Hacker News Reader

Comment by teddyh | Hacker News Reader

I would go further and say this: Never treat foreign ccTLD’s (two-letter domains) as anything you can just register and use a domain in. You should only ever use a ccTLD of your own country or region you actually have your main presence in.

Your domain name is often your most secure key to your entire online identity, and you want that to be on as a secure legal footing as possible.

Older discussion here: <https://news.ycombinator.com/item?id=32797286#32801880>

Disclaimer: I work at a domain name registrar.

View on HN

People look at me like I'm crazy when I suggest that Notion's use of the Somalia TLD is a security concern that should give pause to anyone looking to store confidential data. This includes Notion's own recruiters.

I still think that's probably the biggest mistake that company has made. It seems baked in to their architecture now. But I think any company using a vanity domain in this manner is acting irresponsibly.

FWIW I don't think the "colonialism" argument makes sense for this or other vanity domains. But the use of vanity ccTLDs is still a huge, underappreciated security concern. Companies willingly expose themselves to the risk of their domain being hijacked (or "legally" taken away) with zero recourse - or worse, putting their government in a situation where they have to choose between trying to intervene or having a bunch of their citizens' data compromised. It betrays a security naivete, oblivious to what state-sponsored APTs out there are capable of once enough is at stake.

I know this is good advice, but I simply value vanity TLDs too much to ever stop. I've got all of my projects' domains on absurd gTLDs and I'd never have it any other way. My users enjoy it and so do I.

One thing to consider is to have your publicly-visible web sites on vanity domain/domains, but all your server infrastructure on a domain in your local stable ccTLD.

I recall a HN post within the past few years of an issue with a particular TLD (I think it may have been .io) that resulted in an outage and the conclusion was exactly this. Use whatever nice-looking domain you want for marketing, but stick with something stable for infrastructure.

Why does it even matter what domain your servers use internally? Most servers I've ever seen were actually using raw IPs, and the few exceptions used an internal DNS system that couldn't have cared less what the internet thought their domain was.

Evolving such an infrastructure is incredibly painful. Want to move to a zero-trust security model? How about migrating only some services to a different provider?

Set it up right from the start with a domain name you control (or one that is reserved for private use in an RFC). You can still use internal DNS if you want the additional layer of obscurity.

Personally, I prefer to use the internet as it is and not build up and maintain my own parallell infrastructure.

Not internally, but API endpoints for customers.

Newer / weird gTLDs are not as problematic as ccTLDs in unstable jurisdictions, by any means.

If they really are gTLDs, I wouldn't worry.

Newer gTLDs can start price gouging you at any time. Don't use them.

what is vain about having a domain?

<https://en.wikipedia.org/w/index.php?title=Vanity_domain&old...>

About as useful as calling someone vain because they wear clothes.

"Vanity domain" is based on the common (in US English) term for custom license plates, "vanity plates". Neither is meant to indicate an accusation against the person's character, it's just a figure of speech.

I used to work at a registrar and I completely agree with you. This is exactly my take as well (with a small exception for .eu, just don't use it)

For your online identity (ie email address) I'd even go as far as suggesting not using a ccTLD at all, no matter if you check all the boxes. No fancy gTLD either, just use a .com. I don't think any TLD is remotely as reliable as this one (maybe .net because they're both Verisign, but that's it)

I’d say that it depends on your situation and TLD registry. For argument’s sake, if I was a company in, say, India, would I be able to trust that Verisign would keep my .com or .us domain rights against, say, Google? Probably not, so I’d probably prefer a .in domain in that case, since an Indian authority or registrar would be more amenable to arguments and reasoned discourse with me, an Indian company.

For a company yeah, I would definitely consider the ccTLD. As an individual, not so much

What's wrong with .eu domains?

You’re unfortunately not guaranteed your country will be a part of EU forever. With Brexit, there was a really long transition period for UK citizens, but in the end they couldn’t keep their .eu domain.

Fortunately .eu is not that popular as a TLD, and Brexit is not a common scenario, but the transition was painful. Honestly we’re all 1 bad election away from $CountryExit, so at least I’m not taking risks with my domains. I don’t want my contact@my-name.eu to become unavailable to me in 10 years.

Nothing, but Brits had to quit their .eu domains due to Brexit. Which seems reasonable to me. Of course, Brexit wasn't; it was manipulated by the Russians.

Wow, TIL .eu had a residency/domicile requirement! That indeed disqualifies it for many use cases.

Before .eu we had .eu.org where the country level was administered by so-called Good People (networking techies of the 90s), so you could have e.g. nl.eu.org this was for free. Back then (end 90s) I didn't envision UK leaving EU. I'm from NL, and I cannot envision NL leaving EU either.

But either way I agree with another comment you're better off with a ccTLD of the country where you were born and/or are residing. Though if I were born in Russia and were residing in USA I wouldn't want a .ru domain (unless if I were running a criminal enterprise?). At least not now. I do think it would be cool to own a .su domain. But that's the thing. Cool, not for anything serious. This was cool in the beginning of the internet, with a fun play e.g. on your last name (gongri.jp comes to mind). But nowadays with the internet being deeply rooted into our every day lives, it is no longer the most clever thing to do. Although as a Dutch person, I wouldn't be particularly worried about a .jp domain. We're on friendly terms.

A lot of sites use .org because .com is a bit censor-happy when it comes to certain topics.

What topics? I’ve never heard of it. Any examples of this happening?

thepiratebay

> You should only ever use a ccTLD of your own country or region you actually have your main presence in.

Don't do this either.

Countries have rules and regulations around who can own certain domains. It's really annoying when there's a million problems to fix and a business restructure potentially affects whether there even has to be a conversation on if it affects the use of a domain name.

Heaven forbid a tech company should be forced to obey applicable laws and regulations. Those strict regulations are part of your brand; if you register, say, a .de domain, a user can be reasonably sure that you’re not some weird fly-by night operation whose real company name is something else entirely. This is an asset for you.

As someone who owns a .de domain (for random reasons) and has never even been to Germany, I would argue "reasonably sure" should be more like "hopeful" ...

Strong agree. I use my country’s ccTLD as my primary domain, and my domain was stuck in limbo for 6 years where I could not move registrars because the Registry decided to do a hostile takeover of all domains managed by a specific registrar. The lawsuit and arbitration took 4-5 years, and the registry had to apologise in the end.

But that limbo was quite scary to deal with, not being able to change my nameserver or renew the domain.

I’ve documented it here: https://gist.github.com/captn3m0/3ca2752f1394ef779d0e0bd0e04...

I would generalize this into avoiding any TLD which controlling entity does not deserve long term trust. Goverments of other countries are one kind, and I would add to that list companies such as google who could at any day put a gTLD into its graveyard. We have already seen some of the new gTLD that shortly after being created was then abandon by their operator (https://news.ycombinator.com/item?id=17624158).

.io for example should be considered harmful because their operator Ethos Capita has a history of incompetence, corruption and mismanage. They forgot to renew some of the nameservers for the TLD, allowing security researchers to take partial control of the TLD! They also had major outages like randomly giving NXDOMAIN for long periods, prompting articles like https://hackernoon.com/stop-using-io-domain-names-for-produc.... Ethos Capita was also the company behind the infamous attempt to buy .org and the associated insider dealing.

Registering a domain name is a long term partnership, and the cost of breaking that partnership is usually much more costly than people realize until the point when forced to do it.

> Your domain name is often your most secure key to your entire online identity, and you want that to be on as a secure legal footing as possible.

No, it absolutely isn't. Domain names are rented from a TLD registrar, someone who literally just controls a bunch of DNS servers and some automated systems that's approved by and has paid ICANN. They can reject your renewal for any reason and there's nothing you can do about it from an ICANN or court perspective. Worse, what walks in domains is money, which is why registrars can sell "premium" domains that aren't owned for exorbitant prices.

Ordering from your own country maybe ups the ante from a civil court perspective if you have money to sue a registrar and the time to go to court for it.

> Ordering from your own country maybe ups the ante from a civil court perspective if you have money to sue a registrar and the time to go to court for it.

Yes, that’s my point. If your local government and associated court system is completely unworkable for you (corruption, onerous fees, etc.), then some other TLD might be preferable. But a local citizen will almost always have a large advantage in a dispute with some foreign entity. Therefore, you should almost always try to get this advantage by using your local ccTLD.

That was a point, but your first point was that domains are secure sources of web identity. That's what I disagreed with. I do agree that if your civil courts are knowledgeable you at least have some defense, but domains are more rent and less property which makes them an insecure form of identity imo.

You might own your house, but if you stop paying taxes, you will, somehow, lose ownership of it. The same thing applies here.

There is no such thing as absolute property. Legal entities can confiscate and expropriate whatever they think they should, regardless of ownership. Everything is fluid and exists on sufferance. If you want absolute irrevocable control, use a darknet, like .onion.

I introduced the word rent, but I'm realizing my issue with domains as identity is that they're more analogous in my mind to property than identity.

My name and identity are mine even if I don't pay taxes. Identities aren't fully immutable but certainly not transactionally transferable. PGP, for all its flaws, is much closer to the concept of provable identity, imo.

I do understand your underlying message which is to function independently on the web you absolutely need a name you can rely on. We agree there, I just don't think the system or things that support it match the underlying needs/wants.

You really don't know what you're talking about.

First, you've confused registrars and registries - registrars don't operate DNS servers for TLDs; registries do. This isn't a pedantic point; understanding the distinction is absolutely key for understanding how domain registrations work.

Second, registries (for gTLDs) have agreements with ICANN that provide legal protections for domain registrants - including protections against denying renewals or jacking up renewal pricing. You can see the agreements here: https://www.icann.org/en/registry-agreements

This is not the case with ccTLDs; each ccTLD registry can operate as arbitrarily and capriciously as they want, which is why teddyh's advice to avoid foreign ccTLDs is quite sound.

> You really don't know what you're talking about.

I used the wrong word and suddenly I don't know what I'm talking about, but somehow I know how that system works.

ICANN defers to the courts and doesn't differentiate between a registrar and a registry in dispute resolution:

https://www.icann.org/resources/pages/help/dndr/udrp-en

https://www.icann.org/resources/pages/name-holder-faqs-2017-...

Not the best advice for authoritarian countries, where you domain can be seized for any reason or subjected to random repressive policies.

Of course, there are exceptions. In some places, your only viable alternative might be .onion.

24 years ago, my then startup bought about 60,000 domain names. For many.of the TLDs in question it represented the largest chunk of income they'd had. We had about $1m in funding at that stage.

Put another way: Many of these TLDs bring in little enough that it'd likely take a really small funding round to go to some of these registries and make them a nice offer to tighten rules so that e.g. all registrants outside the country needs a licensed representative in the country, and convince them to license only you.

Price by revenue or number of employees or something and give kickbacks to the right people.

I anlway prefer using OG .com and .net for business/apps, and .org for personal.

These are all general purpose and open for anything. You gotta get creative with the naming though!

what about .me ?

Are you a citizen of Montenegro? If you are, feel free to use it! Otherwise, I suggest that you use something else.

Hello,

I am an official representarive of the Balkan countries. A non-negligable chunk of our GDP is based on random Rust projects using Serbia's .rs and of course .me. If you stop using our TLDs our ecobomies will collapse.

Kind regards,

The Balkans

Fine by me.

Old article about how big of an export it is: https://techcrunch.com/2017/01/10/me-10-years-and-two-percen...

Serbians should really let go of the idea they can speak for all Balkan nations.

-- Sincerely, Everyone Else

Suddenly Bismark's remark about bad things coming "[...] out of some damned foolish thing in the Balkans" is echoing in my head.

"feel free to use it"

I feel free with my .co domain and I'm not a citizen of Colombia TYVM.

Good luck with that. What happens when there’s a dispute with a Colombian entity who wants your domain? Who do you think will have the advantage? Would you trust the Colombian registry and courts to favor you?

They could take the dispute to the UN internet court for domain names, whatever it's called. I can't see why that would apply only to the TLDs that existed 20 years ago.

You’re thinking of WIPO, perhaps? IIUC, they can’t interfere in the affairs of a ccTLD registry unless invited to do so. So if the Colombian authorities says you lose your domain to some local Colombian outfit, then you lose.

I was thinking of WIPO, and that's interesting that they have to be invited. I guess someone could always establish a cheap LLC there if they really wanted protection.

> .me is the Internet country code top-level domain (ccTLD) for Montenegro.

https://en.wikipedia.org/wiki/.me

Reply on news.ycombinator.com