Google Pushes New Domains Onto the Internet, and the Internet Pushes Back (arstechnica.com) 50
A recent move by Google to populate the Internet with eight new top-level domains is prompting concerns that two of the additions could be a boon to online scammers who trick people into clicking on malicious links. From a report: Two weeks ago, Google added eight new TLDs to the Internet, bringing the total number of TLDs to 1,480, according to the Internet Assigned Numbers Authority, the governing body that oversees the DNS Root, IP addressing, and other Internet protocol resources. Two of Google's new TLDs -- .zip and .mov -- have sparked scorn in some security circles. While Google marketers say the aim is to designate "tying things together or moving really fast" and "moving pictures and whatever moves you," respectively, these suffixes are already widely used to designate something altogether different. Specifically, .zip is an extension used in archive files that use a compression format known as zip. The format .mov, meanwhile, appears at the end of video files, usually when they were created in Apple's QuickTime format. Many security practitioners are warning that these two TLDs will cause confusion when they're displayed in emails, on social media, and elsewhere. The reason is that many sites and software automatically convert strings like "arstechnica.com" or "mastodon.social" into a URL that, when clicked, leads a user to the corresponding domain. The worry is that emails and social media posts that refer to a file such as setup.zip or vacation.mov will automatically turn them into clickable links -- and that scammers will seize on the ambiguity.
Shocked, just shocked I say! (Score:3, Funny)
... that Google would be trying to make a move to foster ambiguity in search results in order to profit by riding the coat-tails of dark patterns that feed criminal society?! I'm simply shocked! /sarcasm
bad idea from day 2 (Score:5, Insightful)
The whole top level domains thing is a bad idea. In the beginning, when it was only .com, .org, .edu, and .mil, it made some sense. But with a universal internet, the likelihood of name collisions makes it a really bad idea. Making more of them is an even badder idea.
Re: (Score:3)
uh, maybe .net was also in there in the beginning.
Re: (Score:1)
uh, maybe .net was also in there in the beginning.
Naah. It's 2023 and a decent percentage of my users still respond to "ok, please type in mycompany dot net" with "mycompany dot net...dot com?". Of course they respond the same way with anything else that isn't "dot com" including .to, .love, .office, .it, .eu, .edu, and every other shitty TLD on the internet
Re: (Score:3)
The first was .arpa https://en.wikipedia.org/wiki/... [wikipedia.org] Then januari -85 there was .com, .edu, .gov, .mil, .net, org, and .int https://en.wikipedia.org/wiki/... [wikipedia.org] First country codes also started 1985 with .us, .uk and .il. https://en.wikipedia.org/wiki/... [wikipedia.org] Late -80s to 96 there was .nato https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:2)
Yeah, .cc was there too.
Re: (Score:2)
TLDs should at least make sense, perhaps be run by a country of origin. That way, we know that someone is coming from a specific geographic area. Let countries figure out their own TLD structure.
I've not seen much good from some of the newer TLDs. Some actually jack the price up by traffic, so if one has a booming site, the renewal might go from $20 a year to a lot more. Even then, it is common for companies to blacklist the TLDs because they also tend to be origins for spam.
Re: (Score:2)
Re: (Score:2)
Unfortunately doesn't work that way. .tv has been hijacked (commercially sold and corrupted) by... wait for it... TV
Tuvalu TLD
Obligatory XKCD (Score:4, Funny)
Do we remember .com? (Score:5, Informative)
For those who used DOS, in the days before windows, as well many other OS's that were Dos like. The executable file were .com the MS DOS prompt was ran with command.com file. Which seems on the internet leads to 3M command tape.
Re:Do we remember .com? (Score:4, Informative)
For those who used DOS, in the days before windows, as well many other OS's that were Dos like. The executable file were .com the MS DOS prompt was ran with command.com file. Which seems on the internet leads to 3M command tape.
On a sidenote pertaining to companies like 3M and 3COM, the rules for DNS originally did not not permit having a domain name starting with a number (like 3m.com). This was changed in RFC 1123 (October, 1989).
Re: (Score:2)
Remember? When was .com disabled in Windows?
Re: (Score:1)
Although there are a few files in Windows that are called ".com" (more.com for one), they are just .EXE-format files in disguise.
The ".COM" executable file format used in DOS and carried over into some versions of Windows ended long ago.
Wikipedia "COM file" snapshot [wikipedia.org]
Re: (Score:3)
> they are just .EXE-format files in disguise.
They are bastardized NOW, but originally .com files were completely different from .exe files.
"Windows NT-based operating systems use the .com extension for a small number of commands carried over from MS-DOS days although they are in fact presently implemented as .exe files. The operating system will recognize the .exe file header and execute them correctly despite their technically incorrect .com extension. (In fact any .exe file can be renamed .com and st
Re:Do we remember .com? (Score:4, Informative)
The difference between a .COM file and .EXE file is the memory space they occupy. A .COM file can only be up to 64K in size (everything within a near jump). .EXE files can be larger than 64K. .COM files are not .EXE files in disguise as I saw someone else state.
Re: (Score:2)
just to be that guy
.com - Command .exe - Executable
proliferation of TLDs has been A Bad Idea (Score:5, Insightful)
For every legitimate use of a new TLD, I've seen 5-10 misuses. Can anyone argue that almost 1500 new TLDs is in any way a success for any one other than scammers and domain registries?
Obligatory XKCD #1698: Theft Quadrants (Score:1)
For every legitimate use of a new TLD, I've seen 5-10 misuses. Can anyone argue that almost 1500 new TLDs is in any way a success for any one other than scammers and domain registries?
Never seen .com misused? Were you born yesterday?
Obligatory XKCD #1698: Theft Quadrants [explainxkcd.com]
Re: (Score:2)
Of the original TLDs, .net is MUCH MORE WIDELY misused, as an alternative to .com for commercial operations (as opposed to network infrastructure, the original intent.) I personally have no strong expectations for ".com" other than "it's quite likely that there's some commercial intent"
Re: (Score:2)
It allowed me to finally have a 3 letter vanity domain name... (I am not a scammer, btw)
Re: (Score:2)
(Disclosure: Wife worked for Verisign and still owns some of their stock.)
Re: (Score:2)
It's a success if you can get large business to snatch up all the variant TLDs to prevent namesquatting thereupon...
from 1470 domains to.1480... what a difference (Score:2)
Sure we've had too many top level gtld but going ahead and making sensational accusation about weakening security, bla bla bla... could be said of all gtlds that came before.
people don't need a new gtld to fall victim to scams.
To give the argument that zip and mov are extension is to ignore com is an executable type too
Re: (Score:3)
It was pointed out in the comments on Ars but it was downvoted. Why do applications create links in content that the author didn't include? It's one thing if the author put the full https://domain.tld/link than the software creating a link when someone is just talking about domain.tld.
Re: (Score:2)
i've seen Whatsapp turn a three-kisses signature into an unintended web link, for example with a message like this:
See you tonight, ladies.xxx
Re: (Score:3)
You wouldn't go looking for a .com on a website to download and run a program. That would be insanity. But if you see a .zip on a forum post you'd expect it to be reasonably safe, but if instead it's a malicious website you have a potentially bigger problem. Sure, just because a URL says http://somewhere.com/somefile.... [somewhere.com] doesn't mean that's what you'll get any more than http://somewhere.com.somefile.... [somefile.zip] would be, but it's more effort to achieve that for the people loading malicious payloads into unsecured f
Re: (Score:2)
is their an .Wad ? (Score:2)
is their an .Wad ?
Re:is their an .Wad ? (Score:4, Funny)
Re:is their an .Wad ? (Score:5, Funny)
Obligatory classic The Onion [theonion.com] on wads.
Maybe we should talk about (Score:2)
Here is your attachment (Score:5, Insightful)
Here is the file you requested: attachment.zip [attachment.zip]
So (Score:2)
Who owns ICANN these days?
Re:So (Score:5, Funny)
Who owns ICANN these days?
I'm guessing not Apple, otherwise it would be iCANN ... :-)
ICANN gTLD process (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
You missed the OP's point. The process has a specified period for complaints to be heard. That the "Internet Pushes Back" now is completely irrelevant. The internet is late, it dropped the ball, you don't get to complain about something after it is implemented if you didn't complain about it during the review period dedicated to soliciting your complaints.
ICANN's hasn't approved anything wrongly and followed the process. Google maybe should have known better than to applied for it, but in either case the ti
How about adding (Score:1)
".stfu" for Google critique sites.
I just block them all (Score:2)
Country Codes Only (Score:2)
In the 90s, we should have seen the problem and squished it entirely. The solution would have been to move .com, .edu, .mil, and even .net under .us. Then have everything use country codes. Sure, that's a pain for a few big multinational companies, but it would have been a lot cleaner than what we have now.
Duh (Score:1)
FTFY (Score:2)
Yes, email is terrible, that's not news! (Score:2)
He's not an isolated case, or some outlier to take note of, he's an average, idiotic, simpleton! He treats email like most people do, never gives it a second thought, and
word.xyz (Score:2)
is not a damn URI
who the hell parses that and turns it into a clickable HTTP URI?
No problem (Score:2)
Please download my secret stash of nude Natalie Portman pics from:
hxxp://definitelynotmalware.zip
ICANN, not Google (Score:2)
I'd note that those domains were approved by ICANN. If Google wasn't the registry for them, someone else would be. The domains are a problem but the blame lies with ICANN, not Google.
ISPs could fix this (Score:2)
It'd be nice if some ISPs (and others) reached some kind of informal agreement to have their nameservers filter out most of the stupid new toplevels, maybe gave users a choice on the matter but defaulted to filtering, and we made sure that the usability of many of these things were not certain, in order to hamper adoption.