It seems like the right thing they should do is discontinue new registrations but continue to honour existing ones (+ continuing to reserve any 2LD that has a 3LD registered on top). It’s a bit insane that they can decide to just terminate all existing 3LD registrations. One would hope that they’d at least continue to reserve the 2LDs for some period to avoid domain squatting, but this isn’t mentioned in the proposal and I doubt Verisign would graciously do so.
Maybe they want to avoid the ambiguity between john.doe.name versus john-doe.name, and I assume they prefer the latter scheme because it probably sells better. Nevertheless, discontinuing existing domains is disgraceful.
Even that doesn't pass basic scrutiny. The same ambiguity can and always will exist with tim-apple.com and tim.apple.com - there's nothing here that needs fixing.
True, they can’t outright prevent the ambiguity, but much fewer people will go to the trouble of establishing such subdomains when the option isn’t directly offered by the registrar.
This is my theory because, a priori, 3LDs should be more profitable than 2LDs, because with 3LDs John Doe and Jane Doe don’t have to compete over doe.name, but instead can each separately purchase john.doe.name and jane.doe.name. Apparently, however, that’s not a benefit of 3LDs in practice, which leads me to conclude that john-doe.name and jane-doe.name just sell better.
That is definitely not true. There are literally thousands if not tens of thousands of well known domains that do this. .co.uk is a very common example.
I'm surprised they don't just do that, and maybe even to go a little further, disallow renewals so you can phase people out and reclaim domains you can sell.
Whether disallowing renewals or terminating them tomorrow, there's still the same core problems, only the date of the offense changes: (1) seizing people's names that they've established, breaking innumerable things including email and server hostnames, and (2) the possible resale of the 2LD fraser.com to a third party who will be free to do malicious things like reading OP's email, redirecting his traffic, or extorting him, to sell continued access at any price demanded.
That would be so cool and would make these limited hot commodities.
.name was one of the very first expansions of gTLDs back in the very early 2000s. It's a shame that it's being shut down as it was spearheaded by the ICANN itself rather than some registrar / investor like Donuts, Inc.
I suppose this is impractical as someone has to run the registry and there are costs associated with that. But don't the domain fees cover it?
From having worked in that space what feels another lifetime ago, I vaguely recall that you can just offload the registry work to a registry that would manage this together with a mountain of other TLDs.
As I recall it. This was mostly a money scam that targeted private users with ads like "make sure to claim to your .name domain so no one else does it and use it to impersonate you". It was stupid from the beginning and never took off.
I freaked out for a second because I've owned `dvt.name` for like 15 years. `.name` is not getting terminated, so it's important to be precise here. The third-level x.y.name (where you're the `x`) is getting terminated, and the respective `y.name` domains are going to be released.
Still a crappy thing for people, but it does not affect owned second-level domains.
There should be a conflict resolution to gracefully degrade the third level to 2nd level when there is no competing name on the second level.
But I didn't think about the 1st level competitors. There'd still need a mechanism to resolve that...
1. First come first serve? (e.g. whoever registered a y.name first, whether x is bob or sue is determined by the earliest registrant on record)
2. Lottery/random selection?
3. Bidding war?
I think the problem is 2nd level domains who have the same name will be a problem when they find out all these other 3rd level are now expiring and can run a route to spoof? Likely wouldn't happen, but with the fuckery in the DNS that can happen... This is such a rash and weird decision to push through so quickly just because engineers find it "easier" while ignoring the implications of the move, seemingly when it comes to larger scale security.
I assume there would have to be some method to prevent routing of third level domains to subdomains of two-levels... (or is that just me being a fool yet again, assuming we have competent administration of our systems).
It kind of seems like an insane TLD structure to begin with, right? I always thought .co.uk was bad (you're just pinning yourself to whoever owns the .co. part, but at least browsers have some suffix list where you can't, I don't know, hijack some login cookie for all of .co.).
Joe Smith and John Smith can independently register joe.smith.name and john.smith.name, do browsers have a wildcard suffix list for the 2nd level of `.name` specifically, or can Joe set a cookie on all of .smith.name?
I know about the public suffix list - I was wondering about the wildcard specifically. In the very issue you linked to, as of 2025, it seems this was still unresolved...:
> We have no plans to modify the .name entries at this point in time. We are aware of the implications of adding a wildcard, therefore we won't.
Yeah, apparently they both (used to) offer unbounded registrations of 3LDs and unbounded registrations of 2LDs? So if I see j.doe.name, the only way to find out if "doe.name" is a public suffix or not, i.e. if I should (not) be able to set a cookie on it, would be to email the registrar?
So does that mean that in practice, .name domains were always treated by browsers like regular 2LDs, meaning the cookie and origin protection was always broken for those domains?
Doesn't sound like good news for the guy in the OP...
I'm just saying that they have discussed the situation. They seem to have no answer and for cookies and similar things the answer probably is "maybe don't run security critical web stuff in the third level under .name".
IIRC orgs like letsencrypt also use the PSL for rate limits, so there are probably more issues that are not browser-based.
There end up being some weird edge cases where there are some countries which have both the equivalent of .co.uk but also allow registrations directly under the two-letter country code as well. .mx is one such case where most business are, e.g., costco.com.mx, but it’s also possible to register directly under .mx as well so Toyota Mexico is toyota.mx and not toyota.com.mx (the latter is registered, and ostensibly to Toyota, but the whois and nslookup records give very different results and the website doesn’t load when I try to visit it).
Since neither smith.name nor the wildcard *.name appear in the Public Suffix List (https://publicsuffix.org/), browsers would likely allow any page on a *.smith.name domain to set cookies for .smith.name.
There was an effort to properly handle the .name 2LDs, but it was never resolved because there’s no easy way to tell a reserved 2LD (open for 3LD registrations only) apart from a normal 2LD on .name: https://github.com/publicsuffix/list/issues/2306
So yes, this TLD’s setup is in fact pretty insane.
I think this says more about how the cookies security model is stupid. They should always have been scoped to the single, exact name they were set from and nothing else. Websites would have had to be designed a bit more thoughtfully.
It seems like it would be easily resolvable with TXT records these days. Anyone could try, say, on www.google.com to set a cookie for all of google.com, and the browser can fetch TXT records on google.com to see what, if any subdomains, it wants to allow this privilege for. Google could return a list or a wildcard; co.uk wouldn't allow any.
In a world without advertising, there's no reason why google.com couldn't also allow *.youtube.com to set cookies for it, but of course that would cause a tremendous privacy freakout. Though in practice they can and do just send every login/logout through a 302 redirect roundtrip to take care of the cookies on youtube.com.
An “administrative structure” seems fine, but the fact that a subdomain gets any sort of privilege over the parent has always seemed absurd to me.
Surely a better solution would involve an actual request. login.foo.com could send a request to foo.com with Origin: login.foo.com asking to set a cookie, and foo.com could make its own decision.
that seems strange to me: why shouldn't policy leverage name resolution? sort of like dkim, but taken further. for instance, for site.com, I'd much rather retrieve its public key from DNS (some DNS++ version, of course).
> It kind of seems like an insane TLD structure to begin with, right?
It's been around for years. I seem to remember this issue coming up around 2001 where originally .name was for third level registration (i.e. john.doe.name) and changed to second level it a few years later and caused some problems... https://publicsuffix.org/ talks about it in light of architectural limitations of domain names.
> can Joe set a cookie on all of .smith.name?
That can happen. I seem to remember ancient browsers made it so .name (and other non-generic TLDs) required three periods. I think country code domains and new generic TLDS caused the browsers to change it.
It's pretty screwed up, but a lot of the people with .name domains have had them for a very long time. Sad to see them all lose their identity online that way.
So, this kind of thing happens all the time, and there's the Public Suffix List for exactly this problem.
There would be no issue at all if Verisign, or maybe Global Name Registry, decided to stick to the 3rd level registrations exclusively. Problem is, the chucklefucks over there decided it was a good idea to also hand out 2nd level registrations. Those 2nd level registrations outnumber the 3rd level registrations by an order of magnitude, so the PSL decided to just let joe.smith.name and john.smith.name share cookies. Which, IMO, was not a good decision, but it is what it is.
Yes, but you have to admit that the existence of these SLDs (like co.uk) is always going to be a point of confusion for anyone with a basic knowledge of how the domain hierarchy _usually_ works.
Needing to be familiar with all the special cases (like the VERY special case of x.y.name which I previously knew nothing about) kind of ruins everything and introduces yet more security risk.
> but you have to admit that the existence of these SLDs (like co.uk)
I'm sorry, what ? Admit ? Confusion ?
In the case of .co.uk it has been around since 1996. HN is a technical forum, most people here should be well aware it is a serious SLD. I honestly can't believe it even needs clarifying.
Hell, if you use AWS Route 53 you'll see they use co.uk as one of their nameserver suffixes[1].
About 20 year ago I registered {lastname}.name and have dozens third level domains below it. So there are "privately owned" second level domains under .name for quite some time...
I'm working on same for my family since I want to properly degoogle a bit. One thing I think long term - if I give my kids first-name @ last name , that means that I forever hold power over their email. Which isn't great. But what's the alternative? Register one full domain name per kid? Even ignoring the cost, the ergonomics are awful.
Imho email is missing a feature for nameless email addresses for when somebody just buys their full name as a domain name. If I get "firstname-lastname.name", having the email be "firstname@firstname-lastname.name' kinda ruins it.
Aside: I'm honestly bewildered that Google doesn't have the ability to handle that in gmail accounts. If somebody gets married or otherwise needs to change their name, their answer is "just make a new google account" when all your stuff is still tied to the old account.
A child born today sees email like we see the telegraph...
they'll grumpily sign up to gmail just so they can get a verification email, and that'll be all it gets used for. Messaging their irl friends will be done in apps like Discord.
lol I ran a sizeable team around 2020 and I had to educate a couple of our new hires straight from college that they actually needed to check their work email, after they missed important HR related stuff and they had just completely not realized it was an avenue for company communication, with an assumption that everything was available on our heavily used slack.
To me that sounds like reasonable structure. I hold that every single edu, gow and mil domains should be moved under respective ccTLDs. After this sort of move that doesn't seem unreasonable thing.
1. The Nominet rules are crystal clear about which 2LDs are managed by Nominet[1] (co.uk, sch.uk, gov.uk etc. etc.). `co.uk` has been a Nominet managed 2LD since 1996 and it is not going anywhere.
2. FUN FACT ... Nominet introduced the ability to register directly under `.uk` much, much later, in 2014. Before 2014 your only option was to register under the auspices of a Nominet managed 2LD, e.g. `co.uk`. Ownership of a third-party 2LD is validated in 10 seconds via the usual WHOIS.
I suspect you meant 'uk.co' and other such shenanigans. Please correct your post accordingly.
Ok, co.uk was perhaps a bad example, because it's owned by the same registry as the TLD, but perhaps there are other 2nd level TLDs where that is not the case. My point is both that it's hard to tell, and more broadly why would anyone want their domain to be tacked on to some 3rd level subscript anyway, when there's so many plain top level domains available. Surely most of us (present company excluded perhaps) do not feel so passionately about the reverence of `co.uk`
I don't have some nefarious desire to scare people away from the TLD of their choosing. Really I'm bringing it up to be like "why would you even, like, want some 3rd rate domain instead of getting a .com" so I don't think there's anything to correct
Its not hard to tell for things like ".uk" or other serious suffixes.
It only (maybe) becomes hard(er) to tell for all the vanity ccTLDs that came along in the 2000s. But even then 10 seconds on WHOIS and Google should fix any doubt.
> about the reverence of `co.uk`
What are you on about ? Lots of other countries do it too. Japan is one example given already here, but there are dozens. It is very common practice for country tlds.
You're absolutely right, when it's Nominet's actions that actually inspire a lack of trust in .co.uk, given they've been a bit of a hot mess since the early 2010's-ish.
;)
(Edit: although I should add that I'm hopeful that things have improved there over the last few years).
Agree that the .name 3rd level domains are silly, disagree on .co.uk being a problem.
If .gov and .mil and .com make sense, then .gov.cc and .mil.cc and .com.cc make sense.
Of course, I think having more than one non-cc TLD was a mistake, but that's just me. If it makes sense to have topical TLDs for international and US institutions, it make sense to have national ones.
Nominet and therefore .co.uk has been around since 1996.
.co.uk is not going anywhere, and neither is Nominet.
The only "problem" is the original poster did not do their homework. I suspect they were inferring `uk.co` which is a completely different kettle of fish. The original poster should urgently correct their post.
We were rescued from that dot org scam by the fact that ICANN is a California non profit. I wonder if the AG can lean on them again. This is an outrageous thing to do.
This is why I am building DNTLS. These organizations no longer deserve our trust and they have inadvertently gained too much power over the last two decades of massive internet expansion. Names need to be fully owned by individuals and a shared, decentralized trust system must be in place for resolution. The more I see actions like this, the more convinced I am that a solution is long overdue.
Yeah, the website is a holdover from when we were pitching AI VCs a few months ago. We quickly determined that the whole system is now "Cancer Capital" (see the other front page HN thread) and have pivoted to just bootstrapping from a close syndicate of like minded individuals. We plan to update the website this month, sorry it's a bit behind.
In short, AI identities were just a happy accident that comes with the system/architecture. It's not tied to AI at all.
But if anyone is interested in talking about what we're doing more, happy to connect at hn@sepositus.com.
The adoption has basically been non-existent. I have a lot of theories on where they've gone wrong. Being so heavily tied to a blockchain (Ethereum being the worst due to its state bloat) is probably the biggest mistake I think they made.
There's a DNS wizard at my job (not doing DNS stuff currently; but in his past life), and while he was talking to me about certain topics my eyes glazed over, and I thought, "Man, surely that won't affect me, right?"
Well, it's still not affecting me, personally, but wow, seeing articles like this makes it feel just a tiny bit more real.
One of the reasons I stick with Big Email for my primary email is cases similar to this. If I host email and lose the domain one day, I’ve lost two factor on a thousand different services (the single factor on some). Big Email’s policy is to not reissue my address, should I lose it or die.
The .name scenario is even worse. One domain gives you access to tens of thousands of users email. It seems like a privacy nightmare.
I’m not sure how future auth and privacy will work, but my child lost a tracfone phone and some mixup had separated it from my account. There was no way to recover the number. If that was my personal phone, how difficult would it be to restore banking, medical, and government access to things that assume I’ll always have that number.
Doing the same with personal email seems like too big of a risk.
You can look through my history how many times I’ve brought this up to people and they just don’t seem to care. A defence is that they’ll buy the domain for a century and not care once they’re dead which is fair but the situation in this article is a valid one. I will always stick with Big Email for accounts.
I worked for .name briefly right at the beginning of their entry into the world. Interesting but very odd part of my career.. Ill give it that.. I personally found the product at first a great idea but somewhat crippled by execution..
> Once the 3rd-level domains are terminated, it is assumed that the now vacant 2nd-level domains will become available for registration. Should someone (other than me) scoop up fraser.name (...)
What's to stop someone from doing that, and keeping the status quo? Sure, it might be expensive, but pool together a few frasers for the initial buy, and make the money back on the sublets.
Well, nothing, but it does assume that Verisign doesn't have an unstated plan to do something else with .name. Domain registration is the real estate of the Internet and very little has happened in the last 30 years of domain name policy that has been for the benefit of anyone outside the the registrars.
For all we know, this is simply the first step in a series of moves for Verisign to better monetize the .name TLD in some novel fashion.
My evidence for this is that Verisign's own arguments for terminating the third-level domains are highly dubious. They claim that the third-level domains are too hard for them to manage. Bollocks: there are only 22,000 of them in use. That is a VERY small database that practically fits on a calculator and I refuse to believe that any manual labor around it is an outsized burden compared to pretty much any other semi-popular TLD. The second claim is that "the majority of those are not in use." Okay, if that's true, then where is the management burden coming from? That means tens of thousands of people are giving them money and getting nothing in return, isn't that the definition of an ideal business model?
It just doesn't pass the sniff test.
And finally, having read both of the linked documents, it sounds like people who have registered their .name for years in the future are not getting their money back. Are they likely to pay a second time, to a sub-registrar with no history?
I don't think it's hyperbolic to say that this is the most careless, disruptive change to anything to do with DNS or internet names I have ever seen.
> "will increase efficiency for the operation of the .name TLD."
What a preposterous excuse -- especially for something already up and running. Sounds like they probably want to change the backend in some way - or adopt some kind of off-the-shelf software - which doesn't jive so well with this unique TLD, and they figure "Ehh, fuck 'em, let's just pull the plug on these tens of thousands of people."
Wow! Years ago I initially bought my firstname.lastname.name, then I let it expire and then bought lastname.name. So glad I did!
Never dreamed that such a supposedly durable thing would just disappear. How hard is it really to preserve a global resource like this that exists only in software?
From the Verisign application [0] for this change:
> 2.1. What effect, if any, will the proposed service have on the life cycle of domain names?
> None. There will not be any effect on the life cycle of domain names.
ehhh, how is that possibly true? This change (deleting all third level names) by definition affects the lifecycle of domain names ... by terminating them!
Many years ago I wrote articles bringing attention to the negative effects of Verisign's SiteFinder [1] - if you don't remember this, it's when Verisign hijacked NXDOMAIN by redirecting any unresolvable domain to a site they owned and controlled.
"Well, it doesn't affect the lifecycle of domain names. The lifecycle is defined in some RFC somewhere, and this change doesn't modify that. Now, these particular domain name instances might be adversely affected, but you didn't ask about that." -- lawyers, probably.
If this proves to be a viable business strategy, then verisign could equally use it to re-sell google.com, ycombinator.com, etc. to the highest bidder.
I've had a .name domain forever and I had no idea first.last.name was even a thing, meaning that it was possible to register this without owning last.name.
That said, my domain is simply unusual.name, and everybody in my family has email addresses in the form first@unusual.name. So this is a no-op for me, and I gather www.unusual.name will also continue to work, since I own the 2nd level outright.
I'm sure Verisign would be thrilled to have a bidding war between the legitimate owners of fraser.name and a bunch of third parties they suddenly enabled.
This is silly question, but is your family managing trust in you as lone guy - cousin, father, brother - having potentially access to all their emails?
I feel that I more trust some corpo (Google, etc) that one particular person.
I don't imagine setup where you can effictevely guarantee them full privacy.
Some people in my family use it as their main address, others don't, it's entirely their call.
But yes, ultimately I control the domain and could be nefarious if I wanted to. But there's a certain baseline level of trust as a family, I'm reasonably certain my wife won't poison the milk in the fridge and she's reasonably certain I'm not going to read her emails.
I manage the email accounts for the others in my household because it's free for them and I'm happy to do it. Plus, they trust me more than they trust a random tech company. Maybe that is not a universal thing among all families or parts of the world.
> This is silly question, but is your family managing trust in you as lone guy - cousin, father, brother - having potentially access to all their emails?
I believe this is a very common setup: the "computer wizard" kid of the family manages the computers for the whole family. Not just emails, they have access to the whole computer (and have to fix when it breaks).
It was deemphasized pretty early because people didn't understand it.
It made sense to us because our starting point was an email service letting people share lastname.sometld, but we never got close to as many registrants on .name as we had users on the webmail service (we had a couple of million accounts on that when it was sold to one of Marc Cubans companies for a relative pittance in the aftmath of the dot com bubble bursting)
"2.1. What effect, if any, will the proposed service have on the life cycle of domain names?
None. There will not be any effect on the life cycle of domain names.
...
2.3. Explain how the proposed service will affect the throughput, response time,
consistency or coherence of responses to Internet servers or end systems.
There will be no effect on the throughput, response time, consistency or coherence of responses to Internet servers or end systems."
My registrar is also suggesting that they are going to just keep the money I pre-paid for years of registration, which is a minor annoyance compared to the loss of my entire online identity but an annoyance nonetheless.
Since ICANN is a non-profit that is required to operate in the public interest I do hope there can be some pushback on this. I will be writing to the CA AG myself.
Ok I don’t get it. Why not register `fraser.nameˋ directly? Or pick any TLD and register ˋ a 2nd-level domain (ˋfraser.tld`)? It just feels easier, plus this way you don’t have to pay for any new member of your family?
> Or pick any TLD and register ˋ a 2nd-level domain (ˋfraser.tld`)?
How would that help? The problem is that he's losing access to all the accounts currently tied to fraser.name, if he is changing that he can just use any arbitrary domain anyways.
The post sounds like that wasn't possible; that this TLD operated by exception with third-level domains. It would be like asking why you don't just register smith.uk instead of smith.co.uk: because you can't (https://en.wikipedia.org/wiki/.uk#Second-level_domains)
That's just my reading of the situation though. The person could now hope they're the first to claim their second-level domain once it becomes up for grabs, but there's probably a dozen other people with a fraser subdomain that would want the same, plus however many hundreds of scalper scum. Probably the best you can hope for is that whoever does get it, has the decency to honor the original third-level domains for a reasonable fee
Because only one lucky person can own `fraser.name` at any one time in your model. And whilst that lucky person might be able to register their family members for free. There will be countless more (unrelated) Frasers who won't be able to register (even for money) their own `FIRST.fraser.name`.
So the argument goes, society as a whole gains more if we prevent anyone from owning `fraser.name`.
A legitimate alternative though, is to register `FIRST-fraser.name`
At the beginning of the existence of the .name TLD you couldn't do that, you were forced to register firstname.lastname.name and provide an ID to justify registering this specific domain.
With it you got an email redirection from firstname@lastname.name to the address of your choice. At some point this feature was discontinued (I assume when VeriSign took control of the .name TLD), a bit after it was decided (again by VeriSign) to allow registering first level .name domain. My main email address stopped working from one day to another without me being warned in any way.
When this happened I've emailed VeriSign and my registrar at the time, and tried several time since then, to be able to register the first level domain I'm the only one using, but they categorically refuse, despite recognizing that a single subdomain has ever been registered. They kept saying that I could just let the domain expire, wait for the grace period, and register it once it's liberated, hoping that no one does it before me, and without any solution for the downtime in the mean time…
This really sounds like VeriSign has no business owning .name … best possible outcome would be transferring it to somebody who will retain the originally intended services.
Dude, this is one of the craziest things I think I've read on HN
First, that a legit dealer could/did(does?) sell third-level domains at all (Verisign, no less)
Second, that the top-level is staying available, allowing for second-levels to be bought/sniped like you mention.
If you do lawyer up and need help with legal fees, I think this would be a worthy cause.
I think the “not applicable” is to the elided second sentence of the question:
> 3.6. Have you communicated with any of the entities whose products or services might be affected by the introduction of your proposed service? [→ No.] If so, please describe the communications. [→ Not applicable.]
Gotta say that the entire form feels not applicable. The proposed service is the discontinuation of an existing service. I see from their website that other similar things do the same, but it feels broken when so many of the questions become nonsense.
The ability to register fraser.geek so a very small number of OpenNIC users can access that new URL doesn't really solve the OP's problem with his family's long-established URLs disappearing and their emails being directed to whichever scammer buys up the fraser.name domain.
That isn't the correct problem. The 3rd level domain is going away, which can be reconqured via OpenNIC and mass re-adoption. There will surely be new problems, but owning will not be among those problems.
> Second, my email address also disappears. Third, all the IoT devices that use services on this domain become bricks. Basically, I disappear from the Internet.
While changing email is inconvenient, I don't understand the point about IoT devices. IoT devices should not depend on the Internet at all for obvious privacy and security reasons. If you are using IoT devices with "cloud" accounts, then this is a blessing in disguise. Put that garbage in the trash and rebuild around HomeAssistant, Zigbee, RTSP, etc. I find it hard to believe that someone hosting their own website would fall for the cloud IoT scam.
Plenty of people and businesses have their own (DIY, etc) devices that need to use DNS. I mean it wouldn't really be the internet of things, if it didn't actually use the internet...
For instance, I own a .house domain that I use for a bunch of stuff that I've programmed. It would be a pain in the ass to go change that domain out. Now take that to next level and you're a business that's deployed a few thousand devices that need to call home.
I guess all this is to say - IoT doesn't just mean cheap botnet honeypot IP cameras. Take a look at https://www.balena.io/cloud for instance
"Internet" in this context usually means IP, and in any case it should be restricted to a LAN. If you actually own the device changing the domain or IP should be trivial, I don't think this is what the article refers to.
He didn't say his IoT devices relied on 'cloud' accounts. He said there are IoT that use services on this domain.
Imagine he's set up some IoT devices at his parents' home, and those devices use services that he hosts somewhere on the internet. It would be silly to hard code the IP addresses in there, right (unless he operates his own ASN)? So he would use DNS to allow those devices to find his server(s). This would be the case whether the servers are at his home, at his office, or in a rack at a data centre.
I wonder if this could constitute a violationiof article 6 of the UN declaration of human rights.
It has been established that national identifiers are protected by it, and a domain works as a sort of international identifier, in this case a personal one.
No one is obligated to give you a domain, but by contracting an obligation to provide that identifier until 2040, they would at least be liable for those damages, but there's an argument that depriving you of an identifier already granted is a more fundamental violation of a right to a name, an identifier and recordkeeping of them.
You might want to write to the CA attorney general. Former AG Xavier Becerra was able to dissuade ICANN from letting the .org fuckery happen, maybe Bonta could try to strong arm ICANN in this case.
EDIT: seems like Ethos Capital private equity firm wanted the .org registry, and Xavier Becerra (Attorney General of California at the time) wrote a letter that played major role in transaction being rejected
> Dear Messrs. Botterman and Marby:
>
> I urge ICANN to reject the transfer of control over the .ORG registry to Ethos Capital.
> The proposed transfer raises serious concerns that cannot be overlooked.
> In April 2019, ICANN proposed an end to the price cap of .org domains and effectively removed it in July in spite of having received 3,252 opposing comments and only six in favor. A few months later, the owner of the domain, the Public Interest Registry, proposed to sell the domain to investment firm Ethos Capital. After intense criticism from nonprofit groups and significant figures in Internet history, the proposal was scrapped.
Surprisingly not by Verisign, who gave up .org in 2003.
So, where is our fully decentralized TLD alternative, free of ICANN or any central authority to handle how we grant names by conventions, without any money scheme in the game that attracts malevolent actors moving only through greed strings?
Also, this time let’s make it like usenet, so "person:named:Neil Fraser" or even "::Neil Fraser" (harder to type but less culturally entangled into English).
> So, where is our fully decentralized TLD alternative, free of ICANN or any central authority to handle how we grant names by conventions, without any money scheme in the game that attracts malevolent actors moving only through greed strings?
We can all edit our hosts file.
The problem with a lack of a central authority is domain names are most useful if they follow the highlander principle. There can only be one neil.fraser.name ... otherwise it's not usable for routing traffic if every webserver a Neil Fraser runs uses that address. (Yes, there are useful ways for one name to resolve to different webservers, but almost always those are webservers under at least loose control of a single entity or very exceptional cases)
That's pretty shit. You'd think changes like this would need to go through a public comment period with the affected users (much like city planning decisions do)
Consider whether you'd be questioning this if the author had written that within minutes of his daughter being born, her photo was on Facebook. The only thing it suffers from is not being normalized and taking marginally more* effort, while being nowhere nearly as creepy.
* or arguably the same amount or less; for additional context: the author is an ex-Googler
I even suspect that the name of the child was dependent on the domain name being free... but then, it shouldn't be too hard to set up the request in advance and just press the button once the child is born. Maybe there was some rule that names could only be registered for living (i.e., born) persons?
To be faiiiir, when your partner is absolutely zonked out in the minutes post-delivery, what else is there to do when you're by their side and still half-asleep? Time to start announcing your pride and joy to the world, starting with a domain zone file.
Pretty crazy to be focused on anything other than your immediate family in after a birth... but not exactly unprecedented when you look at social media posts!
I mean, you've already had 10 months to come up with some name ideas. It's not like it's a huge surprise when it happens. You could even register the names before they're born.
I thought there might have been a need to send an ID to prove that you actually have the name you're registering for so you would need to wait for the birth certificate but from wikipedia it doesn't seem like that's the case.
No requirements at all. My mom had registered my firstlast.com domain some 30 years ago. While caring for my dying dad, she let all her domain registrations expire. I then had to negotiate with a domain squatter to get my domain back.
I wrote to ICANN support and got a template-AI answer wholly unrelated to my complaint about this:
”Greetings from ICANN Global Support.
I am sorry to hear you are experiencing this domain access issue after your registrar's transfer. I will happy to provide you with relevant information and guidance.
Please note that, ICANN accredits companies as domain name registrars and works to ensure contractual compliance with the terms and conditions of the 2009 and 2013 Registrar Accreditation Agreements (RAAs).
ICANN does not provide domain name registration or manage domain accounts. As a result of that ICANN is not able to perform domain management for you.
If you need help to access and manage your domain, you will need to contact your domain service provider or registrar for assistance.
You may check who your registrar is by doing a domain search at lookup.icann.org.”
That's 22k people with third level domains like first.last.name. There are close to 100,000 second level last.name registrations, which are not going anywhere.
Surely the author must have anticipated some heightened level of risk in pegging important parts of his personal and business life on a nonstandard TLD like this.
It's a pretty bizarre exception to the normal, intuitive ways that domains work.
I'll admit that it's a crappy situation and I would be frustrated in his place. But if I were in his place, I probably would have also thought it prudent to have a backup plan.
What exactly is non-standard about an ICANN-approved TLD? Yes, the multi-level structure is a little odd, but given that ICANN approved it in the first place, one has a reasonable expectation that they would work as advertised.
Even though .science was launched in 2014 (more than a decade ago), I still consider it a non-standard TLD and still deal regularly with difficulties around its use. (For instance, you wouldn't believe how many online services reject email addresses than end in .science because they use regexes that exclude TLDs with 7 letters.)
Likewise, I've registered .lol and .fun domains but never would have assumed that just because they're available now, they will be available in perpetuity.
In that sense, .name as a third-level TLD is even more non-standard, because the standard way domain registration works is by choosing a single "second level" domain name, then adding subdomains.
> Likewise, I've registered .lol and .fun domains but never would have assumed that just because they're available now, they will be available in perpetuity.
Why wouldn't you assume this?
> the standard way domain registration works is by choosing a single "second level" domain name, then adding subdomains
The entire ccTLD systems of the UK, China, Germany, France, Japan, and many others would beg to differ.
I don't think those are comparable, because when you register a .co.uk domain, you are selecting one name that precedes .co.uk, similar to how you register one name that precedes .com.
Whereas with .name, you are choosing what appears to be a subdomain, followed by what appears to be a domain name. But under the hood, you do not own all subdomains for that domain name; you own only the combination of first_name.last_name.name.
I'm not sure I understand. How is registering first.last.name not also selecting one name ("first") that precedes last.name, similar to how you register one name that precedes .com?
(And yes, I am aware that you can also register last.name by itself, but only if there are no third-level domains using it, so for practical purposes it doesn't change my question above. Plus, when the OP originally purchased his domain, you could only buy third-level domains for .name.)
Present these two domain names to the average person:
1) benedict.cumberbatch.name
2) drstrange.co.uk
I expect the average person would assume that for the domain 1, .name is the TLD, cumberbatch.name is registered by a private entity, and benedict (and any other subdomains associated with cumberbatch.name) is a subdomain fully controlled by that private entity.
Whereas for domain 2, I think the average person will view ".co.uk" the same way they view ".com", even though technically it is both a ccTLD and a second-level domain.
.name is in no way a "nonstandard TLD." It has been in existence for a quarter of a century and was part of the first batch of new gTLDs approved after the dot-com boom had begun, in 2000.
For the first couple of years of .name's existence, it only allowed registration of third-level domains, and the ability to register second-level domains was added later (and only if no third-level domains existed for that second-level domain).
The author is in no way at fault here, and I don't think I would have assumed there was a heightened level of risk if I were him.
It seems like the right thing they should do is discontinue new registrations but continue to honour existing ones (+ continuing to reserve any 2LD that has a 3LD registered on top). It’s a bit insane that they can decide to just terminate all existing 3LD registrations. One would hope that they’d at least continue to reserve the 2LDs for some period to avoid domain squatting, but this isn’t mentioned in the proposal and I doubt Verisign would graciously do so.
Maybe they want to avoid the ambiguity between john.doe.name versus john-doe.name, and I assume they prefer the latter scheme because it probably sells better. Nevertheless, discontinuing existing domains is disgraceful.
Even that doesn't pass basic scrutiny. The same ambiguity can and always will exist with tim-apple.com and tim.apple.com - there's nothing here that needs fixing.
True, they can’t outright prevent the ambiguity, but much fewer people will go to the trouble of establishing such subdomains when the option isn’t directly offered by the registrar.
This is my theory because, a priori, 3LDs should be more profitable than 2LDs, because with 3LDs John Doe and Jane Doe don’t have to compete over doe.name, but instead can each separately purchase john.doe.name and jane.doe.name. Apparently, however, that’s not a benefit of 3LDs in practice, which leads me to conclude that john-doe.name and jane-doe.name just sell better.
I can say, as a SysAdmin, I have been taught and tell my users to check the domain to verify a website is real.
It's a strange edgecase that the owner of John.Doe.com does not need to own Doe.com
In every other case that I know about, to own the Joe subdomain of Doe.com, you would need to own Doe.com
That is definitely not true. There are literally thousands if not tens of thousands of well known domains that do this. .co.uk is a very common example.
I can’t think of any prominent ones outside the country domains.
I think the problem is that .co.uk, .gov.uk and so on are very well known in the UK.
The .name subdomain rules are not very well known anywhere.
There are still exceptions to this like .co.uk and many others.
I'm surprised they don't just do that, and maybe even to go a little further, disallow renewals so you can phase people out and reclaim domains you can sell.
Whether disallowing renewals or terminating them tomorrow, there's still the same core problems, only the date of the offense changes: (1) seizing people's names that they've established, breaking innumerable things including email and server hostnames, and (2) the possible resale of the 2LD fraser.com to a third party who will be free to do malicious things like reading OP's email, redirecting his traffic, or extorting him, to sell continued access at any price demanded.
That would be so cool and would make these limited hot commodities.
.name was one of the very first expansions of gTLDs back in the very early 2000s. It's a shame that it's being shut down as it was spearheaded by the ICANN itself rather than some registrar / investor like Donuts, Inc.
I suppose this is impractical as someone has to run the registry and there are costs associated with that. But don't the domain fees cover it?
From having worked in that space what feels another lifetime ago, I vaguely recall that you can just offload the registry work to a registry that would manage this together with a mountain of other TLDs.
As I recall it. This was mostly a money scam that targeted private users with ads like "make sure to claim to your .name domain so no one else does it and use it to impersonate you". It was stupid from the beginning and never took off.
I freaked out for a second because I've owned `dvt.name` for like 15 years. `.name` is not getting terminated, so it's important to be precise here. The third-level x.y.name (where you're the `x`) is getting terminated, and the respective `y.name` domains are going to be released.
Still a crappy thing for people, but it does not affect owned second-level domains.
There should be a conflict resolution to gracefully degrade the third level to 2nd level when there is no competing name on the second level.
But I didn't think about the 1st level competitors. There'd still need a mechanism to resolve that...
1. First come first serve? (e.g. whoever registered a y.name first, whether x is bob or sue is determined by the earliest registrant on record) 2. Lottery/random selection? 3. Bidding war?
I think the problem is 2nd level domains who have the same name will be a problem when they find out all these other 3rd level are now expiring and can run a route to spoof? Likely wouldn't happen, but with the fuckery in the DNS that can happen... This is such a rash and weird decision to push through so quickly just because engineers find it "easier" while ignoring the implications of the move, seemingly when it comes to larger scale security.
I assume there would have to be some method to prevent routing of third level domains to subdomains of two-levels... (or is that just me being a fool yet again, assuming we have competent administration of our systems).
> There should be a conflict resolution to gracefully degrade the third level to 2nd level when there is no competing name on the second level.
Curious if there are prior similar situation that went with conflict resolution compared to outright termination approach that .name went with.
I don't get the difference. If I acquire the y domain and make it work as a subdomain broker, it's the same thing no?
There is no subdomain/TLD bit
It kind of seems like an insane TLD structure to begin with, right? I always thought .co.uk was bad (you're just pinning yourself to whoever owns the .co. part, but at least browsers have some suffix list where you can't, I don't know, hijack some login cookie for all of .co.).
Joe Smith and John Smith can independently register joe.smith.name and john.smith.name, do browsers have a wildcard suffix list for the 2nd level of `.name` specifically, or can Joe set a cookie on all of .smith.name?
.co.uk is run by the same people as .uk. There is no additional org that you trust when you register a .co.uk: https://en.wikipedia.org/wiki/.uk#Second-level_domains
> do browsers have a wildcard suffix list
Yes: https://publicsuffix.org/ and they have discussed this situation here: https://github.com/publicsuffix/list/issues/2306
I know about the public suffix list - I was wondering about the wildcard specifically. In the very issue you linked to, as of 2025, it seems this was still unresolved...:
> We have no plans to modify the .name entries at this point in time. We are aware of the implications of adding a wildcard, therefore we won't.
Yeah, apparently they both (used to) offer unbounded registrations of 3LDs and unbounded registrations of 2LDs? So if I see j.doe.name, the only way to find out if "doe.name" is a public suffix or not, i.e. if I should (not) be able to set a cookie on it, would be to email the registrar?
So does that mean that in practice, .name domains were always treated by browsers like regular 2LDs, meaning the cookie and origin protection was always broken for those domains?
Doesn't sound like good news for the guy in the OP...
I'm just saying that they have discussed the situation. They seem to have no answer and for cookies and similar things the answer probably is "maybe don't run security critical web stuff in the third level under .name".
IIRC orgs like letsencrypt also use the PSL for rate limits, so there are probably more issues that are not browser-based.
Yes, Japan does the same with .co.jp but also .ne.jp, ac.jp, etc.
There are many examples; k12.<state>.us is another.
It is (or was for a long time, IDK) a strongly recommended practice from ICANN. I imagine nearly all countries to do that.
There end up being some weird edge cases where there are some countries which have both the equivalent of .co.uk but also allow registrations directly under the two-letter country code as well. .mx is one such case where most business are, e.g., costco.com.mx, but it’s also possible to register directly under .mx as well so Toyota Mexico is toyota.mx and not toyota.com.mx (the latter is registered, and ostensibly to Toyota, but the whois and nslookup records give very different results and the website doesn’t load when I try to visit it).
Since neither smith.name nor the wildcard *.name appear in the Public Suffix List (https://publicsuffix.org/), browsers would likely allow any page on a *.smith.name domain to set cookies for .smith.name.
There was an effort to properly handle the .name 2LDs, but it was never resolved because there’s no easy way to tell a reserved 2LD (open for 3LD registrations only) apart from a normal 2LD on .name: https://github.com/publicsuffix/list/issues/2306
So yes, this TLD’s setup is in fact pretty insane.
I think this says more about how the cookies security model is stupid. They should always have been scoped to the single, exact name they were set from and nothing else. Websites would have had to be designed a bit more thoughtfully.
It seems like it would be easily resolvable with TXT records these days. Anyone could try, say, on www.google.com to set a cookie for all of google.com, and the browser can fetch TXT records on google.com to see what, if any subdomains, it wants to allow this privilege for. Google could return a list or a wildcard; co.uk wouldn't allow any.
In a world without advertising, there's no reason why google.com couldn't also allow *.youtube.com to set cookies for it, but of course that would cause a tremendous privacy freakout. Though in practice they can and do just send every login/logout through a 302 redirect roundtrip to take care of the cookies on youtube.com.
It’s not nearly just cookies, and I think interpreting domain hierarchies as administrative structure generally does make sense.
Maybe it could be opt-in or opt-out via some markers at the DNS level, though? The public suffix list having to exist at all is bizarre.
An “administrative structure” seems fine, but the fact that a subdomain gets any sort of privilege over the parent has always seemed absurd to me.
Surely a better solution would involve an actual request. login.foo.com could send a request to foo.com with Origin: login.foo.com asking to set a cookie, and foo.com could make its own decision.
that seems strange to me: why shouldn't policy leverage name resolution? sort of like dkim, but taken further. for instance, for site.com, I'd much rather retrieve its public key from DNS (some DNS++ version, of course).
I'm always mystified why we haven't leveraged DNS.
I mean: why not have cookie policy set by a flag in DNS? Not unlike DKIM or even SSHFP.
Of course, we wouldn't need the entire certificate industry if we simply looked up a site's PK along with its DNS record...
> no easy way to tell a reserved 2LD (open for 3LD registrations only) apart from a normal 2LD on .name
And that's one reason why the public-ness of a hierarchy level belongs on a DNS record on that level and not some separately-distributed side list.
> It kind of seems like an insane TLD structure to begin with, right?
It's been around for years. I seem to remember this issue coming up around 2001 where originally .name was for third level registration (i.e. john.doe.name) and changed to second level it a few years later and caused some problems... https://publicsuffix.org/ talks about it in light of architectural limitations of domain names.
> can Joe set a cookie on all of .smith.name?
That can happen. I seem to remember ancient browsers made it so .name (and other non-generic TLDs) required three periods. I think country code domains and new generic TLDS caused the browsers to change it.
It's pretty screwed up, but a lot of the people with .name domains have had them for a very long time. Sad to see them all lose their identity online that way.
So, this kind of thing happens all the time, and there's the Public Suffix List for exactly this problem.
There would be no issue at all if Verisign, or maybe Global Name Registry, decided to stick to the 3rd level registrations exclusively. Problem is, the chucklefucks over there decided it was a good idea to also hand out 2nd level registrations. Those 2nd level registrations outnumber the 3rd level registrations by an order of magnitude, so the PSL decided to just let joe.smith.name and john.smith.name share cookies. Which, IMO, was not a good decision, but it is what it is.
Nobody owns the .co part of .co.uk. If you buy foo.co.uk, that is registered with Nominet, who are the registry for .uk.
> Nobody owns the .co part of .co.uk. If you buy foo.co.uk, that is registered with Nominet, who are the registry for .uk.
Yup. The original statement was dangerous FUD which should be urgently corrected.
Yes, but you have to admit that the existence of these SLDs (like co.uk) is always going to be a point of confusion for anyone with a basic knowledge of how the domain hierarchy _usually_ works.
Needing to be familiar with all the special cases (like the VERY special case of x.y.name which I previously knew nothing about) kind of ruins everything and introduces yet more security risk.
> but you have to admit that the existence of these SLDs (like co.uk)
I'm sorry, what ? Admit ? Confusion ?
In the case of .co.uk it has been around since 1996. HN is a technical forum, most people here should be well aware it is a serious SLD. I honestly can't believe it even needs clarifying.
Hell, if you use AWS Route 53 you'll see they use co.uk as one of their nameserver suffixes[1].
[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/SO...
About 20 year ago I registered {lastname}.name and have dozens third level domains below it. So there are "privately owned" second level domains under .name for quite some time...
I'm working on same for my family since I want to properly degoogle a bit. One thing I think long term - if I give my kids first-name @ last name , that means that I forever hold power over their email. Which isn't great. But what's the alternative? Register one full domain name per kid? Even ignoring the cost, the ergonomics are awful.
Imho email is missing a feature for nameless email addresses for when somebody just buys their full name as a domain name. If I get "firstname-lastname.name", having the email be "firstname@firstname-lastname.name' kinda ruins it.
Not to mention some of those kids may end up changing their names at some point if they get married and decide to take their partner’s last name.
Aside: I'm honestly bewildered that Google doesn't have the ability to handle that in gmail accounts. If somebody gets married or otherwise needs to change their name, their answer is "just make a new google account" when all your stuff is still tied to the old account.
From what I can tell most people do something like me@myname.whatever or hi@domain.
A child born today sees email like we see the telegraph...
they'll grumpily sign up to gmail just so they can get a verification email, and that'll be all it gets used for. Messaging their irl friends will be done in apps like Discord.
Truth.
lol I ran a sizeable team around 2020 and I had to educate a couple of our new hires straight from college that they actually needed to check their work email, after they missed important HR related stuff and they had just completely not realized it was an avenue for company communication, with an assumption that everything was available on our heavily used slack.
To me that sounds like reasonable structure. I hold that every single edu, gow and mil domains should be moved under respective ccTLDs. After this sort of move that doesn't seem unreasonable thing.
Surprisingly the public suffix list doesn't list `*.name`. So they're indeed not properly isolated from each other.
https://publicsuffix.org/
edit: apparently not all second level domains in .name are public suffixes anymore, so a wildcard addition wouldn't be correct.
It wouldn't surprise me if that is (maybe even a large) part of the reason for this change.
Note that the posted link talks about .uk.co, which currently does not exist but I guess may have in the past. Where .co is the ccTLD of Colombia.
Different from .co.uk.
Originally there was uk.co.orgname.
> I always thought .co.uk
What the hell are you talking about ?
1. The Nominet rules are crystal clear about which 2LDs are managed by Nominet[1] (co.uk, sch.uk, gov.uk etc. etc.). `co.uk` has been a Nominet managed 2LD since 1996 and it is not going anywhere.
2. FUN FACT ... Nominet introduced the ability to register directly under `.uk` much, much later, in 2014. Before 2014 your only option was to register under the auspices of a Nominet managed 2LD, e.g. `co.uk`. Ownership of a third-party 2LD is validated in 10 seconds via the usual WHOIS.
I suspect you meant 'uk.co' and other such shenanigans. Please correct your post accordingly.
[1]https://nominet.uk and https://www.nominet.uk/wp-content/uploads/2025/03/UK-rules-o...
Ok, co.uk was perhaps a bad example, because it's owned by the same registry as the TLD, but perhaps there are other 2nd level TLDs where that is not the case. My point is both that it's hard to tell, and more broadly why would anyone want their domain to be tacked on to some 3rd level subscript anyway, when there's so many plain top level domains available. Surely most of us (present company excluded perhaps) do not feel so passionately about the reverence of `co.uk`
I don't have some nefarious desire to scare people away from the TLD of their choosing. Really I'm bringing it up to be like "why would you even, like, want some 3rd rate domain instead of getting a .com" so I don't think there's anything to correct
> My point is both that it's hard to tell,
Its not hard to tell for things like ".uk" or other serious suffixes.
It only (maybe) becomes hard(er) to tell for all the vanity ccTLDs that came along in the 2000s. But even then 10 seconds on WHOIS and Google should fix any doubt.
> about the reverence of `co.uk`
What are you on about ? Lots of other countries do it too. Japan is one example given already here, but there are dozens. It is very common practice for country tlds.
geez, dude, someone woke up on the wrong side of the bed this morning...
> geez, dude, someone woke up on the wrong side of the bed this morning...
5 seconds on wikipedia or google would have stopped them spreading completely dangerous FUD about .co.uk.
What's so dangerous about it?
> What's so dangerous about it?
Implying lack of trust in `co.uk`
Implying `co.uk` may suffer the same fate at `.name`
Complete FUD.
You're absolutely right, when it's Nominet's actions that actually inspire a lack of trust in .co.uk, given they've been a bit of a hot mess since the early 2010's-ish.
;)
(Edit: although I should add that I'm hopeful that things have improved there over the last few years).
> given they've been a bit of a hot mess since the early 2010's-ish
No.
Oversimplified summary:
There was a period around 2010 when the management at the time wanted to follow a more commercial route with various unrelated "investments".
Nominet members made it impeccably clear in a very loud manner to management that it would not be tolerated.
Management insisted on a vote which they inevitably lost.
Management departed.
TL;DR Don't piss off Nominet members
.uk.co (mentioned in the blog) isn't .co.uk
It wasn't obviously wrong in 2001. .pro started with a similar structure around the same time.
Agree that the .name 3rd level domains are silly, disagree on .co.uk being a problem.
If .gov and .mil and .com make sense, then .gov.cc and .mil.cc and .com.cc make sense.
Of course, I think having more than one non-cc TLD was a mistake, but that's just me. If it makes sense to have topical TLDs for international and US institutions, it make sense to have national ones.
The 3rd level .name domains are the original ones. They didn't hand out 2nd level domains until three years after they started.
> disagree on .co.uk being a problem
Nominet and therefore .co.uk has been around since 1996.
.co.uk is not going anywhere, and neither is Nominet.
The only "problem" is the original poster did not do their homework. I suspect they were inferring `uk.co` which is a completely different kettle of fish. The original poster should urgently correct their post.
And that kids is why it's always DNS fault.
Again, you're security is only as strong as your DNS.
We were rescued from that dot org scam by the fact that ICANN is a California non profit. I wonder if the AG can lean on them again. This is an outrageous thing to do.
This is why I am building DNTLS. These organizations no longer deserve our trust and they have inadvertently gained too much power over the last two decades of massive internet expansion. Names need to be fully owned by individuals and a shared, decentralized trust system must be in place for resolution. The more I see actions like this, the more convinced I am that a solution is long overdue.
Never heard of DNTLS, thanks for sharing. I skimmed the Website Abd am a bit uncertain hat the ai angle is. Shouldnt naming be, well, just naming?
Yeah, the website is a holdover from when we were pitching AI VCs a few months ago. We quickly determined that the whole system is now "Cancer Capital" (see the other front page HN thread) and have pivoted to just bootstrapping from a close syndicate of like minded individuals. We plan to update the website this month, sorry it's a bit behind.
In short, AI identities were just a happy accident that comes with the system/architecture. It's not tied to AI at all.
But if anyone is interested in talking about what we're doing more, happy to connect at hn@sepositus.com.
Do you have a brief explanation of what DNTLS is that you could post here?
There is already ENS.
The adoption has basically been non-existent. I have a lot of theories on where they've gone wrong. Being so heavily tied to a blockchain (Ethereum being the worst due to its state bloat) is probably the biggest mistake I think they made.
isn't yours tied to crypto and AI?
No, see the above comment.
There's a DNS wizard at my job (not doing DNS stuff currently; but in his past life), and while he was talking to me about certain topics my eyes glazed over, and I thought, "Man, surely that won't affect me, right?"
Well, it's still not affecting me, personally, but wow, seeing articles like this makes it feel just a tiny bit more real.
One of the reasons I stick with Big Email for my primary email is cases similar to this. If I host email and lose the domain one day, I’ve lost two factor on a thousand different services (the single factor on some). Big Email’s policy is to not reissue my address, should I lose it or die.
The .name scenario is even worse. One domain gives you access to tens of thousands of users email. It seems like a privacy nightmare.
I’m not sure how future auth and privacy will work, but my child lost a tracfone phone and some mixup had separated it from my account. There was no way to recover the number. If that was my personal phone, how difficult would it be to restore banking, medical, and government access to things that assume I’ll always have that number.
Doing the same with personal email seems like too big of a risk.
You can look through my history how many times I’ve brought this up to people and they just don’t seem to care. A defence is that they’ll buy the domain for a century and not care once they’re dead which is fair but the situation in this article is a valid one. I will always stick with Big Email for accounts.
Who is running the show over at ICANN? How can this possibly be a reasonable thing for a registrar to do?
I worked for .name briefly right at the beginning of their entry into the world. Interesting but very odd part of my career.. Ill give it that.. I personally found the product at first a great idea but somewhat crippled by execution..
> Once the 3rd-level domains are terminated, it is assumed that the now vacant 2nd-level domains will become available for registration. Should someone (other than me) scoop up fraser.name (...)
What's to stop someone from doing that, and keeping the status quo? Sure, it might be expensive, but pool together a few frasers for the initial buy, and make the money back on the sublets.
Well, nothing, but it does assume that Verisign doesn't have an unstated plan to do something else with .name. Domain registration is the real estate of the Internet and very little has happened in the last 30 years of domain name policy that has been for the benefit of anyone outside the the registrars.
For all we know, this is simply the first step in a series of moves for Verisign to better monetize the .name TLD in some novel fashion.
My evidence for this is that Verisign's own arguments for terminating the third-level domains are highly dubious. They claim that the third-level domains are too hard for them to manage. Bollocks: there are only 22,000 of them in use. That is a VERY small database that practically fits on a calculator and I refuse to believe that any manual labor around it is an outsized burden compared to pretty much any other semi-popular TLD. The second claim is that "the majority of those are not in use." Okay, if that's true, then where is the management burden coming from? That means tens of thousands of people are giving them money and getting nothing in return, isn't that the definition of an ideal business model?
It just doesn't pass the sniff test.
And finally, having read both of the linked documents, it sounds like people who have registered their .name for years in the future are not getting their money back. Are they likely to pay a second time, to a sub-registrar with no history?
Also, someone managed to run all this 20 years ago. Has technology gotten so much worse? Is RAM now THAT expensive?
Depends on how much one trusts whoever's running fraser.name. Is it more or less than Verisign?
You have to trust them and Verisign; which will always be less then just Verisign.
Unless your trust for VeriSign is already zero
Discussion from yesterday: https://news.ycombinator.com/item?id=49516047
I don't think it's hyperbolic to say that this is the most careless, disruptive change to anything to do with DNS or internet names I have ever seen.
> "will increase efficiency for the operation of the .name TLD."
What a preposterous excuse -- especially for something already up and running. Sounds like they probably want to change the backend in some way - or adopt some kind of off-the-shelf software - which doesn't jive so well with this unique TLD, and they figure "Ehh, fuck 'em, let's just pull the plug on these tens of thousands of people."
Wow! Years ago I initially bought my firstname.lastname.name, then I let it expire and then bought lastname.name. So glad I did!
Never dreamed that such a supposedly durable thing would just disappear. How hard is it really to preserve a global resource like this that exists only in software?
From the Verisign application [0] for this change:
ehhh, how is that possibly true? This change (deleting all third level names) by definition affects the lifecycle of domain names ... by terminating them!Many years ago I wrote articles bringing attention to the negative effects of Verisign's SiteFinder [1] - if you don't remember this, it's when Verisign hijacked NXDOMAIN by redirecting any unresolvable domain to a site they owned and controlled.
[0] https://itp.cdn.icann.org/en/files/consensus-policies/rsep-2... [1] https://en.wikipedia.org/wiki/Site_Finder
"Well, it doesn't affect the lifecycle of domain names. The lifecycle is defined in some RFC somewhere, and this change doesn't modify that. Now, these particular domain name instances might be adversely affected, but you didn't ask about that." -- lawyers, probably.
I kind of assumed .name was a product of relatively new TLD explosion [1]
[1] https://blog.asmartbear.com/free-markets-bad/
Gotta wonder what other possible disasters introduced with gTLDs.
No, we were in fact part of the very first batch of "new" TLDs
> Despite the fact that it's registered and paid for until 2040
How is this possible? I thought there was a 10 year limit.
I think it was figure of speech. The domain is registered until 2036
> Registry Expiration: 2036-01-29 00:00:00 UTC Updated: 2026-09-03 08:12:27 UTC Created: 2002-01-23 14:41:45 UTC
Will they get a refund?
it's probably a 10 year registration, plus a pre-paid renewal at the registrar
If this proves to be a viable business strategy, then verisign could equally use it to re-sell google.com, ycombinator.com, etc. to the highest bidder.
I've had a .name domain forever and I had no idea first.last.name was even a thing, meaning that it was possible to register this without owning last.name.
That said, my domain is simply unusual.name, and everybody in my family has email addresses in the form first@unusual.name. So this is a no-op for me, and I gather www.unusual.name will also continue to work, since I own the 2nd level outright.
I'm sure Verisign would be thrilled to have a bidding war between the legitimate owners of fraser.name and a bunch of third parties they suddenly enabled.
This is silly question, but is your family managing trust in you as lone guy - cousin, father, brother - having potentially access to all their emails?
I feel that I more trust some corpo (Google, etc) that one particular person.
I don't imagine setup where you can effictevely guarantee them full privacy.
I don't store their emails, I use forwardemail.net and they have a pretty reasonable privacy policy: https://forwardemail.net/en/privacy
Some people in my family use it as their main address, others don't, it's entirely their call.
But yes, ultimately I control the domain and could be nefarious if I wanted to. But there's a certain baseline level of trust as a family, I'm reasonably certain my wife won't poison the milk in the fridge and she's reasonably certain I'm not going to read her emails.
How do you manage the bus factor? You die tomorrow and what happens to management of the domain and therefore access to their emails?
I manage the email accounts for the others in my household because it's free for them and I'm happy to do it. Plus, they trust me more than they trust a random tech company. Maybe that is not a universal thing among all families or parts of the world.
How do you manage the bus factor? You die tomorrow and what happens to management of the domain and therefore access to their emails?
> This is silly question, but is your family managing trust in you as lone guy - cousin, father, brother - having potentially access to all their emails?
I believe this is a very common setup: the "computer wizard" kid of the family manages the computers for the whole family. Not just emails, they have access to the whole computer (and have to fix when it breaks).
It was deemphasized pretty early because people didn't understand it.
It made sense to us because our starting point was an email service letting people share lastname.sometld, but we never got close to as many registrants on .name as we had users on the webmail service (we had a couple of million accounts on that when it was sold to one of Marc Cubans companies for a relative pittance in the aftmath of the dot com bubble bursting)
I am also one of the 22,000 people who have a third-level .name domain and I am livid about this, not least because Verisign flat-out lied in their proposal to ICANN: (https://itp.cdn.icann.org/en/files/consensus-policies/rsep-2...) :
"2.1. What effect, if any, will the proposed service have on the life cycle of domain names? None. There will not be any effect on the life cycle of domain names.
...
2.3. Explain how the proposed service will affect the throughput, response time, consistency or coherence of responses to Internet servers or end systems. There will be no effect on the throughput, response time, consistency or coherence of responses to Internet servers or end systems."
My registrar is also suggesting that they are going to just keep the money I pre-paid for years of registration, which is a minor annoyance compared to the loss of my entire online identity but an annoyance nonetheless.
Since ICANN is a non-profit that is required to operate in the public interest I do hope there can be some pushback on this. I will be writing to the CA AG myself.
ICANN approved this.
Ok I don’t get it. Why not register `fraser.nameˋ directly? Or pick any TLD and register ˋ a 2nd-level domain (ˋfraser.tld`)? It just feels easier, plus this way you don’t have to pay for any new member of your family?
If aaa.bbb.name is registered, then bbb.name cannot be registered.
bbb.name can ONLY be registered if it is not already registered AND there are no 3rd levels registered on bbb.name currently.
https://manage.whois.com/kb/servlet/KBServlet/faq1485.html
> Or pick any TLD and register ˋ a 2nd-level domain (ˋfraser.tld`)?
How would that help? The problem is that he's losing access to all the accounts currently tied to fraser.name, if he is changing that he can just use any arbitrary domain anyways.
I mean in the first place. Now it's too late indeed.
The post sounds like that wasn't possible; that this TLD operated by exception with third-level domains. It would be like asking why you don't just register smith.uk instead of smith.co.uk: because you can't (https://en.wikipedia.org/wiki/.uk#Second-level_domains)
That's just my reading of the situation though. The person could now hope they're the first to claim their second-level domain once it becomes up for grabs, but there's probably a dozen other people with a fraser subdomain that would want the same, plus however many hundreds of scalper scum. Probably the best you can hope for is that whoever does get it, has the decency to honor the original third-level domains for a reasonable fee
> It would be like asking why you don't just register smith.uk instead of smith.co.uk: because you can't
You can. Anyone can register a .uk, and you don't need to own the .co.uk
There will other people with the Fraser surname in the exact same position.
Because only one lucky person can own `fraser.name` at any one time in your model. And whilst that lucky person might be able to register their family members for free. There will be countless more (unrelated) Frasers who won't be able to register (even for money) their own `FIRST.fraser.name`.
So the argument goes, society as a whole gains more if we prevent anyone from owning `fraser.name`.
A legitimate alternative though, is to register `FIRST-fraser.name`
At the beginning of the existence of the .name TLD you couldn't do that, you were forced to register firstname.lastname.name and provide an ID to justify registering this specific domain.
With it you got an email redirection from firstname@lastname.name to the address of your choice. At some point this feature was discontinued (I assume when VeriSign took control of the .name TLD), a bit after it was decided (again by VeriSign) to allow registering first level .name domain. My main email address stopped working from one day to another without me being warned in any way.
When this happened I've emailed VeriSign and my registrar at the time, and tried several time since then, to be able to register the first level domain I'm the only one using, but they categorically refuse, despite recognizing that a single subdomain has ever been registered. They kept saying that I could just let the domain expire, wait for the grace period, and register it once it's liberated, hoping that no one does it before me, and without any solution for the downtime in the mean time…
And now this… fuck VeriSign -_-
This really sounds like VeriSign has no business owning .name … best possible outcome would be transferring it to somebody who will retain the originally intended services.
It has been extreamly clear VeriSign has no business doing anaything for years.
The firstname@lastname.name email forwarding is still working for me. I think only some registrars support it, though.
Dude, this is one of the craziest things I think I've read on HN
First, that a legit dealer could/did(does?) sell third-level domains at all (Verisign, no less) Second, that the top-level is staying available, allowing for second-levels to be bought/sniped like you mention.
If you do lawyer up and need help with legal fees, I think this would be a worthy cause.
They deserve to lose their control of all domains over this.
This is ridiculous.
Wow, they were extremely laziest in the request form too. Most answers are just a few words.
Seriously.
Also note that their response is the exact length of the shortest allowed one, and yet still wrong.
I want to hear you justify, with perfect gravity, “N/A.” being the exact same length as “None.” Pictures of handwriting or specific fonts accepted. :D
It's _almost_ the same length if you count the period on "N/A." but not on "None."
I think the “not applicable” is to the elided second sentence of the question:
> 3.6. Have you communicated with any of the entities whose products or services might be affected by the introduction of your proposed service? [→ No.] If so, please describe the communications. [→ Not applicable.]
Gotta say that the entire form feels not applicable. The proposed service is the discontinuation of an existing service. I see from their website that other similar things do the same, but it feels broken when so many of the questions become nonsense.
This is how you fill out an application when you know it's going to be rubber-stamped.
The nerve.
I feel like TLDs as a concept are more trouble than they are worth. We should just have .com and get rid of the rest (except special purpose tlds).
dang and team, perhaps it makes sense to special-case .name domains in the domain hint, like you do for GitHub and Ex-Twitter.
I didn't even know I was using .name incorrectly...
It's just money. Nothing else. Just money.
How would the avg person know that ..name is different and somehow more trustworthy than ..uk
Overall this seems like the right move, either they all are trusted or none.
Lawyer up and fight it. This is bs.
Instead of giving up, why can't all 22k .name owners move on to OpenNIC? They will not say no, you can't have that.
The ability to register fraser.geek so a very small number of OpenNIC users can access that new URL doesn't really solve the OP's problem with his family's long-established URLs disappearing and their emails being directed to whichever scammer buys up the fraser.name domain.
That isn't the correct problem. The 3rd level domain is going away, which can be reconqured via OpenNIC and mass re-adoption. There will surely be new problems, but owning will not be among those problems.
The problem is everyone else (such as email providers...) recognising your ownership.
> Second, my email address also disappears. Third, all the IoT devices that use services on this domain become bricks. Basically, I disappear from the Internet.
While changing email is inconvenient, I don't understand the point about IoT devices. IoT devices should not depend on the Internet at all for obvious privacy and security reasons. If you are using IoT devices with "cloud" accounts, then this is a blessing in disguise. Put that garbage in the trash and rebuild around HomeAssistant, Zigbee, RTSP, etc. I find it hard to believe that someone hosting their own website would fall for the cloud IoT scam.
Plenty of people and businesses have their own (DIY, etc) devices that need to use DNS. I mean it wouldn't really be the internet of things, if it didn't actually use the internet...
For instance, I own a .house domain that I use for a bunch of stuff that I've programmed. It would be a pain in the ass to go change that domain out. Now take that to next level and you're a business that's deployed a few thousand devices that need to call home.
I guess all this is to say - IoT doesn't just mean cheap botnet honeypot IP cameras. Take a look at https://www.balena.io/cloud for instance
It's dubious whether the Internet of Things was ever a good idea in any sense. Especially given how, famously, the "S" in "IoT" stands for security.
"Internet" in this context usually means IP, and in any case it should be restricted to a LAN. If you actually own the device changing the domain or IP should be trivial, I don't think this is what the article refers to.
He didn't say his IoT devices relied on 'cloud' accounts. He said there are IoT that use services on this domain.
Imagine he's set up some IoT devices at his parents' home, and those devices use services that he hosts somewhere on the internet. It would be silly to hard code the IP addresses in there, right (unless he operates his own ASN)? So he would use DNS to allow those devices to find his server(s). This would be the case whether the servers are at his home, at his office, or in a rack at a data centre.
It sounds to me like you understand the point perfectly well, you just cared to make a different point.
I would not use a 2nd level tld for a "stable presence". it seems like a gimmick
I can't be the only one that assumed based on the domain that this was some bizarre DMCA action by Paramount.
What does Paramount have to do with the last name Frazer?
https://www.paramountplus.com/shows/frasier/
I wonder if this could constitute a violationiof article 6 of the UN declaration of human rights.
It has been established that national identifiers are protected by it, and a domain works as a sort of international identifier, in this case a personal one.
No one is obligated to give you a domain, but by contracting an obligation to provide that identifier until 2040, they would at least be liable for those damages, but there's an argument that depriving you of an identifier already granted is a more fundamental violation of a right to a name, an identifier and recordkeeping of them.
You might want to write to the CA attorney general. Former AG Xavier Becerra was able to dissuade ICANN from letting the .org fuckery happen, maybe Bonta could try to strong arm ICANN in this case.
What was the deal with .org?
EDIT: seems like Ethos Capital private equity firm wanted the .org registry, and Xavier Becerra (Attorney General of California at the time) wrote a letter that played major role in transaction being rejected
> Dear Messrs. Botterman and Marby:
>
> I urge ICANN to reject the transfer of control over the .ORG registry to Ethos Capital.
> The proposed transfer raises serious concerns that cannot be overlooked.
(from https://itp.cdn.icann.org/en/files/correspondence/becerra-to...)
Thanks yeah was too lazy to go searching for a link.
I wonder which tech nonprofit would be best to champion this cause. Doesn't seem quite the EFF's domain.
I never bet in any other than .com, .org, .net?
.org almost got screwed in 2019 too:
> In April 2019, ICANN proposed an end to the price cap of .org domains and effectively removed it in July in spite of having received 3,252 opposing comments and only six in favor. A few months later, the owner of the domain, the Public Interest Registry, proposed to sell the domain to investment firm Ethos Capital. After intense criticism from nonprofit groups and significant figures in Internet history, the proposal was scrapped.
Surprisingly not by Verisign, who gave up .org in 2003.
I love that name, "Ethos Capital", it's so wholesome
it'd fit like a PE firm focusing on chemical weapons
Those are all controlled by companies in and subject to the demands of the USA, which has been proving for many years that they cannot be trusted.
Also, all common names with any of those prefixes have been registered a long time ago.
I really think ENS is on to something with blockchain based domain registration and management
Family of ESR or who is this?
How is it that they can just nullify the contracts they had with people they were providing services for?
Fuck verasign. TLDs should be run as an actual public utility. Can these economic parasites be expelled already…
Verisign is the worst. Hope author wins
May I ask what is wrong with Verisign?
Well, the post in OP is a good start
They have been generally scummy throughout their existence. https://en.wikipedia.org/wiki/Verisign#Controversies is a good start.
Breaking trust, one TLD at a time.
So, where is our fully decentralized TLD alternative, free of ICANN or any central authority to handle how we grant names by conventions, without any money scheme in the game that attracts malevolent actors moving only through greed strings?
Also, this time let’s make it like usenet, so "person:named:Neil Fraser" or even "::Neil Fraser" (harder to type but less culturally entangled into English).
> So, where is our fully decentralized TLD alternative, free of ICANN or any central authority to handle how we grant names by conventions, without any money scheme in the game that attracts malevolent actors moving only through greed strings?
We can all edit our hosts file.
The problem with a lack of a central authority is domain names are most useful if they follow the highlander principle. There can only be one neil.fraser.name ... otherwise it's not usable for routing traffic if every webserver a Neil Fraser runs uses that address. (Yes, there are useful ways for one name to resolve to different webservers, but almost always those are webservers under at least loose control of a single entity or very exceptional cases)
Namecoin (.bit) was an attempt to create naming system without a central authority using a blockchain.
But from what I remember, they fucked up the pricing function and it got overrun by domain grabbers.
Ah! verisign! Proving the world over and over what kind of scum they are
That's pretty shit. You'd think changes like this would need to go through a public comment period with the affected users (much like city planning decisions do)
Things like this happens from time to time and yet people insists on using stupid TLD:s just because of "cool" suffixes.
> Minutes after my daughter was born, I also registered beverly.fraser.name.
...minutes?
Don't want to get scooped by GoDaddy when they hear the good news.
Consider whether you'd be questioning this if the author had written that within minutes of his daughter being born, her photo was on Facebook. The only thing it suffers from is not being normalized and taking marginally more* effort, while being nowhere nearly as creepy.
* or arguably the same amount or less; for additional context: the author is an ex-Googler
Maybe they wanted the Created Date for the domain to match the birth date.
I even suspect that the name of the child was dependent on the domain name being free... but then, it shouldn't be too hard to set up the request in advance and just press the button once the child is born. Maybe there was some rule that names could only be registered for living (i.e., born) persons?
To be faiiiir, when your partner is absolutely zonked out in the minutes post-delivery, what else is there to do when you're by their side and still half-asleep? Time to start announcing your pride and joy to the world, starting with a domain zone file.
Pretty crazy to be focused on anything other than your immediate family in after a birth... but not exactly unprecedented when you look at social media posts!
I mean, you've already had 10 months to come up with some name ideas. It's not like it's a huge surprise when it happens. You could even register the names before they're born.
I registered a domain name for my son the day he was born...
shows his birthday, which I found amusing!GDPR would like to have a word with you! :D Nah seriously though, that's awesome.
I thought there might have been a need to send an ID to prove that you actually have the name you're registering for so you would need to wait for the birth certificate but from wikipedia it doesn't seem like that's the case.
No requirements at all. My mom had registered my firstlast.com domain some 30 years ago. While caring for my dying dad, she let all her domain registrations expire. I then had to negotiate with a domain squatter to get my domain back.
He didn’t say how many minutes.
Presumably less than 60
It was more than one minute.
just a figure of speech
Priorities. /s
I wrote to ICANN support and got a template-AI answer wholly unrelated to my complaint about this:
”Greetings from ICANN Global Support.
I am sorry to hear you are experiencing this domain access issue after your registrar's transfer. I will happy to provide you with relevant information and guidance.
Please note that, ICANN accredits companies as domain name registrars and works to ensure contractual compliance with the terms and conditions of the 2009 and 2013 Registrar Accreditation Agreements (RAAs).
ICANN does not provide domain name registration or manage domain accounts. As a result of that ICANN is not able to perform domain management for you.
If you need help to access and manage your domain, you will need to contact your domain service provider or registrar for assistance.
You may check who your registrar is by doing a domain search at lookup.icann.org.”
Absolutely infuriating
> I had history with Verisign and did not trust them.
I don't know what that history is, but did it really make a tld used by only 22k people more appealing?
That's 22k people with third level domains like first.last.name. There are close to 100,000 second level last.name registrations, which are not going anywhere.
https://www.icann.org/resources/pages/name-2014-03-03-en
According to Wikipedia, "Verisign was the outsourced operator for .name since the .name launch in 2002". That makes the reasoning yet more puzzling.
They ran the backend services, but didn't set the policies (until they acquired the operator in 2008-2009)
Surely the author must have anticipated some heightened level of risk in pegging important parts of his personal and business life on a nonstandard TLD like this.
It's a pretty bizarre exception to the normal, intuitive ways that domains work.
I'll admit that it's a crappy situation and I would be frustrated in his place. But if I were in his place, I probably would have also thought it prudent to have a backup plan.
> nonstandard TLD
What exactly is non-standard about an ICANN-approved TLD? Yes, the multi-level structure is a little odd, but given that ICANN approved it in the first place, one has a reasonable expectation that they would work as advertised.
I have a .science domain and a .com domain.
Even though .science was launched in 2014 (more than a decade ago), I still consider it a non-standard TLD and still deal regularly with difficulties around its use. (For instance, you wouldn't believe how many online services reject email addresses than end in .science because they use regexes that exclude TLDs with 7 letters.)
Likewise, I've registered .lol and .fun domains but never would have assumed that just because they're available now, they will be available in perpetuity.
In that sense, .name as a third-level TLD is even more non-standard, because the standard way domain registration works is by choosing a single "second level" domain name, then adding subdomains.
> Likewise, I've registered .lol and .fun domains but never would have assumed that just because they're available now, they will be available in perpetuity.
Why wouldn't you assume this?
> the standard way domain registration works is by choosing a single "second level" domain name, then adding subdomains
The entire ccTLD systems of the UK, China, Germany, France, Japan, and many others would beg to differ.
I don't think those are comparable, because when you register a .co.uk domain, you are selecting one name that precedes .co.uk, similar to how you register one name that precedes .com.
Whereas with .name, you are choosing what appears to be a subdomain, followed by what appears to be a domain name. But under the hood, you do not own all subdomains for that domain name; you own only the combination of first_name.last_name.name.
I'm not sure I understand. How is registering first.last.name not also selecting one name ("first") that precedes last.name, similar to how you register one name that precedes .com?
(And yes, I am aware that you can also register last.name by itself, but only if there are no third-level domains using it, so for practical purposes it doesn't change my question above. Plus, when the OP originally purchased his domain, you could only buy third-level domains for .name.)
Present these two domain names to the average person:
1) benedict.cumberbatch.name
2) drstrange.co.uk
I expect the average person would assume that for the domain 1, .name is the TLD, cumberbatch.name is registered by a private entity, and benedict (and any other subdomains associated with cumberbatch.name) is a subdomain fully controlled by that private entity.
Whereas for domain 2, I think the average person will view ".co.uk" the same way they view ".com", even though technically it is both a ccTLD and a second-level domain.
> What exactly is non-standard about an ICANN-approved TLD?
Uh, 99% of people would assume a .name address is a scam. Hate to break it to you.
.name is in no way a "nonstandard TLD." It has been in existence for a quarter of a century and was part of the first batch of new gTLDs approved after the dot-com boom had begun, in 2000.
For the first couple of years of .name's existence, it only allowed registration of third-level domains, and the ability to register second-level domains was added later (and only if no third-level domains existed for that second-level domain).
The author is in no way at fault here, and I don't think I would have assumed there was a heightened level of risk if I were him.