Hacker News Reader

Comment by tasuki | Hacker News Reader

> For me, the question remains why do user have to pay for domain names.

Because they're scarce! Should you have `x3blah` or should I have it? If domain names are free, how do we decide who operates which domain?

If I understood it right, one of the goals of Handshake is for names to be almost free. With a near-infinite number of TLDs which you can buy for as little as $0.09 (and renew for $0.02 every two years), less desired names become essentially free.

Furthermore, you can become a registrar! With such a low cost (about $2 over our expected lifetime), you can charge extremely low fees for `domain.x3blah` or even give out the second level domains for free!

View on HN

What if no one gets "x3blah" and we each get some random string, e.g., an ed25519 public key.

Handshake looks like it wants to create another "gold rush" for "vanity" names. We have already had that. We have already seen how it plays out. It has been a while since I read through the Handshake docs. Are there limits on how many names a single applicant/organisation could register.

> What if no one gets "x3blah" and we each get some random string, e.g., an ed25519 public key.

I think you end up with TOR!

Names are just nicer, more convenient, easier to remember.

> Handshake looks like it wants to create another "gold rush" for "vanity" names.

I don't think that was the goal, but yes, this gold rush is already happening, even though it's not clear whether Handshake will ever receive any meaningful adoption. And I can understand why you find it distasteful.

> Are there limits on how many names a single applicant/organisation could register.

There aren't, and if there were, they would be easy to bypass.

Haha great point re: tor! You can even generate a vanity address using scallion. Of course, it’s subject to impersonation by a similar address if someone else wants it badly enough and has the hashpower to generate it.

Personally I’m interested to see where Handshake goes. Thanks for your constructive comments on this article.

I can enter x3blah from memory. I can print it on a poster when promoting my service.

I can't memorise AAAAC3NzaC1lZDI1NTE5AAAAIFwAU7Q9tccWIyPviJuzAatFIgQZVRr7mExznfbUR9Il. I can't print it on a poster when promoting my service. I can use a QR code, but that's ripe for exploitation. Someone can easily replace the QR code on my poster, and there's no way for anyone viewing the poster to know that it's not the correct QR code.

What's the point of the name at all if it's not memorable?

Or to put it another way, do you really want email address AAAAC3NzaC1lZDI1NTE5AAAAIFwAU7Q9tccWIyPviJuzAatFIgQZVRr7mExznfbUR9Il@gmail.com?

> I can't memorise AAAAC3NzaC1lZDI1NTE5AAAAIFwAU7Q9tccWIyPviJuzAatFIgQZVRr7mExznfbUR9Il. I can't print it on a poster when promoting my service. I can use a QR code, but that's ripe for exploitation. Someone can easily replace the QR code on my poster, and there's no way for anyone viewing the poster to know that it's not the correct QR code.

Which isn't a problem of the qr code, since you can't tell if someone replaced AAAAC3NzaC1lZDI1NTE5AAAAIFwAU7Q9tccWIyPviJuzAatFIgQZVRr7mExznfbUR9Il with AAAAC3NzaC1lZDI17TE5AAAAIFwAU7Q9tccWIyPviJuzAatFIgQZVRr7mExznfbUR9Il.

At least you have a fighting chance of realising something is wrong when they say "x3blah has released a new album. Get it now from x4blah.com". Humans can only understand human understandable things.

If the point of the domain name for you is marketing, then get one you think is "memorable" and use it as a CNAME.

The point for me would be non-marketing uses, e.g., to get an SSL cert so I do not have to use a self-signed one when monitoring encrypted egress traffic from the local network. That name does not need to be memorable. I can get a free cert from Let's Encrypt but I cannot get free domain name. Best I can get for free is a subdomain of someone else's domain name.

As you know, not every domain name is used for the purposes of email addresses or a website. To use a common example, AWS Cloudfront subdomains are not memorable but they are useful to AWS. Like subdomains, domain names can still be useful without being memorable.

A lot of low-importance tlds offer domain names for $0.99/year. At that rate, I think almost anyone can afford it.

What are some examples of such tlds?

Hmm, it turns out that I’m actually wrong. I’d see domain registrars offer really cheap domains before, but they’re actually one or two year offers that then bump up to $10/year or $20/year.

We need a tld that offers domains for really cheap with the understanding that it’s mainly for people owning shdkshfkskfjslfjsk.sometldname.

I'm checking Gandi.net, and .site, .website and .space seems to be around 1 USD per year. They are marketing it as 95% off, but that doesn't change the fact that it's that price.

> If the point of the domain name for you is marketing, then get one you think is "memorable" and use it as a CNAME. The point for me would be non-marketing uses

This is a very fair and valid point. Thank you for pointing this out.

> to get an SSL cert so I do not have to use a self-signed one when monitoring encrypted egress traffic from the local network

This sounds like you're doing proxying / TLS interception / MITM? If so, you need a signing certificate with authority to sign for any arbitrary name. No vendor provides this for free, and using your own self generated CA is the solution here.

> Best I can get for free is a subdomain of someone else's domain name.

It's unclear what you mean here, as the words you're using are somewhat overloaded, depending on context.

An arbitrary gTLD is not something you can get for free, until we have a better solution for DNS than the current approach.

Anything else is just variations on a subdomain. Heck, technically even a gTLD is a subdomain of the root domain '.', where you don't own anything there either, and are simply getting a subdomain granted to you by the roots.

When you look at it from that perspective, and you're simply looking for something that is unique for you, what's the difference between a subdomain from a dyndns provider, and a subdomain from a registry?

"An arbitrary gTLD is not something you can get from free, until we have a better solution for DNS that the current appraoch."

This implies that there is a better approach. I agree. There are many possibilities. I have been running own root zone at home for several decades. I routinely experiment with different ideas. I am aware of many possibilities.

I do generate a CA pem file using openssl in order to view own traffic. However even with all these hoops we jump through to do such basic things, "Big Tech" seems to actively try to discourage users even more, .e.g., from monitoring their own traffic. For example, subjecting the user to a keylogger in Chrome and forcing them to type some undocumented, opinionated shibboleth such as "badidea" or "thisisunsafe" to proceed.

https://stackoverflow.com/questions/35274659/does-using-badi...

The subject of the OP is what was originally supposed to be a "non-commercial" TLD, which since abandoned that designation and began charging fees, and, more importantly, the current and future lack of any restrictions on raising those fees. If one is using a TLD in ways that demand transparency, e.g., to represent an entity that is taking money from the public, then involving a third party that accepts personally identifiable information, e.g., a registrar, makes some sense. However, interactions with the public, e.g., commercial uses, are not the only ways the internet can be used and such uses are not the only way domains can be used.

This is what tor/i2p do. It is honestly much better (it gets rid of CAs!) but you will get people screaming for "convenience", despite never typing a domain name themselves.

As of late 2019, there were about 3,6×10⁹ domain names registered it seems[11].

Taking "ycombinator.com" and keeping just the 11 ycombinator letters, and supposing you would allow only the 26 letters of alphabet, that's about 3.6×10¹⁶. That is 7 order of magnitude bellow the number of registered entries.

The only scarcity here is the manufactured one.

http://www.circleid.com/posts/20190829_verisign_q2_2019_indu...

lets start two companies. i'll take coolnewcorp.com, and you can have qwrfggtylop.com. seems fair!

Actually you’re absolutely correct.

If there wasn’t scarcity built in, someone would simply take all the names in a Sybil attack.

While the number of possible domain names is very high, the number of valuable ones is much lower.

Reply on news.ycombinator.com