Hacker News Reader

Comment by antsar | Hacker News Reader

Good idea for a company. Tough if you're a FOSS project and the domain costs $xx,xxx (almost any desireable dot-com does).

View on HN

Change the name. Especially if you're a security oriented service and not having the dot com opens you up to this sort of, I guess its phishing? .info and all are basically active red flags, especially for a security oriented project...

Honestly the Keepass maintainers have had enough basic issues with website security (see how long they held out on https for update downloads), that I use KeepassXC even on Windows these days. I figure there's enough eyes on the kdbx 4 protocol that it's safe, but the keepassxc team feels better organised.

IIRC, the update was over HTTPS, just the "check for new version" call was to HTTP.

According to https://keepass.info/help/kb/sec_issues.html, it doesn't auto-update - it just displays that a new version is available. Enabling a man-in-the-middle to display a fake update notification, when there are fake versions of Keepass floating around and the user could easily slip up (and the MITM could guide the user towards a fake version) still feels like a hole, albeit a minor one.

It has however been resolved:

> the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS.

The domain name provider I use[1] takes $2 less per year for a .com compared to a .info.

[1]: https://domainname.shop/register

That page says €9.95/yr for .com which is $11.17 USD...

$11.95 vs $13.95 for me. Similar in my local currency if I go to their regional page.

For an unregistered .com. Most desirable .com's have been squatted, and the squatters want five to six digits for the domain. The business model deserves a fiery death, yet it thrives.

So cities recently have been toying with vacancy taxes that target rich people using prime real estate speculatively or who wish to reserve a unit without anyone having lived there for cultural reasons - maybe that's the sort of tactic we need to examine with domains, some sort of creative usage bar that utilizes distinctness from other domains to detect squatting and levy a fee.

At scale, distinguishing a squatter's markov-generated WordPress landing page from a genuine pre-product startup in stealth mode sounds like a Hard Problem. On the other hand someone with 10,000 domains and zero business plans is obviously a squatter. There's probably a way to draw the line that's viable to enforce.

Seems like it would be fairly trivial to find any instance of a phrase similar to "this domain for sale" on any page and flag it for human intervention. Because that's how squatters get buyers, right, by indicating the site is for sale? Am I missing something obvious?

Additionally, as a web developer, when I see squatting on a domain I want, I will be absolutely livid. Give me a place to report squatters and I'll happily help you crowd-source what was previously a Hard Problem.

That's actually kind of genius. Domain squatting is highly automated, so in most cases it's not hard to figure out when a domain is squatted rather than simply inactive. Taxing squatters 10% of their sale offer every year would make them think twice.

It could even be done through the registrars: for every year you hold onto a domain, the registrar withholds another 10% if/when you sell it. Legitimate companies and people wouldn't suffer, since they would want to keep their domains more or less forever. Those looking to flip domains would have to consider their diminishing returns.

Fair point. Most of my domains have not been .com's but when I've registered I've checked if the .com was available and for the most part they have been.

Reply on news.ycombinator.com