Hacker News Reader

Comment by 013a | Hacker News Reader

I can't believe this situation.

This is a guy who, by his own admission, wants it to go to Microsoft, but is also holding an auction. He could just quote Microsoft $2M and be done with this whole thing.

Instead, he and this "security firm" publish a big article on one of the internet's most lauded security blogs where they outline how blown away they were with how much data was being sent to this domain. They left it open for 15 minutes and got millions of emails, passwords, etc. "Wow, bad people reading this, look at how much data you could get. You better join in on the auction. Microsoft, you seeing this? You better get in on this too. Bid often and bid well, friends."

I wonder what kind of authority ICANN has in revoking domain name registrations in extreme circumstances. Microsoft fucked up here, but we're long past that being a relevant component in this discussion. This registration should be pulled out from under O’Connor and blocked from registration for 100 years.

View on HN

I am totally OK with the sale of this domain to anyone. He owns the domain and he has the right to sell it.

Perhaps the fallout would be good for computer security, as it would stop corporations from making boneheaded security decisions. Pain seems to be the only way to make corporations evolve anyways.

I would agree except he is quoted as “fearing” it won’t go to Microsoft. He could just make that happen.

Microsoft has deep enough pockets to make that happen.

But it's very valuable and he wants (needs?) the money for his retirement. Microsoft may not be willing to pay up.

From the article:“It seems to me that Microsoft should stand up and shoulder the burden of the mistake they made,” he said. “But they’ve shown no real interest in doing that, and so I’ve shown no interest in giving it to them. I don’t really need the money. I’m basically auctioning off a chemical waste dump because I don’t want to pass it on to my kids and burden them with it."

What right does he have to 1.7 million dollars? The fact that he was the first person to register a domain? That's ridiculous. He did no work for it. He did not do anything to benefit society. His is just trying to extort society for that money by threatening to help criminals if we don't give it to him.

He has an asset that he values at $1.7 million. His right is that he owns it and can sell it as he see fit.

He has no obligation to M$FT or any of their customers.

What asset?

He has an informal agreement with a informal group of organizations to respect his decision of what records to return in response to DNS requests. No one is obligated to follow that agreement. This form of abuse of that informal agreement should result in the group of organizations unilaterally terminating that agreement.

> He has an informal agreement

It’s a legally binding agreement. I guess we should start yanking peoples’ homes because all they have is an “informal agreement” with the seller?

No it's not. He has no legal agreement with my DNS provider for them to do jack shit.

He has some legal agreement with his registrar, and maybe indirectly with ICAAN, but that legal agreement means jack shit to DNS providers, who are the ones that ultimately matter.

For an example of DNS providers already using this fact for the public good, see AdGuard DNS

So call your DNS provider and have them not resolve to his address.

It probably won't surprise you to learn that my DNS provider reads HN... so in a sense you could say I am doing that.

How is it abuse? Giant companies auction off lots of domains every day.

He is literally advertising to criminals... how is it not abuse.

He is not. He's saying it can be valuable to criminals, just like many other products sold everyday.

The fact that a criminal may acquire them and/or use them for nefarious purposes does not mean selling them is a problem.

Knowingly aiding and abetting criminals puts you right in jail.

He's selling the domain through an auction/resale service [1], so any question of "aiding and abetting" goes to them, not him. At the high end, these services have extensive anti-fraud and anti-money-laundering checks (speaking from personal experience working for a small registrar), so the question of direct liability is pretty well covered.

[1]: https://www.namecheap.com/domains/registration/results.aspx?...

Otherwise, you end up with a world where anyone who comes into possession of a dangerous item is obligated to potentially keep it forever and force all of their descendants to keep it forever.

The keyword is "knowingly". He's clearly well aware of the security risks and is doing his best to keep it safe (including asking Microsoft to acquire it for 10% of the revenue they make in an hour).

Yes, you're right, that is the keyword. This article, and statements like the following make it perfectly clear that if he follows through on his threat he will be knowingly aiding criminals.

> O’Connor said he hopes Microsoft Corp. will buy it, but fears they won’t and instead it will get snatched up by someone working with organized cybercriminals or state-funded hacking groups bent on undermining the interests of Western corporations.

A person can be reasonably confident that their immediate sale of an item is going to go to someone who will use it responsibly... while still worrying about its disposition five or ten years down the line. (Microsoft has already let this problem sit for 26 years, after all.) That still doesn't mean the person has any particular legal or moral responsibility to monitor their original customer indefinitely just because there's a future risk.

That is neither a threat nor proves that he knows anything about the buyer being a criminal. He's only worried about that possibility, which is a good thing considering he has been a good steward of the domain this whole time.

He doesn't know a criminal will buy it. In fact, because it's an auction, he doesn't even know who the buyer will be until it's sold.

This kind of reply reminds me of the vitriolic replies that companies leveled back in the day against the guys who registered donotreply.com.

They would try to alert companies using a domain they didn't own for communications to their customers that this was a bad idea, and soon after got nastygrams from the company's lawyers saying they'd stolen their intellectual property and wiretapped their communications.

http://voices.washingtonpost.com/securityfix/2008/03/they_to...

If this were a meat space address, this wouldn't even be an issue. Then or now

Consider this hypothetical: You buy a house, and its address somehow gets listed as an internal corporate postal address at BigCorp. You regularly get bag-fulls of corporate mail containing personal information. BigCorp refuses to changes their internal directories, and refuses to buy your home at a reasonable value.

The only real difference in the corp.com case is that instead of just one BigCorp, it's one BigCorp that's gotten a bunch of other SmallCorps and BigCorps to all incorrectly list the same address too.

On the same general note, "a business listed my phone number as theirs and refuses to change it" stories are pretty common, and often have the same "the business refuses to change it" quality.

And you're perfectly within your right to sell that address to anyone you so please. For whatever price.

You’d think so, right?

https://arstechnica.com/tech-policy/2016/08/kansas-couple-su...

What I mean is that no one will piss their pants about "morality" if that couple wanted to sell their house.

It's their house, they can sell it and the associated addresses to whomever they see fit

Agreed. As much as I would appreciate Mike acting for the public's benefit here, society isn't entitled to him giving away his property.

In his position, I would absolutely capitalize on the domain; consider that selling is one of the more harmless ways that value could easily be extracted from it. Maybe if I were a billionaire I would consider giving it away, but even then I would rather take the money and donate it than leave it in Microsoft's pocket, considering this is 100% their screwup.

He has no legal obligation. But we can also call him an asshole. Plenty of assholes never break the law.

Microsoft has had 25+ years to fix this. They could have offered to buy the domain at any time.

Instead they leaned on free benevolence from this guy.

I would argue yes just buying it first is all he needed to do to deserve to be able to set his own price. People buy and sell domain names all the time and the ones who scooped up Nike.com or NBA.com likely sold it for a pretty penny. They didn’t benefit society. I would argue there are lots of profitable ventures that don’t benefit society but we allow them I think smoking right away as one example. He is trying to take advantage of Microsoft mistake from what I understand. In the giant corporate world a mistake only costing 1.7mil seems like pennies and they should just grab it and put it behind them. On a side note what do you think of Bitcoin? I wanted to buy it back when it was less then 100 a coin but was broke. It would have shot up in price me doing absolutely nothing to benefit society and actually maybe one could argue hurting the environment as bitcoin mining is very energy intensive and also some may argue bitcoins facilitate criminal activities. But I would bet most here on HN would be okay with bitcoin as an investment. I see his domain no differently.

> take advantage

An asking price of $1.7 million is hardly "taking advantage" of a $286 billion company. Microsoft hoist themselves by their own petard here by letting this problem sit for 26 years: that's only about $65,000 per year, which is more than reasonable pay for somebody who's been effectively giving them free IT services that entire time.

I completely agree. It is pennies to this company this is no hardship for them. My personal name as a domain is being squatted on the .com domain for several thousand dollars. It is worthless and I can not imaging a time it will be worth something. But I don't complain and think I should get it for free. If I want my name domain I have to pay several thousand dollars. Had I bought it 20 years back it would have been pennies also. Such is life.

I agree that it's not taking advantage of Microsoft, but it's not because of the dollar amounts involved. If I do a fake refund scam to the tune of $20 on Amazon (which is a ~$1T company), that's still "taking advantage" of them. It doesn't matter that it's peanuts compared to their market cap, I'm still doing something wrong.

And as an aside, your stated market cap for Microsoft is off by more than a trillion dollars.

> They didn’t benefit society

Yes. However, whoever managed raise 1.7 mil probably did through earning it. Money goes both ways.

He owns it and can offer to sell it at any price. And it sounds like he's certainly helped to keep the security issues contained all this time.

Your statement is completely ridiculous. There's no requirement to "work" or provide benefit to society before you can sell something you rightfully and legally purchased.

Everyone investing in the stock market is the first to buy something at a lower price. Do they not own the stock? What work did they do when it increases in price? Do they have to prove to society that they're a good person when they offer to sell the stock?

A domain is a registry entry in a database, a contractual right, not property. Sure, some people have treated it as property with IP mechanizations, but it is not an asset in the sense of a house or other tangible. If a decision is made you can't trade in them, or makes it difficult (ARIN with IP block space comes to mind), you're outta luck.

Intangible virtual items can be legal assets with ownership. This is not a new concept.

> "If a decision is made you can't trade in them"

Ok, but it hasn't been made. Ownership can be sold and transferred so that's what's happening.

Registration information does not equal ownership. My phone number is assigned to my mobile provider account. I do not own my phone number, as it is not tangible property.

This is a pedantic argument that I suspect you know is completely irrelevant. The ownership is of the registration itself.

When you buy a share of a company, it's also just assigned to you. But you still own it.

Actually, when you buy a share of a company in the US, unless you're getting a physical stock certificate (which no one does), the registration isn't even assigned to you. It's assigned to the Depository Trust Company. You as an individual are then several layers of indirection removed from that.

This example is working against you here, as people do have a right to retain their phone number, similar to domain names. Your phone company cannot take your number away from you, and you have the right to transfer it to another company whenever you want.

Stock ownership is just an entry in a database.

Codified in law. The others I mention, not so much.

As far as I know, there's nothing specifically codified into law prohibiting others from stealing my wheelbarrow. It just fits into the general category of theft of an item owned by someone else. Domain names are treated in exactly the same way. The concept of private ownership of things (tangible or sometimes intangible) is definitely codified into law. And domain names are actually much more tangible than most IP. If I pirate a film, I'm only making an unauthorized copy; I'm not actually depriving the copyright owner of anything save for maybe some hypothetical revenue. But domain names aren't copyable; they are globally unique, and if you take someone else's then you are completely depriving them of their right to use it. It's theft in a very real sense, unlike piracy. The courts have found as such.

Do you have a link to a court case you can reference establishing precedent that a domain is considered tangible property? If so, I’m happy to eat crow.

https://www.casebriefs.com/blog/law/property/property-law-ke...

https://freedom-to-tinker.com/2008/10/18/kentucky-vs-141-dom...

They're intangible property (I never said they were tangible), though that distinction doesn't really make a big difference here anyway since the physicality of the property isn't relevant.

There's decades of case law supporting the idea that domains are in fact property. So you are, in fact, not "outta luck".

>Your statement is completely ridiculous.

Criticism of loose capitalism isn't automatically ridiculous.

>There's no requirement to "work" or provide benefit to society before you can sell something.

Well, obviously some people think that that is a problem with our current system of wealth distribution :)

I fail to see the criticism here, and yes it's ridiculous to say someone can't sell something they own without a subjective moral evaluation on how they benefited society first.

Some people believe ridiculous things. Doesn't make it any less true, and I've yet to hear of any magic utopia system that's any better than capitalism in reality.

I don't get what you're saying. That any possible alternative system of allocating DNS domains rather than "auction to the highest bidder" is necessarily a "magic utopia"? Sounds rather bizarre to me, personally.

You said "Criticism of loose capitalism" and "current system of wealth distribution", and nothing about the domain auction process.

There's little difference between this situation an one in which someone buys a property that then becomes famous in a movie or show.

Except in my hypothetical example your response makes you sound like some sort of communist outraged by the profit your neighbor made off their house, when you bought the decidedly unfamous one next to it.

> His is just trying to extort society for that money by threatening to help criminals if we don't give it to him.

Is he? Where's your proof? Perhaps he's just sharing his very novel experience of a property he owns that the world honestly should know about for security reasons. What if this man dies in a few months and we didn't know about this, then his kids sell it to the NSA or Russia, would you rather that?

Not if Microsoft wasn't willing to buy it at a reasonable price. For all we know he offered, they refused, and this is O'Connor's attempt to publicly pressure Microsoft into buying it at his asking price.

Microsoft's willingness to buy it is, in my opinion, irrelevant in this discussion.

If everything this "security team" from the article has said is true, this domain is Persona Non Grata. Its an armed nuclear warhead. There is no positive outcome for this story that begins with "And then the domain was bought by".

Its Microsoft's "responsibility" to "clean up after their mess". No; We're beyond fighting about who should take responsibility. Throw the ball in Microsoft's court and they'll offer $20k. Throw the ball back to O'Conner and he'll say it's worth far more. He throws the ball to the market. Terrorists notice that, wait, actually, that ball is a nuke. Cool, its at auction; Microsoft now has to pay millions of dollars. So our two options are: Microsoft buys the thing and we're safe, or they don't and we're fucked, and a couple people on reddit are mad at Microsoft for cheaping out, but they live on like it never happened, and we all forget for 18 months until, one day, at the top of hackernews we get a nice new HaveIBeenPwned.

At this point, this domain is like example.com; IANA owns that one. Its too generic. Its used in documentation. People mistake it for being meaningful. The only reason it hasn't caused issues is because the owner has, all thanks to him, not intended to cause harm to the public. But we're now in a place where we can do something about it, and this domain should be removed from public registration.

> Its Microsoft's "responsibility" to "clean up after their mess". No; We're beyond fighting about who should take responsibility.

I feel opposite. It is definitely MS's responsibility, but they don't care because they are not going to be pawned. Its the poor users who MS suggested to use corp as their AD domain without buying that domain in the first place.

Every time any corp fks up, the people have to pay for it (maybe by getting hacked, or being saved by state) and corps don't care.

> Its too generic

Right, and who chose it ? This domain is like example.com except it ain't because people don't mistake it for being meaningful, MS advised people to use it explicitly.

Microsoft have the money, 1.7mil is a rounding error for them. They could've paid the money, solved their problem and nobody would be discussing this on HN now. Instead everybody now knows how incompetent/boneheaded Microsoft are around this issue and they'll probably still end up buying the damned thing.

More to your point, this domain is now "too generic" because Microsoft made it so. example.com is going to be used by a wide collection of people, "corp.com" really only has this issue because of Microsoft, there's no generic reason why people would use "corp.com" in the same way they use "example.com".

Microsoft created this situation and effectively made that domain toxic, surely it's on them to fix it?

Except what's the human cost of this? If there is a stream of sensitive info, real people will be impacted.

Big corps are not usually the ones that are affected the most.

Would it be the corporation experiencing the pain of identity theft and fraud? Is it just the people in charge of Microsoft whose personal data is being waved around?

If a third party got burned, they should turn around and sue Microsoft.

MS deserves some responsibility for causing this. And "take your entire AD network down for some amount of time and break backwards compatibility" is not a reasonably fix.

I don't see why those third parties wouldn't sue the owner that sold this domain to unknown parties fully aware of the security risk.

Sue on what grounds? He has no legal obligation of any kind towards them, and they're the ones who incorrectly sent their traffic to him.

Microsoft certainly screwed up here, but all this guy did was... exist.

Technically, the domain owner probably has grounds to sue Microsoft.

By effectively configuring AD / Windows to DDoS the domain, on multiple protocols, MS deprived him of usability.

Seems pretty open & shut on loss of value.

That configuration is the only reason the seller is able to publicly demand such a high price without the universe laughing at him in concert.

To put it in perspective, dating.com sold for 1.75m.

To put it in perspective, Microsoft products have been spamming his domain for 26 years.

>To put it in perspective, [in 2010] dating.com sold for 1.75m.

That was 10 years ago.

"myworld.com" sold for 1.2m in 2017, "jade.com" sold for 1.25m, "vivo.com" went for 2.1m

In 2019, "voice.com" sold for 30 million usd.

Outlier. My search turns up 10 sales since 2017, only one was higher than 3.5m, and that's "voice.com." I chose a sale that was in the ballpark of the stated figure for "corp.com."

"California.com" sold for $3m this past year, so let's not pretend that much has shifted in the market for these domain names in the span of this decade. $1.7m is a hefty sum for a domain name that isn't even a word.

But it's an irrelevant debate.

My point is that the counterargument against any lawsuit would be that the high value of the domain name "corp.com" comes from the Microsoft issue, so it'd be pretty tough to argue that the owner was harmed by Microsoft.

Because he has no legal responsibility whatsoever. He is not responsible for the content that others send to a domain her controls.

No it’s any windows computer from a certain time frame used off it’s internal network which was set up with the default Active Directory settings for the internal domain.

He doesn't own shit. DNS is a centralized database entrusted to a non profit to serve the good of the internet.

Verisign is a nonprofit now?

Verisign has a business contract with ICANN to operate as a registry for .com. The contract has a bunch of legalese clauses which can be interpreted in a bunch of ways. They all encourage treating names as property because it makes them alot of money but it's bullshit, you get a limited "license" to a row in the database with a bunch of legal clauses and exceptions. The ultimate guidance for ICANN is supposed to be to protect the health of the internet, though they mostly focus on making money these days.

As I've said before, this is like saying that nuclear war is a good thing because it demonstrates the danger of nuclear weapons.

Isn't that true though?

Let's not & say we did

Why not?

I do wonder sometimes just how effective nukes would have been as a deterrent, if Hiroshima and Nagasaki weren't there as a case in point on just how devastating they are to civilians specifically.

He does not have the right to sell it. He has the Privilege of selling it.

Be very careful about that use of language; your rights, as a citizen of whatever country you live in, are generally limited and legally defined. Domain name ownership certainly does not qualify as a Right.

You're saying a domain ownership should be revoked based on a third party having bad defaults and the owner talking up the value of the domain?

Certainly, it's a squatted domain the owner has never had any interest in actually using and is now no longer even interested in holding. If what is in the article is true then I don't even think Microsoft should necessarily own the domain let alone put it out for public bid to see if a good guy is willing to pay more than a bad guy could make off of it.

The guy even claims "I don’t really need the money. I’m basically auctioning off a chemical waste dump because I don’t want to pass it on to my kids and burden them with it." so revocation and locking seems perfect, it's exactly what he wants.

You're putting up two completely different arguments here:

1. The domain was squatted and the owner did not put it to good use.

2. Because of a third party the domain is so toxic that it should be disabled for eternity.

Those are very different reasons, which one warrants a revocation?

The first one is true for very many domains and probably a large reason that ICANN and registrys have large revenues. The second one is probably unprecedented under a gTLD.

If this was under a cTLD I would agree that it would be okay, if accordance under that countries laws and a proper legal process, but under a gTLD I think these measures should not be taken.

Two arguments yes but they aren't presented independent as you pose. Scenarios where 1 xor 2 is true is a much more complicated conversation that we don't need to get into in this case. Is there a general solution to those scenarios independently? Maybe but I don't know for sure in that case.

What I do know is an inactive domain the owner wants to get rid of because it's a massive burden due to being so toxic should be revoked and locked not sold to the highest bidder. I don't know what we should do if it were an active domain and the security question were posed or what we should do about squatting in general (though I will say the money from the sale does not go to ICANN or the registrar).

Scenarios 1 & 2 have very different rationales for being applied to a gTLD though. Scenario 1's problem (domain squatting) has been the fact for basically forever for all TLD's. Scenario 2's problem would be pretty novel to fix at least for gTLD's, so it doesn't really matter as long as Scenario 2 is in the game.

I'd also be interested if he said he would willingly give up the domain for free if it would not pose a security risk? From my read he still wants to sell it to the highest bidder.

> the owner has never had any interest in actually using

What are you basing this on? Did you even try to research the history of this domain? https://www.haven2.com/index.php/archives/corpcom-registry

Yes. Its a combination of several things, and I stress "extreme circumstances"; this qualifies.

The domain clearly would have a broad security impact if it fell into the wrong hands. It is generic. It is being squatted, rather than actively used in any value-generating capacity. The owner has demonstrated poor stewardship of the domain.

This person does not have the right to compromise the security of millions of people just because he was early to registering a domain name. Domain name registrations are not a Right; they're a Privilege granted to registrants by custodians of the internet that we all help build, secure, and maintain.

Its not enough that Microsoft simply buy the domain (though this would be a fine outcome). ICANN should just shut it down. Revoke the registration and refuse to issue it again. We've proven that there are hundreds of thousands of clients sending personal data to this domain; it simply should not be in the hands of anyone, period.

I think an extreme circumstance would be someone hijacking microsoft.com and trying to ransom it off but I'm not really familiar with ICANN's specific powers.

Why should everyone in the world not get to use a thing because Microsoft has some naming scheme? These places have been shouting whatever data at a random (edit: unintentional and uncontrolled rather than random) spot on the internet for years and that's a huge problem.

Opening up an auction is a nice way to draw attention to the problem, get MS to literally&figuratively pay for it (even if the price 10x'd it's not like M$ couldn't handle $17MM), and make it no longer the seller's problem.

The story is not fully clear. It's possible he already tried to contact Microsoft and tried to sell it to them. They might have refused. But the idea of it going on an auction might pressure them into buying it.

Brian did contact Microsoft for comment, and their response doesn't mention that they want to buy it.

I consider it bad reporting that Brian doesn't mention whether Mike already contacted Microsoft or not.

> I consider it bad reporting that Brian doesn't mention whether Mike already contacted Microsoft or not.

To my other comment you say 'contact Microsoft' as if there is a phone line which goes directly to the decision maker for this type of 'purchase'.

Brian could have said Mike tried or that Mike didn't know how to contact Microsoft. And Brian contacted Microsoft, so they could have offered the deal to them at that time, but the article doesn't mention it.

My BigCorp experiences make me picture events happening this way: somebody made Microsoft an offer, got told "let me ask my manager about that", and then the message got lost in twelve layers of management and/or just outright discarded by one of the human spam filters in one of those layers of management.

It's incredibly easy to find someone at a company like Microsoft who would know who the person is to make a decision like this. For example; I'd start on Linkedin or Twitter, searching for someone with a title that contains "Security", "Senior", "Distinguished", "Manager", etc. You'll find a dozen people. Send a few messages out that outline the situation. They're not the person who makes that decision, but they'll know where to direct it, and if its serious, they'll direct it.

No, there's no phone line. No one calls anyone anymore. Find an entry into their corporate graph, and let them resolve it internally. Or, get an article published on a high-profile blog outlining why they should buy it, and they'll be calling by Monday. Its not that hard.

Thank you for your comment. Made me recall an important bit of reporting that I somehow omitted from the original story (now updated and rectified). O'Connor told me that several years back he got a $20k offer from Microsoft for the domain, but at the time he thought that was too low and didn't reflect the market value of the domain. He turned it down.

BTW, where do I go to buy it? Who's mediating the auction and how to I put my bid in?

Visiting http://corp.com/ takes me to a GoDaddy parking page and tells me that GoDaddy will happily convey my offer to the owner for $69.99 plus a 20% buyer broker fee. Is that the plan?

https://www.haven2.com/index.php/contact

https://www.haven2.com/index.php/domains

Hi Brian. Sorry to contact you through this, but could you please make your website responsive. It is hard reading your blogs from mobile phones. Thank you.

From TFA: > Asked why he didn’t just give corp.com to Microsoft as an altruistic gesture, O’Connor said Microsoft actually offered to buy the domain several years back for $20,000.

As krebsonsecurity said, he edited the article to add that because of my comment.

> I wonder what kind of authority ICANN has in revoking domain name registrations in extreme circumstances.

Not even close to the way this works ICANN does not 'revoke' domain names. There are ways to take possession of a domain name but that would not be the process (nor should it be).

> He could just quote Microsoft $2M and be done with this whole thing.

If you think selling anything and in particular a domain name is that easy you should try to sell a domain name to a large corporation and report back the results. It's not trivial and to a large corporation in particular and further for any amount (much less way less) not assured in any way.

Because if he'd have done that, this wouldn't be news, it wouldn't be on HN, and this somewhat invisible security hole would remain in the shadows. Perhaps O'connor would be just fine with ICANN ripping this away from him, but perhaps that bluff needs calling.

> He could just quote Microsoft $2M and be done with this whole thing.

He could but MS would laugh in his face. The auction and publicity are the only way to establish the domain's actual market value and to pressure MS to pay it.

Am I wrong, or does one update from Microsoft make this whole drama go away and the "problem" a moot point?

Can't update old windows boxes that refuse to update. And there are a lot of those.

We're not just talking about Windows boxes. We're talking about entire Active Directory networks.

In this sense, it's more like the ipv4 -> ipv6 migration.

Why bring up ICANN? They don’t control .com, verisign does.

Perspectives like this and others are one of the many reasons I greatly enjoy HN. I didn’t even consider the situation in this way, yet is makes much more sense than what I constructed in my head. Thank you for that.

What a persona this paints of the seller.

Would like to add that I also share your wonder. To me, this needs to evolve to anecessity for them (ICANN, in terms of ability) rather than just an “if”.

Please forgive me my lack of context surrounding this, but would love to learn more about why Corp.com is being sent various data (some sensitive, as mentioned in the article) from various parties in the first place. Did it use to serve a purpose for MS or other?

> What a persona this paints of the seller.

Yeah! How dare he care about his own livelihood rather than “security”?!? What an asshole!

It's hard for me to have sympathy for him "protecting his livelihood" when we are talking about a lucky gamble that appreciated by 140000x, he's already successfully sold several of them, and almost the entire value is driven by scamming opportunities

> and almost the entire value is driven by scamming opportunities

That’s a bizarre claim. Maybe you should read up on previous high value domain name sales before making such statements.

The asking price is perfectly reasonable even if you disregard all the “scamming opportunities”.

Pretty much any four-letter .com domain (even gibberish) would sell for upwards of a million dollars these days, too. $1.7 million for a recognizable four-letter domain is if anything substantially lowballing it.

The whole affair seems bordering on blackmail: “pay me, MS, or your customers will get hacked”.

If you were truly concerned about security, you’d have just transferred the domain over. If you want to make a good profit off of that, though, please—don’t make a theater.

If you are both genuinely concerned about security but also desperately need money, what you would effectively end up doing is a reverse auction—start high and go lower until the one buyer you want agrees.

> please—don’t make a theater

Why not? If Microsoft is unwilling to pay a reasonable amount for the domain, the logical action to take is to publicize the flaw in their system.

Giving security flaws the publicity they deserve: I’m most unreservedly in favor.

Using publicity to hold someone hostage in order to extract money while hiding behind security concern claims: not a good image.

If I were in a situation where I have nothing to eat and urgently need to liquidate such a domain, I would raise awareness publicly but negotiate in private. If I were relatively well-off, I would arrange a pro-bono handover, publicly or privately, and of course try to raise awareness anyway.

To make matters worse, the sale appears to be handled via an auction. The wide publicity given to the event via Brian Krebs’s website must have attracted attention of a wide range of players, motives unknown. For a reputable corporation to find itself bidding against a theoretical Bitcoin millionaire blackhat is far from desirable on a couple levels (I doubt auction’s KYC can really prevent that, but if it is strict enough then I take back this particular concern).

Thus, the situation as it is just seems to smell to me, though I’m not entirely ruling out good faith with unfortunate execution.

If your livelihood is based on squatting domains you bought in 1992, you won't find me crying tears of sorrow for your loss when you only make a couple million dollars instead of whatever number you think you're owed for adding zero productive value to the world.

Scratch that; domain "investing" actually removes productive value from the world. Someone else might own that domain and actually do something incredible with it. Microsoft clearly could have; they use it all over their documentation (and they're idiots for doing so, but what's done is done).

> domain "investing" actually removes productive value from the world

Does it? These domains are available for those who want them at fair prices. Why is the current situation any worse than one in which these domains would be snapped up for low effort personal sites?

> Someone else might own that domain and actually do something incredible with it.

Why? What would be an example of "something incredible" that'd require a very specific domain name like this?

Why not take microsoft.com then in the same way. One could argue the software there has led to a ton of criminal activity. Since we've now decided that private property laws don't matter anymore, then this domain should be blocked from registration for 100 years. Let's throw in google.com. That has led to tons of crimes too, just from the malware ads, let alone everything else.

Obviously all these suggestions are equally ludicrous.

Also if this is such a big issue, you can simply configure your local DNS server to point that domain to whatever you want and ignore its original SOA.

If everyone would do that the domain would be worthless.

Reply on news.ycombinator.com