Hacker News Reader

Comment by huffmsa | Hacker News Reader

He has an asset that he values at $1.7 million. His right is that he owns it and can sell it as he see fit.

He has no obligation to M$FT or any of their customers.

Agreed. As much as I would appreciate Mike acting for the public's benefit here, society isn't entitled to him giving away his property.

In his position, I would absolutely capitalize on the domain; consider that selling is one of the more harmless ways that value could easily be extracted from it. Maybe if I were a billionaire I would consider giving it away, but even then I would rather take the money and donate it than leave it in Microsoft's pocket, considering this is 100% their screwup.

He has no legal obligation. But we can also call him an asshole. Plenty of assholes never break the law.

Microsoft has had 25+ years to fix this. They could have offered to buy the domain at any time.

Instead they leaned on free benevolence from this guy.

What asset?

He has an informal agreement with a informal group of organizations to respect his decision of what records to return in response to DNS requests. No one is obligated to follow that agreement. This form of abuse of that informal agreement should result in the group of organizations unilaterally terminating that agreement.

> He has an informal agreement

It’s a legally binding agreement. I guess we should start yanking peoples’ homes because all they have is an “informal agreement” with the seller?

No it's not. He has no legal agreement with my DNS provider for them to do jack shit.

He has some legal agreement with his registrar, and maybe indirectly with ICAAN, but that legal agreement means jack shit to DNS providers, who are the ones that ultimately matter.

For an example of DNS providers already using this fact for the public good, see AdGuard DNS

So call your DNS provider and have them not resolve to his address.

It probably won't surprise you to learn that my DNS provider reads HN... so in a sense you could say I am doing that.

How is it abuse? Giant companies auction off lots of domains every day.

He is literally advertising to criminals... how is it not abuse.

He is not. He's saying it can be valuable to criminals, just like many other products sold everyday.

The fact that a criminal may acquire them and/or use them for nefarious purposes does not mean selling them is a problem.

Knowingly aiding and abetting criminals puts you right in jail.

He's selling the domain through an auction/resale service [1], so any question of "aiding and abetting" goes to them, not him. At the high end, these services have extensive anti-fraud and anti-money-laundering checks (speaking from personal experience working for a small registrar), so the question of direct liability is pretty well covered.

[1]: https://www.namecheap.com/domains/registration/results.aspx?...

Otherwise, you end up with a world where anyone who comes into possession of a dangerous item is obligated to potentially keep it forever and force all of their descendants to keep it forever.

The keyword is "knowingly". He's clearly well aware of the security risks and is doing his best to keep it safe (including asking Microsoft to acquire it for 10% of the revenue they make in an hour).

Yes, you're right, that is the keyword. This article, and statements like the following make it perfectly clear that if he follows through on his threat he will be knowingly aiding criminals.

> O’Connor said he hopes Microsoft Corp. will buy it, but fears they won’t and instead it will get snatched up by someone working with organized cybercriminals or state-funded hacking groups bent on undermining the interests of Western corporations.

A person can be reasonably confident that their immediate sale of an item is going to go to someone who will use it responsibly... while still worrying about its disposition five or ten years down the line. (Microsoft has already let this problem sit for 26 years, after all.) That still doesn't mean the person has any particular legal or moral responsibility to monitor their original customer indefinitely just because there's a future risk.

That is neither a threat nor proves that he knows anything about the buyer being a criminal. He's only worried about that possibility, which is a good thing considering he has been a good steward of the domain this whole time.

He doesn't know a criminal will buy it. In fact, because it's an auction, he doesn't even know who the buyer will be until it's sold.

This kind of reply reminds me of the vitriolic replies that companies leveled back in the day against the guys who registered donotreply.com.

They would try to alert companies using a domain they didn't own for communications to their customers that this was a bad idea, and soon after got nastygrams from the company's lawyers saying they'd stolen their intellectual property and wiretapped their communications.

http://voices.washingtonpost.com/securityfix/2008/03/they_to...

If this were a meat space address, this wouldn't even be an issue. Then or now

Consider this hypothetical: You buy a house, and its address somehow gets listed as an internal corporate postal address at BigCorp. You regularly get bag-fulls of corporate mail containing personal information. BigCorp refuses to changes their internal directories, and refuses to buy your home at a reasonable value.

The only real difference in the corp.com case is that instead of just one BigCorp, it's one BigCorp that's gotten a bunch of other SmallCorps and BigCorps to all incorrectly list the same address too.

On the same general note, "a business listed my phone number as theirs and refuses to change it" stories are pretty common, and often have the same "the business refuses to change it" quality.

And you're perfectly within your right to sell that address to anyone you so please. For whatever price.

You’d think so, right?

https://arstechnica.com/tech-policy/2016/08/kansas-couple-su...

What I mean is that no one will piss their pants about "morality" if that couple wanted to sell their house.

It's their house, they can sell it and the associated addresses to whomever they see fit

Reply on news.ycombinator.com