Hacker News Reader

Comment by tuckerman | Hacker News Reader

States usually control a top level domain under .gov (e.g there is labor.ca.gov for California’s department of labor).

.us on the other hand is freely available for anyone to use (and in my experience is usually quite cheap)

States being part of .gov is relatively new. There was a very long period where .gov was exclusively for the federal government. The state governments were under the domain (abbreviation of state).us, and everything was a subdomain of that.

yeah I still remember my grade school website's domain ended in ".k12.<state abbrev>.us"

Seems ripe for abuse if such registrations aren't being securely controlled

But you don't get it. No registration is necessary. All an attacker needs is access to the authoritative DNS servers. They can get a delegation or insert their own resource records. Why go through a registry and give up a credit card and personal details?

I think they're referring to <state>.us registrations

I think at this point it’s been allowed for over 20 years but I’m sure there is a mixture still.

I was mostly trying to point out that registering under .us is pretty trivial. There is no need to try and sneak something into some states’s dns records, anyone can just go on any registrar and purchase something directly under .us

New York City, a municipal government, used to have its website at www.ci.nyc.ny.us, now it’s at nyc.gov. But NYC still has a bunch of active websites hosted at *.nyc.ny.us.

NYC also has a TLD of their own. e.g: https://www.archives.nyc/

That's privately controlled, not like .gov. But yes.

Reply on news.ycombinator.com