking.

> Q: Don't you know that you could throw some ads up and make money?

> A: Yes, I know, thank you. For those who feel they need more advertising in their life, please have a look at our swanky Electronic Frontier Foundation ad below.

Trying way too hard to make people think anyone cares...

It really annoys me that they are not monetizing this.

Lol. I don't see why you'd do something like this unless you had infinite money. Put some ads and donate the money to any cause you care about.

There are people starving in this world and I'm gonna go ahead keep my famous page that gets loads of hits just to prove that I don't have to sell it or put ads on it. Fuck you, by us!

The UDRP process is a joke and they got lucky with one panelist. Best go with three and an attorney.

They're easily leaving over US$ 500 a day on the table, for many years. Even if you hate advertising, take the money and donate to some charity. There are many who can use that kind of funds.

Wasteful.

$100 CPMs? No way. With 5k uniques per day, maybe he'd make $5 a day with low quality, quick-leaving traffic. Unless he were to do shady stuff like affiliate redirects to gail.de or something.

> Even if you hate advertising, take the money and donate to some charity. There are many who can use that kind of funds.

It's terrible, all these people with houses in prominent traffic locations and people driving vehicles in high density urban environments, who refuse to place advertising all over their property. So much money being left on the table - even at low ad rates - they could be helping the less fortunate with those billions of collective ad dollars.

Reply on news.ycombinator.com