New ZIP domains spark debate among cybersecurity experts

"It's not new, it's caused a lot of problems, and we're going to make it worse"

What's really stupid about this is a huge number email systems just outright block things like .com and .exe attachments of any kind to avoid direct executable content. Zip content is generally allowed, but typically scanned.

Well, not to maximize user confusion we're adding a new context to one of the most common file extensions in email and downloads there is. Yay Google, thank you very much.

> Some of these TLDs are such a cashgrab and so useless.

I think this is the primary reason why this is getting so much negativity: it’s something a bunch of people in the internet community will need to spend time thinking about but is mostly an exercise in collecting rent from a handful of companies like 7-Zip and WinZip.

It's been completely replaced with .exe since 16-bit computers became common.

I've had a quick look at a Windows 10 install and while there are still some .com files in there, they all appear to actually be the modern Portable Executable format.

This makes sense given the old .com format was really just a binary blob that would be loaded into a single 64k memory segment. Keeping backwards compatibility for running them on modern 64bit processors would be difficult. At the same time Microsoft wouldn't want to break people's batch files if it can be avoided. By replacing the .com file's contents with logically equivalent code in a more modern executable format they can keep those batch files running without having to actually support legacy .com executable format.

(note, that's all guesswork, Microsoft could have had a different reasons for doing it :) )

There are a massive number of windows applications that end up with special consideration around .com, and any potentially executable content like .exe, .cpl, .scr and others. Also, .com tld was created around 4 years before the word cybersecurity was coined. So you have really old stuff that was created before the vast majority of modern internet software was written and that ecosystem grew up with the expectation and quirks of the behaviors of the tld. Simply put when .com files were common, internet users were far less common, and generally more experienced computer users, and the number of bad actors was far lower.

Way back in the IE3/4/5 days visiting a .com website would commonly leave files with a .com extension in your temporary internet files with random non executable content inside the files, which made anti-virus really happy. Microsoft went about hiding the temporary internet files in more convoluted fashion over time also so the end user would not stumble upon it.

Now with the .zip domain, we're getting back into new and fun issues with file:// vs https:// context.

Twitter didn't exist. There was no echo chamber of fear mongering.