Hacker News Reader

Comment by bell-cot | Hacker News Reader

Daydream: Browsers and email programs are shipped with "Default Allow" lists, which include only the older & higher-quality TLD's. While users can add whatever TLD's they want to the lists, that default behavior destroys 99% of the value of new & crap-infested TLD's.

View on HN

“ top was the most common suffix in phishing websites over the past year, second only to domains ending in “.com.”

So should we default not allow .com?

Quality is relative. A far larger percentage of .com domains are legitimate.

Quora, Pinterest, Medium, The New York Times, Scribd, etc

I think the blog universe would only benefit if medium ceased to exist.

Per the article 0.2% of .com domains are phishing vs 4.2% of .top. Or put another way, if you have a .top domain it's about 17 times as likely to be phishing than a .com domain.

.com has the most phishing domains by virtue of by far being the biggest, not because they have looser controls or are less reliable.

Only if you select a random domain from a list of all .com or .top domains. No one does that of course. The chance a random .top (or .com) you encounter is a phishing domain isn't so easily calculated, depends on where you see it, etc.

Ate some cheese before dreaming: Google and MSFT (as maintainers of the dominant mail clients) start charging TLDs under the table to go on GMail/Outlook's "Default Allow" list, except, of course, the ones that Google administers

Sadly, yes. And no "dream" disclaimer is needed.

If you want to do that you can already knock yourself out with a custom DNS. Browsers must be neutral.

From the article:

> .top was the most common suffix in phishing websites over the past year, second only to domains ending in “.com.”

Does that mean you want to block .com domains?

# .top phishing websites / # .top websites total

# .com phishing websites / # .com websites total

make educated decisions

Why does that matter at all? If I go and create a bunch of legitimate .top domains, is it suddenly better somehow? No, it's still the first of the list, and .com is still second.

yes, precisely. if you and a bazillion other people do it so that the percentage goes down. it's the fact that scammers are glomming onto a trendy TLD ruins the reputation of that TLD. If the percentage of scam is higher in one TLD over another, people will consider it a TLD used for scams. Not sure where the logic breaks down here

> No, it's still the first of the list, and .com is still second.

also, what do you mean .com is second? it states that .top was second to .com

> Why does that matter at all?

Because any action will have a negative impact on the legitimate sites and we want to maximize the effect while minimizing collateral damage.

It seems you’re saying if there’s a terrorist training camp with 10 terrorists and no bystanders in it, it would be unreasonable to drop a bomb on it unless we’re first willing to level the nearby city of a million people with 11 terrorists in it because it has more terrorists.

Which… no.

Got to love the mindset of the "old-school" cybersecurity folks.

MS-DOS - 42 years without a remote hole in the default install!

I already do this with NextDNS, I block all the "new" TLDs except for .io, .tv, and .ai because they're used for tech sites that are legitimate. I know that many organizations do the same, in fact it's mentioned in another comment.

All three of them are ccTLDs, so they aren't part of the "new" gTLD bucket (where .zip, .top, .xyz etc live).

This made me sad when got a domain that used the TLD for a domain hack, then realized that I couldn't use it for emails.

Reply on news.ycombinator.com