This brings a disturbing thought to mind… if an instance domain name like foo.bar lapses and someone else snaps the domain up (or of it gets stolen) can the new controller plop Lemmy on a server and be instantly federated? If so what kind of damage could they do?
That’s an assumption that lemmy will quit federating with a server that does not match.
And what signature are we talking about anyway? Is not certificates…
This is why you don’t let your domain registration lapse. It’s not the only way computers on the internet verify each other’s identity, but a hell of a lot of internet security features are based around domain names, so keeping yours functioning is a very big deal.
Domain registration ≠ internet security. Root of trust is in cryptographic keys, not domains. DNS is not the security cornerstone you make it out to be. PKI says hi!
Yes, but it is very quick and cheap to get a domain validated cert from a CA that is generally trusted by most web browsers, so once the bad actor has the domain, the should be able to trick most users, only maybe certificate pinning might help, but that is not widely used.
Consider how many system relies on being able to send you an email for verifying your login and performing password reset. Those who have control over your email address domain can trigger password reset for most of online services out there. Imagine if Google forgot to renew gmail.com and it falls to a wrong hands.
Email is tied to domains. TLS is tied to domains. CORS is tied to domains. OAuth is tied to domains. Those are just four things I can think of while half asleep. Here’s one recent example of how screwing up a domain name is enough by itself to cause a security breach.
Cryptography is not security any more than domain names are; both are facets of how security is implemented but there’s no one system that makes the Internet secure.
ICANN has an Expired Registration Recovery Policy (ERRP) that requires your registrar to give your domain a 30-day grace period before deleting the records. ERRP also requires them to shutdown your DNS resolutions 8 days before deletion.
You’d have to be really mismanaging your domain if you miss all the required email reminders and don’t notice your domain has been non functional for a couple of days.
Out of curiosity, other than fmhy.ml, lemmy.ml, and lemmygrad.ml, what other Lemmy instances were using .ml domains? Also, how are the latter two still running but fmhy.ml isn’t?
edit: This has triggered a chain of comments I wasn’t expecting. I’d appreciate it if someone can answer on a technical level. Is the latter two using a different registrar or name server which is why it still works for them?
You can see all but posts and comments won’t be on their server until back online that are a few it went down. So I can visit my communities like https://lemmy.fmhy.ml/c/artwork that I mod. I can see it but nothing will happen until it comes back online. That’s what understand at least.
AFAIK, lemmy.ml and lemmygrad.ml use it because the ml can also stand for “Marxist-Leninist”, and the two primary maintainers of Lemmy are Marxist-Leninists . Not sure about the others though.
I’m going to have to make a copy paste for this:
.ml stands for Mali.
.ee stands for Estonia.
.tv stands for Tuvalu
Just like .ca stands for Canada.
It can also definitely stand for Machine Learning which is the first thing that comes to my mind
That’s not true at all. ML was used as an idiological choice as it’s the only free TLD you can get and you should not have to pay for a domain name as per Lemmy’s creators ideology.
I think it’s because ML is a popular shorthand for ‘Marxist-Leninist’ since they mostly seem to be communist servers
.ml stands for Mali.
.ee stands for Estonia.
.tv stands for Tuvalu
Just like .ca stands for Canada.
I know a ton about DNS and its technical functionality, not necessarily the regulations guiding registrars, but the technician in me says your TTL (how long other servers wait until asking where xyz.ml points to) hasn’t expired, maybe? Perhaps the government administration process simply hasn’t executed any action against those particular registrars yet?
I never liked TLDs that are from random islands or less than stable countries and there are so many great TLDs available now, I simply don’t see the reason to use such obscure TLDs just for the marketing factor.
Yeah, not a good situation.
The main story I found seems to indicate that many government communications have been misdirected due to the typo of .ml instead of the intended .mil - reserved for the US military. 🤦♂️ There has been an entrepreneur that holds the contract to manage Mali’s country domain and that’s expiring Monday (24th?). I’m assuming the government is not renewing the contract and will instead be taking over the domains and any related data. He has been collecting some of that data and warning the US government about the issue to no avail…for 10 years.
Control of the .ML domain will revert on Monday from Zuurbier to Mali’s government, which is closely allied with Russia. When Zuurbier’s 10-year management contract expires, Malian authorities will be able to gather the misdirected emails. The Malian government did not respond to requests for comment.
Their contents include X-rays and medical data, identity document information, crew lists for ships, staff lists at bases, maps of installations, photos of bases, naval inspection reports, contracts, criminal complaints against personnel, internal investigations into bullying, official travel itineraries, bookings, and tax and financial records.
ICANN is the body responsible for the gTLD initiative, which gives you names like .social and .world. They are an American non-profit with a multinational committee, handling nearly all of the databases that store our Internet address records, etc., you can be relatively assured that your domain won’t be messed with.
The instances really have no option here than to test out moving their systems to an alternative domain and “bench test” their migration to discover a path that works or a least come to the conclusion to start all over.
I never liked TLDs that are from random islands
I remember reading somewhere that Tuvalu gets like 10% of their entire yearly income from Twitch.
I now pronounce Twitch as Twitch dot Tuvalu, but I get weird "huh?"s when I say it like that.
Why is Meta suing Freenom?
Freenom gives away domains, many of which are used by phishers and other bad actors. Meta is suing them for not being responsive to their complaints about this. And I guess the injury inflicted on their users by phishers.
Wait, is it actually Feeenom’s fault? Isn’t it from whatever the server the malicious actions comes from?
For example I use one of their domains along with a Digital Ocean droplet, and I used it briefly to increase my seeding ratio by portforwarding my Qbittorrent port, after several months I got a letter from DO (which is amusing because my country couldn’t care less about torrenting lol) which I think is correct, I don’t think this is Feeenom’s fault.
I’m assuming they’ve run afoul of something similar to the DMCA safe harbor provisions. Basically under the DMCA a hosting provider isn’t responsible for violations due to user submitted content as long as they’re responsive to notifications and remove the content quickly when notified.
Now that applies to copyright not domain names, but I’m assuming there’s some kind of similar law at play. Meta has said that Freenom has been ignoring complaints about domains registered with them that are being used for phishing attacks. It could also be a DMCA issue because I think it does have some anti-domainsquating provisions in it that prevent you from E.G. registering say cocacola.ml as you aren’t the holder of that trademark.
In theory depending on where Freenom is run out of they might be able to just ignore the lawsuit, but it’s probable that doing so will get them blocked by various ISPs and organizations.
Registrars not only have rights, but also responsibilities. They physically own the domain names and bear responsibility to ensure their domain names follow international rules.
Is this because of the DoD typo leaks? Lol
changeover provoked the leak.
that is nonsense. the leak was there before the change, but after the change consequences of the leak could be more dangerous.
oh, you mean leak as in public knowledge of the problem and i am talking about the leak caused be emails ending up in wrong hands.
