alt Hacker NewsI'm not sure I get it. If anyone registers a domain first.second.name then you are basically registering a subdomain under second.name, right? You don't own anything, second.name owns your subdomain and can do whatever they want with it
Replies
Originally, you could register third-level domains directly.
.name was special (derogatory). When you registered first.last.name, .name would give an authoritative NS record for first.last.name, but not last.name. What you think is happening is that .name is spinning up a second DNS zone for last.name, and then issuing a normal declaration, but it's way more cursed.
Delegating multiple levels down is allowed by DNS spec but almost never done, and causes problems. For starters, some registrars just straight up did not handle the first.last.name case at all. Which is particularly bad for .name because originally, you could only register third-level domains. Only later did .name added second-level domain registration.
This creates an obvious collision problem: if John Doe registers john.doe.name first, and then Jane Doe wants to register doe.name, what happens?
You might think that, obviously, both registrations stick. But this means John Doe owns a subdomain of Jane Doe's namespace, that Jane Doe cannot get rid of or otherwise control. When someone looks up records on john.doe.name, doe.name is never queried; .name skips it. This causes all sorts of problems for cookies: John Doe can now set cookies on Jane Doe's website, and Jane Doe's website always sets cookies that John Doe's website can read[0].
The time-reversed scenario (John Doe registers after Jane Doe) is even worse. Obviously, top-level domain operators should not be allowed to project subdomains onto other people's registrations like this. Like, imagine if Verisign decided you could register subdomains on someone else's domain, that they did not control and could not get rid of, if you paid them a little extra? There would be all sorts of shenanigans.
The alternative resolution is confiscation: when Jane Doe registers doe.name, John Doe loses his website. This is more in line with how you thought it was working. And, indeed, what Verisign is planning to do is basically this en masse, dropping all the third-level delegations. Probably because the operational headaches of managing two different conflicting delegation schemes was too much.
[0] This is actually a problem for any DNS suffix that is shared across multiple websites; there's a Public Suffix List that exists specifically to keep you from, say, writing cookies to .com that hit every website. But doe.name isn't exactly a public suffix: it's Jane Doe's personal website, one that just happens to have a suffix collision with another website because of a stupid idea someone had.
Well not really. There are TLDs where third level domains are the primary thing that people register; e.g you can't register example.uk, you need example.co.uk.
Although it is weird to have a registrar where you get to pick both the second and the third level freely.