Hacker News Reader

Comment by mrandish | Hacker News Reader

If you want to get ICANN to fix this vulnerability, you could fix it:

A. The Proper Way: Find the right person at ICANN, send letters, follow-up, and hope they understand and prioritize the issue so it's addressed in some number of years.

B. The Fast Way: Register a funny yet embarrassing domain name, transfer it to a senior ICANN official, tweet to some journalists idle speculation wondering why this person has such a domain name. The vulnerability will be addressed ASAP. :-)

View on HN

The senior ICANN official would need to already own at least one domain at that (unnamed as yet) registrar for the transfer to be possible.

B. And then get in trouble (or sued) for diffamation once we discover that the domain was initially registered by you.

EDIT: Being downvoted because I'm against public shaming, way to go HN! Go on, downvote me.

If there isn't 1) intent for defamation, and 2) identifiable damages (monetary) then there's no viable lawsuit; and arguably any reputation "damage" is deserved if the organization they're in charge of allowed this to happen so easily.

There doesn't have to be those things to make your life hell, at least not in the US. There just has to be enough of an argument where a judge will be OK with bringing it to court - and even if he isn't OK with it, you'll still have tons of lawyer fees to deal with.

Either way, I think it's irresponsible to target a random employee and throw journalists at him.

No, nobody deserves "reputation damage" for the misbehavior of their company (and here, the one at fault is another company).

I mean, what kind of domain name are you imagining is being registered and transferred to them? I'm imagining something relatively mundane but funny.

The domain name must be paid by someone. After the transfer, if the employee is not up to date with their inbox, they may end up paying for something they did not consent.

Is there really no legal basis to sue someone because of this? Is that clearly not malicious behavior from the one who transferred the domain?

The domain could be haha.com it would not matter.

You're responsible for checking your credit card for fraudulent charges, too.

And if you're responsible for fraudulent charges on someone else's credit card, you can get into a lot of troubles.

There are technical ways to avoid that, I suspect. Paying Njalla with monero comes to mind.

The point of it is same-registrar push not requiring a confirmation: you can't do this with Njalla bc they probably don't use Njalla.

When I saw "funny yet embarrassing" I pictured something like rewrite-the-internet-in-Qbasic.com, creating grounds for a lawsuit is completely optional.

Reply on news.ycombinator.com