[xelamonster]

The implication that gTLDs are bad and new ones shouldn't be introduced because of this is a bit silly to me. The argument that they somehow have lower registration requirements makes no sense, .shop .top and .xyz registrations involve the exact same amount of verification as .com (none). Prices aren't really that different and plenty of gTLDs are more expensive than traditional ones.

Registering a domain is frustrating these days, too many already taken and a lot of them by squatters not even intending to use it. I'd love to see more options personally even if it makes it slightly easier to create a phishing domain. We need better tools than memorizing a domain name to deal with that anyways.

[NotSammyHagar]

I think the issue is you can register a known company name on one of these and plenty of people will think it's legit. Companies have to register on all these random domain to protect themselves.

dell.shop, that's probably the dell computer I know, right?

[zanderwohl]

The people who would fall for that would probably also fall for `dell.computerdealshop.com` though

[furyofantares]

When a scam hits someone's inbox or text message, it finds them in a particular time in their life, in a particular state of mind, and in a particular context. It's not just about how gullible or uninformed or whatever they are. They may be tired, they may be drunk, they may be spending all their energy worrying about a sick relative, or trying not to.

They may have just been shopping for a computer, maybe even a dell. Or maybe they need a computer for their kid and don't have the means to afford one and are more likely to fall for a scam advertising a good deal on a computer than for any other scam.

These all add to the probability that someone falls for a scam. Phishing is all about casting a wide enough net that the probabilities align against some of the people you hit at the time you hit them.

Victims are not just uninformed. They are also compromised, and/or incentivized to believe this particular scam, and/or unlucky enough that the scam takes place when they were recently engaged in activity that makes the scam more believable.

Seeing dell.computerdealshop.com will snap a lot of people out of it where seeing dell.shop would not have.

[blululu]

Whether people are more easily fooled by dell.shop dell.computershop.com is a non sequitur from the rather wordy disquisition about why people fall for the scams in general. The eye sees dell first in clear letters for both urls. Their sick relative doesn’t change much here. I would honestly not be sure if either is a scam for the url alone. The improbable deal at the other end is the only meaningful signal.

[furyofantares]

> Whether people are more easily fooled by dell.shop dell.computershop.com is a non sequitur from the rather wordy disquisition about why people fall for the scams in general.

It isn't. People fall because probabilities align. Something can catch their eye to knock them out of it.

A bad URL is a bad probability (for the scammer) in the chain, a really good URL is another good probability. If your assessment is that both URLs look equally good/bad to you, I, of course, won't deny that claim about your own experience. But to my eye, dell.computershop.com looks pretty bad and dell.shop looks pretty good.

I only answer my phone if I'm in the middle of getting a loan and so expecting a call from some unknown number at any time, and even then some numbers look too phishy to answer. The last time I got a loan I got a call from a local area code near the bank, answered, and found myself talking to a scammer about a loan. It was confusing, I believed it was the bank at first! Everything needed to align for them to get that far, including the phone number looking legit to my eyes. To someone else's eyes a number halfway across the country may have looked just as legit. Or the nearby number may have looked instantly bogus. This is exactly my point!

[SoftTalker]

Just the fact that you had your credit report pulled for a loan qualification is immediately sold to ad brokers by the credit bureaus, who will sell it on down the line to less and less scrupulous buyers. It's not surprising to me at all that you got a scam call about a loan while you were in the process of legitmately applying for a loan.

I now ask businesses like these "what number will you call me from" and I put that in my phone as a contact, so that my phone will ring. If they call me from any other number I won't see the call.

[echelon]

Most people don't understand URLs.

Remember that Google was (is?) trying to remove the URL bar. Not just because it reinforces search as the main product and gateway to the web, but also because URLs are kind of hard for most people.

Which brings us to the original argument: is this a reason to ban gTLDs? Surely the cost of banning gTLDs outweighs the enormous benefits of making it easy for society's productive users to find names they like.

We also shouldn't discount the incredible benefit of having additional namespaces and markets positioned against domain name squatters. gTLDs linearly increase the costs to squatters. Good names can be found with lots of alternative gTLD offerings, which greatly increases the supply side for builders and entrepreneurs.

Ultimately gTLDs probably won't be banned simply because there's money to be made by the ICANN and registrars.

[bryanrasmussen]

dell.shop is more believable than dell.computershop.com because shorter urls seem more believable and valuable.

If you don't agree I have a computershopthatisreallycoolandcheap.com to sell you.

[viraptor]

> Seeing dell.computerdealshop.com will snap a lot of people out of it where seeing dell.shop would not have.

I see this and raise you HP using domains like h30434.www3.hp.com for decades now. They only started to disappear fairly recently. Many companies will do it and people don't really care.

[brabel]

> Seeing dell.computerdealshop.com will snap a lot of people out of it where seeing dell.shop would not have.

Would love to see citations for that.

[tpoacher]

Here's one [0]!

[0] : https://news.ycombinator.com/item?id=42307876

[viraptor]

It's just a claim. There's no support for that actually happening. And no real source.

[slavik81]

It would be nice if browsers surfaced the information about when you last visited a site. In the certificate information panel for Firefox you can find things like, "You visited this site 1067 times before" which is helpful information when evaluating if you're on the site you think you're on.

[0xCMP]

They're different. Companies register all kinds of crazy domains and redirect you through them all the time. Why is it crazy that some marketing person at Dell thought it would be cool to link people to 'dell dot shop'? I would check the certificates, but honestly only as a precaution. If the website looks correct that isn't such an insane thing.

That is exactly why it's so dangerous and effective versus your example.

[thayne]

> I would check the certificates

What good does that do? It is pretty rare for companies to get an EV or OV certificate, since it is more expensive and more hassle than a DV cert, and even when they do, the name on the cert isn't always what you expect since it might be the name of the owning company, not the brand you are familiar with.

Whois on DNS isn't always reliable either, since it often just points to another company that provides a dns service (such as AWS).

[jeroenhd]

> Companies register all kinds of crazy domains and redirect you through them all the time

That's the real problem with domain trust these days. Companies go out of their way to make sure you know to only visit official links, and then do stupid stuff like buying vanity domains for one-time deals, or make you click through mailchimp tracking URLs because marketing tracking is more important than your customers falling for phishing. Those vanity domains then end up expiring, and now emails and web links that used to go to an official $brand server are all ready to be swooped up by scammers. Customers never stood a chance.

This isn't a TLD problem. It's a shitty company problem.

[marxisttemp]

I wholeheartedly agree. Subdomains exist for a reason. Vanity domains are so incredibly sloppy and unserious.

Another issue is that they can make password management more of a chore. Every time I need to look up my Microsoft login, I have to remember to actually look up “live.com”. Except sometimes the login page is served from “microsoft.com”. Oops, you forgot your password and reset it; now your password for the other domain is out of date. Utterly ridiculous behavior from a company of their stature.

[xelamonster]

This made me think I'd somehow not saved my MS password because it wouldn't show up if you searched "microsoft". I know you can combine them like the other comment mentioned but what an awful default experience.

[nemomarx]

bitwarden can list multiple domains in one entry for a password - it might be good to find out if you're manager can do that and merge some?

[zokier]

There is no domain trust problem, because there is no trust to be had on domains.

[immibis]

do you trust that you are on Hacker News right now?

[Symbiote]

A little searching shows Dell have dell.to, used as a link shortener, even though Dell has little business in Tonga.

[BlueTemplar]

Maybe companies should stop doing that then ? Also, homonyms aren't uncommon for smaller companies, especially across the world.

EDIT : and ninjaed...

[kataklasm]

Have you seen the domains Microsoft uses? Half the time I am not sure if they are genuine or not, it's actually crazy. Sometimes they use .com, other times .ms. Sometimes Microsoft is in the top-level other times it's in the second-level. Sometimes they have no subdomain, sometimes they have two. It's utterly inconsistent and it's insane to me how close some of them look to actual phishing domains...

[joegibbs]

If you get credits for Azure they're accessed through microsoftazuresponsorships.com. Why not sponsorships.azure.microsoft.com or something like that? I checked it three times when I got the link, because it's exactly the kind of domain someone would use if they were going to steal your Azure credits.

[kataklasm]

That's hilarious..

[prmoustache]

It is not actually important as you know you cannot trust microsoft more than the usual scammer anyway.

[mikestew]

Maybe, maybe not. [citation needed] But store.apple.com is perfectly legit, so what’s wrong with apple.shop[0]? Sure, you and I know that one is a subdomain and one is a TLD. How many random folks on the street in Des Moines know this? 15%? Less? “Say what? It matters which end the ‘shop’ part is on? Whose brilliant idea was that?”

[0] sigh Apparently nothing is wrong with it, as it redirects to apple.com. So much for that example; take in the spirit intended.

[9cb14c1ec0]

There aren't "people who fall for phishing" and "people who don't", generally speaking. I know highly intelligent and talented people, well educated in general online security, who have fallen for phishing links and scams.

[foxglacier]

It's certainly possible to strongly protect yourself though, vs casually relying on intuition which is hopeless. You just need to establish a process or set of rules to follow. Businesses do this all the time. A classic scam is sending an invoice asking for payment, and some disorganized businesses will just pay you! But those with a process won't because you won't be able to give them a matching purchase order number and other things their process needs.

A basic personal protection is to not trust anyone who initiates contact with you, no matter who they say they are or what they know about you. Verify by contacting them independently instead.

[callalex]

Very true. My dad (late 60s) has written a DNS server, but still nearly fell for an email scam when he was sleep deprived and at the airport believing his flight was overbooked and he was going to be kicked.

[hatthew]

I am unlikely to fall for either of them, but given compromising factors as mentioned by the other commenter, I am much less likely to fall for dell..com than dell.

Due to the widespread usage of 3+ common TLDs (com, org, net, etc.) and arbitrary third-level domains, people have been trained that the second-level domain is the one that matters. Now that gTLDs are more common I've needed to retrain my brain that the TLD is also a necessary heuristic for authenticating websites.

[endgame]

Even aside from that, you probably want to register your own .sucks and .rocks, which just means whoever operates that registry gets to make a bunch of money from companies squatting domains that nobody wanted and bring no value to the world.

[inopinatus]

That’s kinda the point. Scammers want to deal with the poorly informed, the gullible, the vulnerable. They concomitantly prefer that the wary and street-smart select themselves away. A marketing professional would recognise the effective segmentation going on, and every new TLD is an opportunity in that regard.

[clan]

I do not think so. I think if someone would have made an effort to rip off the real Dell site I would fall for it. I am just so lucky that scammer mostly prefer to go after the easier marks.

I am not sure what a better solution could be. The idea of EV certificates was good but executed poorly. Maybe a way to link certificated to business IDs.

I do however still prefer more gTLDs to minimize domain squatting.

[AnthonyMouse]

> The idea of EV certificates was good but executed poorly. Maybe a way to link certificated to business IDs.

The idea was bad.

Anybody can open the Dell Flower Shop. They can call their company Dell Inc. and register the domain dell.shop and they're not doing anything wrong, because they're in a different industry and nobody is going to confuse a tulip with a laptop. And then they could get an EV cert that says Dell Inc. -- because that's who they are.

Which is why EV certs are worthless. Just because it says Dell doesn't mean it's that Dell. There can be arbitrarily many companies with the same name in different industries or locations. But then what is the certificate supposed to tell you that gives you more information than the domain name? The average person is not going to know a company's registration ID with the relevant secretary of state, or generally even what state they're incorporated in.

[dietr1ch]

People would fall for `dell.scam` too, it's a number's game.

[Tempest1981]

Also depends on how their browser shortens the display of the URL

[yearolinuxdsktp]

Answers like this, that basically call the users idiots and abdicate any responsibility on the part of tech, are a losing long-term business proposition. Figure it out and gain loyalty and market share.

[throitallaway]

I'm doubtful that most non-technical people familiarize themselves with TLDs/domain names. They use a search provider for whatever they need. As far as emails/phishing goes, it's a game of cat and mouse; it will never be over. Basically, don't trust unprompted email links and just go to the site if it's something you really want.

[yorer]

The always-search-instead-of-bookmark practice is then introduced this situation https://www.bleepingcomputer.com/news/security/sneaky-amazon...

Its really an unsolvable cat and mouse game without proper familiarising oneself with the dos and don'ts of the internet.

[drew-y]

I wonder if we could add some type of verification registry. It would be nice if browser's could have a big indicator saying that this website is verified to associated with Dell inc.

[marionauta]

Some HTTP certificates do exactly that, and web browsers used to show the company/identity the certificate was issued to in the URL bar. Now you have to go to the certificates detail, very clear on Firefox, behind a few clicks on Chrome. Here's an example from a bank in Spain: https://www.bbva.es

[varenc]

HTTPS certificates should do exactly this.

[drew-y]

They should. And sort of already do. Though, I wonder how difficult it is to register with some certificate issuers under a fraudulent name.

[chrismorgan]

That was EV certificates. They were finally removed from browsers completely around five years ago because they didn’t actually work. At all. The problems were largely social. Plenty has been written about it, you can find it by searching.

[Joker_vD]

Well, the original HTTPS certificates too were supposed to work like that; I remember reading a security article criticizing the EV proposal by quoting the old (circa 1998?) policy statements of different CA's and showing that they're pretty much identical to the EV requirements.

[hamandcheese]

> Companies have to register on all these random domain to protect themselves.

"Nice business you got there. Shame if a scammer bought your name on my new TLD."

[xelamonster]

Yep that's the issue, I'm just saying I'd rather have that problem than the one where I can't register a clean looking personal domain because every idea I have is already registered (with 95% of them leading to a parking page untouched for years except to pay the bill). Feels like we just need more names available and I don't see how else we could get them.

[friendzis]

Is dell.com, dell.co.uk and dell.ee owned and backed by the same corporation?

[reaperducer]

The implication that gTLDs are bad and new ones shouldn't be introduced because of this is a bit silly to me.

That wasn't what the article stated. The article stated that the problem is that the new TLDs are so cheap as to be disposable, and the registration requirements are lax. The combination makes them attractive to criminals.

It's literally the first sentence of the article:

"Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) — such as .shop, .top, .xyz — that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds."

[michaelt]

The problem is the new gTLDs don't increase the useful supply of domains.

For casual usage like personal blogs and whatnot? Sure, use whatever.

But if I was starting a web-based business and couldn't afford the .com? I'd rename the company before I'd use .xyz - if your business takes off the squatters will notice and raise their prices, so the .com will never be cheaper.

If you got an "urgent e-mail" saying your employer needed you to confirm you're legally allowed to work, and they directed you to experianrtw.app - would you go there and send them a photo of your passport?

[mrsilencedogood]

There are a few options, though. The fact that .io got so popular shows that we are not forever chained to .com. It's just that a lot of the nuTLD options are honestly hilariously bad, most of them are just lame. My personal top picks are ".online" and ".software" with mention to ".network" but they're all WAY too long. I actually use ".cafe" for my personal stuff because it's short and cute. Obviously can't use that for your SV rocketship company though.

Would it have been so hard to sit down and pick a couple short ones - yknow, ones people might actually use?

[politician]

Unfortunately, .io is now also unsafe with the upcoming transfer away from the UK; another cautionary tale for those considering not getting a .com.

I’ve been seeding government and business forms with a .io email address for years (to counter gmail dominance), and I’m quite concerned about the situation now.

[mrsilencedogood]

That's because it's a ccTLD, not because it's not dot-com though. The powers that be could very well decide to just promote it to be a gTLD if they wanted to not destroy stuff for no reason. Actual gTLDs aren't susceptible to the same kinds of issues.

[teddyh]

> The powers that be could very well decide to just promote it to be a gTLD

No, they can’t do that. Every two-letter TLD is defined to be a ccTLD, and nothing else.

[mrsilencedogood]

If they did that anyway, who would stop them? This seems like a great time to make an exception.

[Sander_Marechal]

Yes they can. They did it before after the Soviet Union broke up and they kept the .su TLD. It's still active. I'd argue that keeping around .io is more important than keeping .su around, seeing how many people and businesses use .io domains.

[ArchOversight]

I use .network for my internal network with a proper FQDN. This allows me to get certs for internal services that validate in all browsers.

[yawaramin]

If I got an 'urgent email' I wouldn't go to any domain, I would contact my employer directly and confirm with them before doing anything. The people who would fall for this phishing scam would fall for almost any domain, because it's not about the domain.

[panarky]

Millions of people don't have an employer with an HR department they can call on the phone to confirm that an email is legitimate.

What if your primary source of income is Uber or Doordash or Etsy or Youtube?

[yawaramin]

All of these have support contacts for drivers/dashers/etc. Eg https://help.doordash.com/dashers/s/dasher-support?language=...

[poincaredisk]

What it you get an email from [yourbank].bank? Or if your mother got one?

It's never a single signal, and the more legitimate a domain looks, the bigger a chance is that someone fells victim to a scam.

[dc396]

Bad example. The requirements to register in .bank are quite rigorous (see https://register.bank/eligibility/). Phishers typically go for TLDs that impose far fewer requirements on their registrars.

[ToucanLoucan]

The lions share of issues with domains would go away if we made squatting illegal, or at the least, extremely expensive.

Tbh I'm increasingly thinking that just about any speculative instrument in the economy is just grift and drag. If you want to make money, make things. Stop trying to extract rent or exorbitant prices for land, for domains, for PS5s, etc. Feels like 9/10ths of the economy now is nothing but fucking middlemen, when we have a dearth of need of ANY middlemen at all anymore.

[gruez]

>The lions share of issues with domains would go away if we made squatting illegal, or at the least, extremely expensive.

How do you define squatting? Is the owner of nissan.com "squatting" on it because he wouldn't sell to the japanese car company? How much interest do you need in a given domain before it's not squatting?

[ToucanLoucan]

I would argue if you aren't doing some combination of:

- Hosting a website

- Operating email accounts

- Infrastructure (mail, DNS, etc.)

- Misc. Services (Minecraft server, TeamSpeak server, something)

Then you're squatting. Like if you own turkeyonapig.com and it's literally just a web page with a picture of a turkey sitting on a pig? Not squatting. It's odd but it's clearly doing exactly what it's meant to be doing. If you own turkeyonapig.com and are doing nothing but advertising that fact, and that someone can buy it? Squatting.

> Is the owner of nissan.com "squatting" on it because he wouldn't sell to the japanese car company?

I mean, it depends. One would argue that people going to nissan.com are clearly looking for the Japanese car company, so it's in the public's interest that that domain be sold to them. On the other hand, if someone owns it and is using to run a Nissan fan website? Well I suppose that's trickier, but that would also probably be better suited to something like nissanfans.com.

It's a tricky thing but not impossible to figure out.

[gruez]

>I would argue if you aren't doing some combination of: [...]

cloudflare offers free website hosting and email forwarding, so it's basically free for a squatter to check those boxes.

>I mean, it depends. One would argue that people going to nissan.com are clearly looking for the Japanese car company, so it's in the public's interest that that domain be sold to them.

So you basically want the Kelo v. City of New London decision to be applied to domains as well? You own "erictrump.com" but aren't the president-elect's son? Well tough luck because it's "in the public's interest" that president-elect's son gets it rather than you.

[ToucanLoucan]

> cloudflare offers free website hosting and email forwarding, so it's basically free for a squatter to check those boxes.

Sure. But it still takes time, or as someone else suggested, a GPT query. Putting literally even the tiniest amount of work in front of squatting will reduce the amount of squatting.

> So you basically want the Kelo v. City of New London decision to be applied to domains as well? You own "erictrump.com" but aren't the president-elect's son? Well tough luck because it's "in the public's interest" that president-elect's son gets it rather than you.

I mean, it is. And putting the phrase in scare quotes isn't a counterpoint.

One could argue in fact that one of the multitude of reasons for the rise of platforms is that it's so hard to find anything on the actual internet, and part of that in turn can be blamed squarely on squatting.

[SoftTalker]

You can boil it down to: are you offering it for sale? If yes, squatting. If not, early bird gets the worm. You should be able to own a domain name and not be required to do anything with it beyond paying the registrar to legitimize your ownership.

[jocoda]

> It's a tricky thing but not impossible to figure out.

Good to hear. So after that you'll be sorting out world peace - right?

[beeflet]

I really don't think eliminating domain squatters is some impossible task. you could probably just tax sales of domain names to death (90% sales tax on any resold domain names) to disincentivize it vs registration upkeep costs.

Squatters are a massive blight on the internet.

[jocoda]

The problem goes way beyond domain squatting. You have a limited resource, say nissan.com, and you have several valid claimants. Who gets to decide what's fair? First past the post? Heaviest pocket book? Biggest stick? Popular acclaim? ...

Is not unique to domains, this is why the world is uts.

[foxglacier]

Make the transaction in a country that doesn't have such a tax?

[echoangle]

And you think a domain squatter would be deterred by high pricing and not just point every single domain to a VPS with a „Hey guys buy my domains“ page? Or even just point them to any random IP, since DNS is one of the legitimate uses you named?

[ToucanLoucan]

I mean that's basically what most do now. I'm saying the domain should direct to an actual website, irrespective of how useful or large it is.

See my example of turkeyonapig.com.

[dist-epoch]

> a web page with a picture of a turkey sitting on a pig? Not squatting

GPT/Cursor will create that page for you in 5 min. I bet a NotSquattingAsAService startups will appear which will create the "not squatting" fake site for you for $2.

[ToucanLoucan]

I mean, that's an improvement in my mind over millions of insipid "BUY THIS DOMAIN!" web pages. At the least the internet would be more interesting?

But also like, then you aren't advertising it for sale. So I'm wondering how many offers you're going to get to sell that domain, which is the point of squatting it.

[dist-epoch]

That's not how most squatting pages are sold. They are registered for sale in places like NameCheap and you can see it directly when you search for domains.

[reaperducer]

NotSquattingAsAService startups will appear which will create the "not squatting" fake site for you for $2.

That's an improvement. Adding $2 to $5 to the cost of a squatted domain will start to dissuade people who squat on tens of thousands of domains, if they have to suddenly have to pay $20,000 to $50,000 for the not squatting service.

[gruez]

>That's an improvement. Adding $2 to $5 to the cost of a squatted domain will start to dissuade people who squat on tens of thousands of domains

There's no way static site hosting and a email service costs $2-$5 per year per domain, especially for bulk users. Even if we take that price at face value, a .com domain already costs around $10/year. A 20%-50% increase will only change behavior at the margins. It won't make chat.com magically become available, and at best will make some D tier domains available. Ironically the introduction of gTLDs probably had the same effect. Squatting harrisonburgrealty.com is suddenly going to be less profitable when there's harrisonburg.{realty,realestate,realtor,homes,house,place,properties,rent,apartments} available as well.

[spookie]

Nissan is the guy's name. Come on.

It doesn't matter if you're just a dude or a corporation, you play by the same rules. There isn't anything to solve here. These problems are solved between those those 2 parties and no one else.

Good Lord. It's in the public's interest it remains this way.

Another person here had it right, companies have been playing with fire with their URL shenanigans. From one time TLDs to abusing tracking parameters. Not to mention browsers in their insane quest to strip useful information out off their UIs, making you CLICK to see who owns the place. Clown world really.

[jltsiren]

It's not a particularly hard problem. Most countries have rules on what you can use as a business name or register as a trademark. Domain names are just more of the same.

And you don't really own your domain. You are just renting it from whichever authority is responsible for the TLD. If you stop paying, the authority will eventually take it back.

[zokier]

Trademarks are specific to the field it is used on. Classic example is Apple Records vs Apple Computers, which one should get apple.com?

[jltsiren]

And there are also businesses with identical names. But the basic idea was already established long before the internet. If you have a legitimate claim to a name, you have a legitimate claim to that name. There may be multiple entities with a legitimate claim to a particular name, in which case the first one that used it in a particular context gets to use it in that context. And if you think that someone is using a name you have claimed in a misleading way or acting in bad faith, you can sue them and let the courts decide.

[zokier]

The problem is that as you note, trademarks and company names are not unique, but domain names are required to be unique. So that n to 1 relationship between trademarks/names and domain names intrisically creates problem, how to allocate the domains when there are many equally legitimate pre-existing claimants. This is not solved problem the way you portray it, because domain names have this novel uniqueness requirement.

Of course this raises valid question if using names in this way at all is a good idea. For example telephone system and lots of banking stuff is based on simple numerical identifiers, and lots of countries have also some unique (numerical) identifiers for companies and persons. So there is fairly strong precedent for using assigned ids instead of names when uniqueness/specificity is required. But somehow we have jumped to the conclusion that for example IP addresses would be too confusing to average joe, and in attempt to hide them we have created even more confusing system.

[foxglacier]

If you're starting a new company, squatters are not a real problem. Just pick another name. If your favorite name is so valuable that it's squatted, then it's valuable! The squatter was reserving it for you, the only company that could really make good use of it, instead of some random personal blogger who happened to walk in first and would wasted its high value.

Also, what's the difference between a squatter and a personal blogger?

[humanfromearth9]

What looks like squatters might also be people who just want their own domain only for email, not hosting.

[allset_]

Or are hosting non-public services and want TLS certs that all my devices trust automatically, like me.

[mrweasel]

That's certainly an issue. There have been a number of cases where companies have demanded that people hand over domain that they "where not using". Not using being defined as "does not have a website".

It feels like there should be some way of determining if a domain is actively being used, to combat squatters, but when ever someone tried to make a rule it ends up being something stupid, like not having a website.

[seabass-labrax]

Email is one of the easier services to detect; not only does SMTP specify that the server sends a greeting before authentication occurs, but there's also a bunch of DNS records just sitting there in full view. I'd say it's easier to detect real usage with email than with HTTP, because, to my knowledge, nobody runs an MTA just to say 'this domain is for sale' like they do on the Web!

[aidenn0]

Including me.

[foxglacier]

gTLDs don't really solve the problem of running out of domain names any more than doing it yourself like myname-shop.com There are too many gTLDs for anyone to remember so they're really just an arbitrary extension on the 2nd/3rd level name.