What the heck?

Is the point just to try to get as much money as possible or what?

A fee of $185'000 is NOTHING. There are thousands of companies that can easily shell out the money. If this goes through, you can expect a land grab of epic proportions, bringing domain squatting to a new level. What is the point?

ICAAN- Daft as a brush

Daft Idea.

There is no need or much demand for this any way. And I mean the only organisation that i have ever notice use ".eu " is the european union itself.

You get whatever Xmas you deserve

That is what you get when you put registrars in charge of DNS infrastructure. First internationalised domain names, now this.

The more domains companies like Coca Cola have to register to protect their brands and trademarks the merrier. For them.

And security be damned. In fact it was damned long ago:

Is this: НSВС ???

F*** No, it is Cyrillic N, S, Cyrillic V, Cyrillic S.

Did anyone care? No. This is from the same songbook. Will anyone besides security geeks care? No. It will be railroaded through as it means more money for the domain names scam.

Ian?

How many people or companies have something named Ian (Apart from Ian)?

Am I missing something that I probably should have Googled before looking stupid?

Russian Roulette

Humm. Those three sites work just fine for me with Konqueror on Debian. I'm not sure whether to be scared or pleased...

So whose DNS is it anyway ?

If ICANN were able to dictate the design of DNS resolvers, presumably they could impose resolution of single label DNS queries such as http://nike/ or sales@nike into MX, A or AAAA records. But that isn't how it works. Designers of DNS software, and operating system library designers are very likely to choose to be less obliging for the security reasons described in the otherwise fine article. Tough luck on any marketing droid who reckons a $185K application fee will get them single label names if the software is changed to block resolution of these.

So how long would it take me to edit and recompile gethostbyname() to something which blocks external resolution of single label names if I don't want to let rich single label name marketing wet dreams to compromise my LAN ?

Another approach might be to have the root zone compiled by a more responsible party than ICANN. This zone is a very small file which doesn't change very often, and it doesn't take much effort to write a shell script making use of dig to enumerate the current version. All that would take would be for the relatively few engineers who develop and distribute DNS client and resolver software to agree on a better root zone provider.

I see someone's called the WHAmbulance...

It's the same group of people that's been crowing about the imminent death of IPv4 for the past... 10 (10? 15? something like that) years.

Give it six months and something will get worked out.

Bonjour!

I've seen localhost and localdomain on practically every Linux box I've had but If only I could think of where it was I saw .local being used as a domain. Was it myPhone or Mac's Book? Bah, it'll come to me sooner or later, probably along with a thunk to the side of the head.

Seriously, given this is set up as the playground for the wealthy it would behoove the likes of Apple, Microsoft, Red Hat (or a Linux consortium) and others to do something sensible like be first on the list for the domains they use as defaults. That way at least folks will know who is reading their mail... and zeroconfing a peak at all the questionably legal material going about your home network.

Who cares?

The security risk comes a long way down the list of why this is a buck stupid idea entirely designed to make stacks of cash for ICANN.

Why exactly are these morons being given the Internet as their personal cash-cow anyway?

XP is passé

"Using a Windows XP SP3 computer, The Register was unable to reach any of the three sites above."

I am proud to report that my super modern OS, Windows 7 SP1 x64 is very happily resolving http://ac/

The older the OS is, the more secure it seems. Any one tried Windows 3.11 yet?

so this is over ..

whether it's "single label" or ".TLD" ?

IOW, using the example, whether it's "@nike" vs "@.nike" or "http://nike" vs "http://www.nike" or having to have some subdomain in the address like all other TLDs ?

really ? .. just don't allow single label to resolve .. all other TLDs require "." , I could care less that it might be required to be @sales.nike or www.nike or shoes.nike to resolve

also .. there are critical .com file extensions in Windows .. how come there isn't a big security problem with that ( other than fools that open an email attachment with .com thinking it's a websile link ;-0)

The price of vanity?

This expansion of TLDs is a reallly terrible idea.

It seems like a cash cow for milking the same kind of idiots that get off on personalized number plates who somehow think it is cool to advertise their shallowness...

Single word domains will be difficult to recognize as part of netspace without protocol designations.

As for validation, it is already difficult enough to fully validate email addresses, which rely on having at least 1 dot embedded in the domain part, as well as a regexp to make seasoned unix programmers cry.

http://company.com or co.uk, eu, etc do the job perfectly well, are recognizeable and give some clue as to a domains category. For instance, *.info, *.biz, *.tv are just most likely spam sites that can be safely ignored.

Leaking single word domains onto the net is a bad idea - at least a dot gives some kind of defence.

TLDs

Leave the top domains alone.

If someone can't be bothered to add 4 to 6 letters to address, he certainly won't be bothered to check if security is right.

Security devie

For corporate network, just like you explicitly allow outbound connection to IP's and ports, I would implement a DNS security proxy that will block DNS requests to TLD's that are questionable.

For personal/home users, I'm sure security products will provide some functionality to block DNS that would otherwise be assumed local which in fact direct users outside the current network scope.

Maybe ICANN won't sell these types of sensitive TLD's or most likely any hacker won't have the $100,000 dollars to buy these TLD's, and those that do and subsequently expose users then ICANN or governments will have the power to get that domain blocked.

This isn't half as stupid as the peer to peer DNS idea that was proposed some time ago

Says it all.

“It's a bunch of FUD,” he said, referring to the scenarios painted by Ray and other critics. “Yes, if domains like wpad or localhost or localdomain were assigned, bad things might happen. Those domains aren't going to get assigned. It's not like there aren't layers of approval that have to go in place to get a top level domain.”

Says it all.

Thanks for all the anti-recommendations

I happen to think that the new TLDs are a dreadful idea, but anyone who had bothered to read the relevant parts of the ICANN draft applicant's guidebook would know that there is no possibility whatsoever of TLDs like the ones discussed in this article being assigned. On page 2-8 it explicitly lists LOCAL and LOCALHOST in a table of reserved names, and on pages 2-9 and 2-10 it describes the DNS Stability Review that is exactly about funky names like these.

So thanks for providing this handy list of people who spout nonsense about DNS "security" without doing even a little bit of reading to see if they know what they're talking about.

Flaw

It's a real dumbass idea (in my opinion) to offer up all these TLDs, and expecting known names to pony up good cash to "protect" their name is tantamount to extortion.

However... Surely if you owned the domain .1 and had people pointed to 127.0.0.1, any decent DNS client would interpret that as a numeric IP and not even bother trying to look it up?