Hacker News Reader

Comment by walrus01 | Hacker News Reader

This is a huge screwup on the part of the people who run the 'root' of .IO, and their entire operation should be severely scrutinized by ICANN.

In my opinion almost all of the 'weird' TLDs which are country codes that are actually operated by a third party commercial service are 95% spam and junk registrations. .TV is a good example.

Technical screwups aside, the existence of .IO and the fact that it "belongs" to the UK government is morally questionable, since the entire country code only exists because the British and American militaries forcibly removed the original inhabitants of islands such as Diego Garcia so that they could use the area as naval and air force bases.

https://en.wikipedia.org/wiki/British_Indian_Ocean_Territory

https://en.wikipedia.org/wiki/Diego_Garcia

If I had been able to successfully register these names and get live traffic going to a BIND9 instance, my first instinct would not be to alert the company through its first tier customer support levels, but to immediately post a summary of the problem to ARIN, RIPE, APNIC and ICANN mailing lists. This would get the issue in front of people who immediately understand how serious the problem is, and hopefully one of them would be able to contact the principals of .IO directly.

View on HN

Just so no one is misled: "original inhabitants" does not mean "indigenous peoples" with respect to the BIOT. The islands were not populated prior to late-18th Century European colonization. The depopulation was of post-colonial people.

Why is that an important distinction? Is forcible expulsion and dispropriration more acceptable if the people were brought to the island as slaves and laborers in the mid-1700s?

> an important distinction

That it is a distinction is important to me. Having difficult discussions is made more difficult if we obscure facts or conflate terms.

> more acceptable

I applied no normative judgement.

> That it is a distinction is important to me.

Why ?

Are you being deliberately obtuse? It's a pretty important distinction that these were not some native tribesmen with millennia of ancestral history tied up in the lands.

100s of years though, so from the perspective of an individual on the island it's exactly the same -- their entire life was on that island. So, the distinction is pointless and reeks of apologetics IMO.

"Sir Bruce Greatbatch, KCVO, CMG, MBE, governor of the Seychelles, ordered all the dogs on Diego Garcia to be killed. More than 1000 pets were gassed with exhaust fumes. "They put the dogs in a furnace where the people worked", Lisette Talatte, in her 60s, told me, "and when their dogs were taken away in front of them our children screamed and cried". Sir Bruce had been given responsibility for what the US called "cleansing" and "sanitising" the islands; and the killing of the pets was taken by the islanders as a warning."

By that logic, ethnic Europeans are the 'original inhabitants' of North America.

I'm also unclear on why you quoted what the British did in your post - how does it relate to whether or not calling those people 'original inhabitants' is misleading? Do you believe that, if the British did something sufficiently wrong to them, that calling them 'original inhabitants' will be less misleading?

What would you call the descendant of a Frenchman who settled in Quebec during the 1600s ?

Immigrant? No. Settler? Not really after so many years.

As an immigrant, I view them as natives Quebecers.

What would you call them?

Not everything is a contest. It doesn't matter how "original" natives are if they're natives.

The reason "ethnic Europeans" aren't "the original inhabitants of North America" is that European settlers violently displaced (or killed) the previous inhabitants.

Heck, the "original" inhabitants of North America (as far as we know) actually originated in what is now mostly Russia if you go back a few dozen millenia. And if you go back further than that (according to mainstream scientific consensus) we all likely originated in Africa. Defining the term "original inhabitants" as an absolute is blatantly begging the question (specifically it only works if you're a creationist).

People were subjected to physical and psychological violence to be forcibly removed from their home and birthplace. That's bad enough, no matter how many generations lived in the same place before. This isn't about who's had it worse.

So why oppose clarifications on what 'original' means in this context?

They were expelled in 1965. The current year is 2017. If we wait a few more decades this discussion will be pointless either way.

I'm not opposing clarifications. I'm opposing quibbling over the semantics of "original" as if the distinction adds anything to the conversation.

Their parents lived there, they were born there, they were violently expelled and suffered emotional abuse. The number of dead ancestors (or lack thereof) in the ground does not invalidate the suffering these people were forced to endure.

No its not.

it's

Rather than correcting grammar, why don't you respond to the numerous rebuttals of your point of view elsewhere in this thread ?

You says its important but don't explain why, and empathise that you place no "normative judgement" on it.

Normative judgment doesn't make sense btw, judgement adhering to the norm - eh wat ? I think you meant moral/ethical.

By European standards the US is mostly inhabited by non-natives. So I guess it'd be okay to forcibly expel everyone but the Natives because they don't have millennia of ancestral history?

I'd hope the more important distinction is how people are removed, not how many generations of dead people there were before them.

If a man shows up with a gun to run me off my land, it doesn't matter whether it was my father that bought it or my grandfather or my great-grandfather. What's important is the forcible dispropriation itself.

Cases like this just make a mockery of the Lockean natural rights theory of property.

I made no comment on if it was right or not, I simply maintain that there is an important distinction there.

For a conversation to happen, everyone should be on the same page. Distinction for the sake of clarity should always be welcomed and not confused with endorsing a specific action or behavior.

The question is NOT about the morality of deportation, but about about the legitimacy of the UK's ownership.

The only two nations that have laid claim to the territory are France and the United Kingdom. (France lost it in the Napoleonic Wars.)

https://youtu.be/UTduy7Qkvk8

Ha ha :)

Of course, the difference between the Indian Ocean Territory and India, is that people lived in India before. When the French showed up, the atolls were uninhabited.

It doesn't really matter at all. The land didn't come with a .io ccTLD. It's dervived from a name the British chose, so it's not like they stole the domain name from those people, right?

Displacing settlers is a different question.

I think the morally questionable problem is this: I am highly doubtful that the original inhabitants of the islands are receiving any revenue whatsoever from the corporation which runs .IO. At least the small pacific island nation states that have hired third parties to run their ccTLD have contracts and agreements in place for a revenue share.

I am similarly outraged that I haven't had any cheques from Nominet come through the post recently and as a UK tax paying citizen I am outraged at this oversight.

I want my £10!

Are the original inhabitants of these islands still alive?

Yes. https://en.wikipedia.org/wiki/Chagossians

Why should they get any revenue from .io? The .io is an invention of the government and has nothing to do with the original inhabitants. The "original" people were removed well before .io even existed.

Might as well demand they get paid for any inventions the military makes while testing stuff out there.

And if the British hadn't done this and gave control over to the people living there 50 years ago, they wouldn't get .io either, because they wouldn't call themselves British Indian Ocean Territories. They'd have used something reflecting the name in their language.

So again, this is a "resource" purely created by the British government being there.

Maybe it's terribly unfair and bad what they've done to those peoples, but .io doesn't figure into that at all.

Edit: I suppose if they had their own nation state, they could make some money that they couldn't otherwise. But why stop at domain names (which, again, wouldn't be .io, it'd be .cx or something for Chagossians)? They can't issue passports, a potentially valuable resource, not being a sovereign nation. They can't run "tax haven" schemes, etc. Seems like getting upset over .io itself is pointless compared to all the other stuff they could do with an internationally recognized government.

When Britain (and thus the US) decide they no longer require the island for a naval base, it will be given to Mauritius.

The .IO domain would eventually be deleted, and that territory represented under the existing .MU (Mauritius) domain.

Judging by https://en.wikipedia.org/wiki/.mu I don't think the Mauritian people have much benefit from the arrangements for .MU.

.SU - for the Soviet Union - still exists, I somewhat doubt that many TLDs will ever be deleted in general.

.SU is actually the only former country with a TLD still delegated, and quite a few have been removed. In recent years .AN, .TP, .YU, .ZR have been phased out representing former countries.

Still, why does the UK need a special TLD for a naval base?

Because the domain name system uses ISO-8859, which provides codes for "countries, territories and islands".

The standard provides codes for such places since different law often applies in territories and on islands.

(See also: UM, TW, EH, AQ, SH, SJ, and many others.)

I think you mixed up your ISOs. ISO-8859 is for 8bit character encodings.

I think you mean ISO-3166-1, ISO-8859 is a standard for character encoding eg: latin1 (which is probably why you know it).

IANA allows delegation of country-code TLDs for all countries and territories represented in the ISO 3166-1 standard.

The thing to bear in mind is this standard is used for a number of different purposes historically that has informed territories and other "non"-countries being added.

For example, it is used by postal services for routing physical mail. A lot of far flung island dependencies are coded individually because their mail wouldn't route through their mother country but through other ports.

The addition of "EU", while not a country, reflected the needs of the "EUR" currency code when the Euro was introduced (the first two letters of ISO 4217 currency codes are derived from the ISO 3166-1 standard).

I'd say that using the land of your own country - owned by people in your country - for military purposes, while sketchy, is definitely more acceptable than taking an island from its indigenous occupants by force. The UK ownership then seems at least to be legitimate.

How is that relevant to this discussion? They are original habitants, or are you contesting that?

> Just so no one is misled: "original inhabitants" does not mean "indigenous peoples" with respect to the BIOT. ... The depopulation was of post-colonial people.

Oh that's fine then. They only lived there for what 100 years, totally fine to do these things to those 1000 some people:

https://en.wikipedia.org/wiki/Diego_Garcia

---

first tactics were implemented to decrease the population of Diego Garcia. Those who left the island - either for vacation or medical purposes - were not allowed to return, and those who stayed could obtain only restricted food and medical supplies. This tactic was in hope that those that stayed would leave "willingly".[26] One of the tactics used was that of the killings of Chagossian pets. Dogs were carried into sheds where they were gassed in front of their owners.[26]

---

Is there a country on Earth which does not have a forced removal of 1000+ people in it's history?

I mean, that doesn't justify the act, but I question the logic of claiming moral superiority or questioning authenticity over this.

It isn't anywhere near the worst thing the UK has done (in this case for the US so, I think they share a bit of the blame). The key issue here is that it is ongoing - the UK still isn't allowing them back or properly compensating them. The UK government should recognise that what it did was wrong, establish that the land belongs to the Chagossians and, broker an agreement where the US tries to try to buy the land needed for the base from them. There will be a price that the US government is willing to pay to keep the base there, that the Chagossians will accept, I suspect. If there is not, the base should have to be moved over a period of five years. An alternative might be the construction of an artificial island nearby. It is also possible that the value to the Chagossians, and the cost of building an artificial island, are both greater than the value to the US of having the base, in which case they should just abandon it. This is the only fair solution IMHO.

https://en.wikipedia.org/wiki/Depopulation_of_Chagossians_fr...

I'm in the TLD space (we run a fair number of gTLDs). If a gTLD operator screwed up like this then there could be consequences. A ccTLD, however, runs with very few restrictions. I don't see much of consequence happening to it as a result of this.

I will, however, say that gTLDs are generally more secure and well-run than smaller ccTLDs, and are worth preferring for that reason. It's a weird historical quirk that .io randomly became popular in the developer community, but there are better options. And, as you point out, it's morally suspect, which is why we don't use it for new domain names.

There are a few ccTLDs that differ from that, though. DENIC and CZNIC are two that are generally very well-run, DENIC even offering better security and safety than many gTLDs (while also being a cooperative, not a commercial NIC, so prices are very low, too)

There's probably around a dozen ccTLDs that are really competently run and that are world-class. Beyond that I'd stick with competently run gTLDs.

I actually just met a bunch of the denic guys at a conference they hosted a month ago in Frankfurt. They're on point with their Internet stuff.

given the incredible importance to global internet infrastructure of things like the DE-CIX in frankfurt, I am not surprised that the Germans have their shit together when running critical back end systems.

I think it's more than a dozen. I would expect all wealthy, tech-savvy democracies to have fairly competently run ccTLDs. It's just that there's about 200 countries in the world, and quite a lot of those are a complete mess.

.me and .ca "seem" competently run.

More so for .me, ran by the owners of .org

if .ca was not competently run, I'm pretty sure the federal government would step in and put it into the hands of people with real DNS/network engineering credibility.

Unlike the rarely used .us for the USA, it is used for the vast majority of canadian domestic corporations' web identities.

And also the Canadian government for that matter

It is really nice, that the .de domain is seen more as infrastructure than some business. But there are a few downsides to DENIC as well.

1. you need to have a person (juridicial or natural) with an address in Germany to register and list that person as ADMIN-C

2. if you run a website that provide contents which COULD generate revenue, you have to have an Impressum [1] which includes the address, names, etc. of the website owner.

This is pretty annoying if you are sensitive about privacy and do not want your details out in the open.

[1] https://en.wikipedia.org/wiki/Impressum

Well, this is what every domain should have, though. A Ladungsfähige Anschrift of a person that is liable.

This is a major criticism I have with many other domains, I don’t know where to send a C&D, or whom to sue if they violate my rights.

And requiring only commercial entities to have these things also makes sense.

making a single person personally liable for content that's hosted on a domain is problematic, to say the least. Go down that path and you eventually end up where the chinese government is now. Where you need a "license" from some ministry to operate an http daemon and you need to hire censors to police all user generated content that disagrees with an authoritarian regime's politics.

https://www.google.com/search?q=china+lgbt+web&ie=utf-8&oe=u...

Agree to disagree. Of the top of my head I can think of several useful things where a public (private) address would be problematic:

1. you want to do something like wiki leaks

2. you want to publish your thoughts anonymously, let's say you are from the LGTB spectrum and want to engage with people by building a forum or blog to communicate with them -> this could lead to potential problems with family, friends and work

3. you have political views and publish them. Now say someone disagrees with your views and is potentially aggressive. Do you want them to know where your family lives?

4. you do not wan't annoying calls by people who crawl the DENIC records (happens to me regularly)

I agree with you that a person should be liable for the stuff they do, but should also be able to engage in open discussion while protecting their privacy. FWIW If someone does bad stuff on a .de domain there are several options:

a) take down the domain via DENIC, or b) take down the domain via ISP or c) take down the domain via Hosting provider

If you really did illegal stuff, I am with you and someone (DENIC, ISP or Host) probably should have the knowledge of the domain owner which could be subpoenaed to lawfully prosecute someone.

ccTLDs don't appear to be held to very high standards. For example the .AF top level domain (which is controlled by the government's ministry of communications) doesn't even have a working website, www.nic.af

They're not held to any standards, really. Some of the smaller ccTLDs are basically just run using hand-edited zone files and spreadsheets to track ownership and expiration thereof.

Like .ai, the new "hot" ccTLD.

We just used ai.google instead of google.ai as the canonical domain name for Google's AI initiative for precisely this reason. (We run .google and you can see the source code at https://nomulus.foo )

Hey, when are you guys gonna open .meme? Asking for a friend :-)

https://dickbutt.meme ?

I'd love to open it up tomorrow, but alas, I'm not the decision maker.

I just looked at the wikipedia page for the .ai ccTLD and registering something in Anguilla requires.... a fax machine?

It's like time traveling to 1987.

If I'm reading https://whois.ai/cgi-bin/register.py? correctly, I'm not sure it's strictly required - it might just delay our account by a month (it's not 100% clear IMO):

> We will email you a password after which you need to login and pay the $100, unless you are resident in Anguilla.

> After this we will send you a letter, fax and short text message (SMS) with codes on them. Please, be sure your information is correct so you can receive verifiaction codes. When you get these you need to login and enter them.

> We will also wait 3 months to make sure there is no problem with your credit card. But each successfully verification will decrease this period by one month, so if you pass all of them you do not need to wait 3 month.

Shame it's so arcane/expensive ($100 for account, then $100/2 years per domain) - there's a couple of joke domains I might have picked up if they were cheap enough (gomennas.ai / ebihara.ai [character from Persona4]).

I do appreciate that the TLD alone resolves though: http://ai./

FWIW, 101 Domains allows you to register a .ai domain (I registered zuse.ai there) and you don't have to do anything with a fax, etc. Now, maybe 101 has to fax something to somebody in Anguilla, but as the end user, you're isolated from that. Unless things have changed since I registered my domain.

Any ETA on .app?

How about setting MX records for .google so you can have name@google emails

There's far too much software that won't accept that, sadly.

We also have .gmail, so you can imagine some clever possibilities with that.

God knows how widely a "ben@google" email address would work though. I'm going to guess not very.

True, I imagine a lot of software wouldn't know how to handle an email without a dot in the domain part

That and apparently ICANN would frown upon such an implementation [1]

[1] https://www.icann.org/news/announcement-2013-08-30-en

Wouldn't that work like the old Compuserve or Prodigy email addresses? And if it would, wouldn't most email clients have to have "back-compatibility" with it?

There are also issues like the .LY ccTLD being owned by whatever government claims to be in control of Libya this month, and occasionally revoking domains for things they don't agree with. If I recall correctly for a long time there were several commercial services reselling .LY, but its stability is questionable at best.

Why you assume that nic.$cctld must exist?

because that's the URL that the admins of .AF publish. It could be http://whatever.af if they wanted that, but if it had an httpd not showing any content, would be equally as suspect.

https://en.wikipedia.org/wiki/.af

http://www.wipo.int/amc/en/domains/cctld_db/codes/af.html

Shame: Afghanistan could really use a stream of teen marketing/hipster revenue for various domains that are x AF.

At least somebody grabbed the delightfully multilayered dope.af domain already...

As an average user, how do I know which is which? How can I tell whether .ABCXYZ is competently run and trustworthy?

gTLDs & ccTLDs have to be some of the worst ideas in Internet history.

ccTLDs are two letters long and gTLDs are everything else.

except all the new punycode IDN ccTLDs which now exist, for chinese, bulgarian, russian, etc.

> gTLDs have to be some of the worst ideas in Internet history.

Not if you're an investor in Donuts, LLC, they're not...

ccTLDs (Country Codes) are always two letters. gTLDs aren't.

The gTLDs have a pretty strict ICANN contract they have to follow; ccTLDs are looser.

_ASCII_ ccTLDs are always two letters. There are ccTLDs in other scripts that are of variable length (.ไทย, .ελ, .укр, .한국 etc.)

ccTLDs are loosers? Not according to their increasing registration figures.

Looser != loser

Ironically a rare correct use of "looser".

Thanks.

It wasn't your use that was correct.

ccTLDs are pretty much the most sensible thing in DNS hierarchy. The "original" TLDs (.com, .net, .org etc) had mostly lost their meaning by late 90s (iirc), and were heavily biased towards the US anyways and as such would have made far more sense as second-level domains for .us, where enforcing the separation could have at least hypothetically worked in some reasonable way.

Besides the old .org, what better options are there for software projects?

.sh and .run come to mind in some cases.

We have .dev and .foo, which seem like they'd be good options, but neither are available for open registration. Sorry :(

> .dev

I really hope that one never becomes available..

Play around at domainr.com, a brainstorming tool some friends and I made a few years ago. It supports all the new generic TLDs.

what's wrong with the traditional .net ? software projects are pretty much all network related these days. or use the new gTLD .network which is pretty cheap to buy.

.build ?

> "It's a weird historical quirk that .io randomly became popular in the developer community"

The reason for me is totally clear: Github Pages gives me a free subdomain for http://pingtype.github.io but not .com.

I registered http://peterburk.github.com before that policy changed.

> and their entire operation should be severely scrutinized by ICANN.

ICANN does not have 'control' in any substantive way over the ccTld's.

https://www.icann.org/resources/pages/cctlds-21-2012-02-25-e...

In the mid 90's I got to spend a quiet and frankly wonderful 60 days on Diego Garcia while I was enlisted in the USAF. It is a wonderful island, you can bike around the whole thing in a couple hours, the rec facilities were great, beer was incredibly cheap, and the Internet (on such a remote island, in 1995!) was the best/fastest I had seen at that point.

That all said, the forced expulsion thing (which I just caught up on) is news to me now. I guess bullies will always exist. It reminds me of forcibly relocating people in the US via eminent domain to build a highway. It's possible that an ethical argument can be made that if the security of the USA actually did depend on total control of that island, the cost in dollars and emotion of "strongly encouraging" people to move elsewhere might be justifiable (and I do believe they were compensated... the gassing of pets thing is shocking, though).

Bad actors are on those mailing lists too. What you describe would be the equivalent of mailing fulldisclosure with "Hi all, there might be more unregistered nameservers at .IO (or another 101domains-serviced TLD) that could be used to attack live traffic if anyone wants to grab those, kthx"

I'm fine with that happening, because the people who run .IO need to be spanked. If their customers are subsequently unhappy that their domain names have been hijacked, they can take it up with whatever corporate entity runs .IO. Same problem as publicly disclosing serious flaws with an SSL/TLS root CA.

I own an .IO domain. Do I deserve to have fake LetsEncrypt certs issued against me and my domain hijacked because some engineer forgot to remove some critical NS records or forgot to register some aliases?

Responsible disclosure cat is responsible!

Frankly, yes, a little bit. You're choosing to run your website/infrastructure/etc with a dependency on a sketchy service with no oversight (the ccTLD system in general, but .io in particular). Unless you suffer for this choice, the market for provider competence will be broken.

That nobody had any idea was sketchy or un-oversighten until recently. It was not a choice to run their website/infrastructure/etc on sketchy services at all.

No. People who care about internet-scale infrastructural issues have known about these issues for a very long time. However, most people who utilize (and depend on) these services have not taken the time to understand how they work.

Because it's a simple transaction. I pay someone for a domain, I get said domain.

Jimmy Throwawaysite shouldn't have to take the time to understand how DNS works above knowing how to set DNS records, the oversight should come from above. If ICANN wants to let anyone with a couple hundred thou run a TLD they should be making sure that entity can technically manage the TLD.

"Responsible disclosure" is a coercive term. It implies that it's irresponsible to do anything else. "Coordinated disclosure" is far better.

That said, coordinated disclosure is the neighborly thing to do, but it's by no means a moral obligation. It would be perfectly fine for the author to tweet about it, for example.

It represents a moral judgement that it is absolutely not okay (or perhaps: irresponsible) to screw over n+y people for the actions of n people.

This moral judgement is mistaken because its premise is false. The moral blame lies on the company that allowed the problem to happen, not the person calling attention to it. It's not at all the same as "if I leave my door unlocked..." type scenarios. It's perfectly legal to register .io's nameservers.

That's a cop out. If your actions reasonably cause harm to other people, regardless if those actions are "calling attention to" or actually pulling the trigger, that's a moral evil.

If someone goes around the town telling everyone that you leave your door unlocked, while they can't be legally held responsible, they're still morally responsible if someone goes in and steals your stuff armed with that knowledge.

Companies fixing their stuff before that happens is in everyone's best interests at the end of the day - hence responsible disclosure.

No moral obligation? I don't think many people would agree with you on that.

If you are actively poking around at someone's home and you find an unlocked window, you don't think there is a moral obligation to inform the owner of the security issue? No moral issues if you then find a group of hoodlums down the street and announce that house 123 has an unlocked window?

I can see if you were just driving by and saw the window open, you don't really have any obligation (unless you plan to announce it publicly) but if you are actively seeking out security flaws in someone else's property, not disclosing it to the owner and then announcing it or worse, selling it to potentially bad actors seems morally reprehensible.

This isn't equivalent to "If I leave my door unlocked..." scenarios. It's perfectly legal to register any .io name you want. You can't go poking around someone's house.

The situation is more analogous to discovering that a certain type of door offers no protection, even though it seems to lock. It's perfectly fine to tweet about that, regardless of how many people have that door. The blame lies on the company, not the messenger.

That would still be unethical. An ethical person would not commit acts which they know have the potential to cause harm to innocent people.

If you're a black hat and you don't give a shit about potential legal ramifications or any injury to anyone (partly because you fear no consequence), there's probably nothing unethical to you about fucking over a bunch of innocent people just so you can "spank" some douchebag management company into following best practices.

If you're a professional, or even a non-douchebag adult, who finds value in the ideal of protecting the innocent customers of a dangerously irresponsible corporation, you would want to work first toward protecting those individuals, and then focus on disciplining the corporation.

That will most likely cause widespread havoc without solving anything and even slow down the actual resolution of the problem.

Strategy is important.

> original inhabitants

Is a pretty misleading phrase: they were 1000 or so slaves brought by the French to otherwise unoccupied islands. They should have been compensated like any other group of people whose government wants to build a military base, or a dam, or a highway on their land - but it's not like it was some kind of genocide. Much worse things have happened in pretty much every country on the globe.

The idea that there should be a breakdown of domains by country is a bad one. There's this situation. There are many other situations where countries don't have the resources or drive to maintain what they have been allocated. And then there's the fact that there are enough domains conflicting with this structure that it makes no intuitive sense.

The fact is that there is nothing that can be derived by an end user from most top level TLDs. EDU is one of the few, but then anybody can have a subdomain in an edu environment for any purpose.

Maybe the time isn't now, but somebody should be thinking about how to replace the current domain management system and with what.

Cloudflare For Top Level Domains? :)

Why would that be a good thing, exactly?

The same as to why Cloudflare is a good thing for managing second (and plus) domains levels.

They have great network engineers (I personally know one), maybe the best in the world.

People make mistakes. This seems like some manual configuration/technical debt issues. Don't get me wrong, mistakes for these big, highly used TLDs is pretty massive. The scale of this is could have been devastating.

Responsible disclosure to the company that runs the TLD seems like the right first step. This should probably posted on ICANN, ARIN, etc mailing lists even now, but I think the writer's original response is the right one.

The people that make this sort of mistake should not be responsible for a TLD. This is one of the worst possible blunders imaginable.

Considering they control the .io TLD these should have been registered and locked as reserved. That this wasn't the policy is but one of the many failings that lead to this outcome.

If I were ICANN I'd slap them with a huge fine to send a message.

*coordinated disclosure. "Responsible disclosure" is coercive.

Just about every country has had some war with people removed or killed by an occupier. America, for instance.

So? That doesn't make it right anyway.

Direct your "so?" at the original poster who pointed out that a particular land was acquired by force, as if that was somehow notable.

yeah...yeah...and the UK seized ".UK" from the Ukraine and this means...

save your politics for politics, not for a technology discussion. We get it, you're moral.

That's not the same thing?

If you're interested, the Ukraine TLD is .ua.

To say they stole it from Ukraine in the same way they stole the .io TLD would mean that they would have to take over the entire country of Ukraine. Maybe the Russian government will have control of the .ua TLD someday.

Reply on news.ycombinator.com