1: "SRT® Hellcat Redeye Jailbreak" actually. I think the marketing department is staffed with 12 year olds.

$185k is a rounding error in the marketing budget of many companies

By being a registry instead of a registrant you get an extra layer of protection that helps to ensure your domain is untouchable. I think it makes a lot of sense to use for long term infrastructure if, again, the costs aren't prohibitive.

The domain for my work project was over $400k. Buying a gTLD would have been way cheaper, but wouldn't have managed to get us the cool domain we have.

edit: on the other hand, we're hostage to a country who could ruin everything. I guess someone above my pay grade rolled the dice

There's probably ten or twenty domains (not counting my own or my work's) that I can type from memory, the rest I just search for.

The other killer is that "clownfarts.com" looks like a website but www.mcdonalds looks like a typo, even to non-tech people who don't understand any TLD besides the big three.

I'm too lazy to research them all here, but I recognize a number of them here from their initial applications, which would have all happened at the same time as the two you mentioned.

Another "ghost mining town" left behind from the wild west that was the first decades of the commercial internet.

https://en.wikipedia.org/wiki/Generic_top-level_domain

Thanks for the correction!

B. Much better to have it and not need it, than need it and not have it.

As it turns out, they didn't need it, and lost a bit of their marketing budget.

But nope. ICANN turned the whole thing into another disgraceful money grab... taken to a new level. Now that it has flopped, we can just hope that someday we'll be able to end a domain name with any valid string.

DNS is hierarchical, and I don't think devolving into a semi-flat namespace is a good idea at all.

ICANN could certainly afford to run servers for a "flat" TLD system.

The problem for ICANN is that it will sour relations with all the existing TLD registrars, and there are security problems with allowing any TLD. For example, I might be able to redirect traffic for a particular local network host name (e.g. "router", "fileserver", "raspberrypi", "linksys", etc.) to an external IP address of my choosing. Or I can make something that is normally a local file (e.g. "cmd.exe") and make it also a valid hostname.

Interesting idea. Can you give an example of how that would actually happen? Also the cmd.exe one. So what if it's a valid hostname?

CMD.exe is either a program accepts either a filename or URL in the same context (VLC does this), or the user is confused about the URL/file distinction. The .ZIP TLD was concerning for this reason.

I was looking more for specific dangerous use cases; for example, "The user types such-and-such in the address bar, and instead of getting this he gets that." In other words, how is this a problem in actual practice.

An example:

The attacker posts a message to a forum, chatroom, etc. like:

Download: 2024YourCompanySalaryData.zip

When the user clicks "2024YourCompanySalaryData.zip", it is actually a domain name, and loads that website. This website then asks you to enter your corp credentials, or executes a 0-day on the victim's browser, etc.

The forum doesn't need to allow file downloads (i.e. a real .zip might not even work), and even if it does, client or server side virus scanning doesn't have a .zip to inspect.

The user is less wary of phishing, having never seen the .zip TLD. They assume they are downloading a file.

https://blog.talosintelligence.com/zip-tld-information-leak/

In terms of the user going to a site instead of a zip file: If a user is willing to unpack and run a random file he downloaded and give it credentials to something... what's the difference? Not being argumentative, but this seems like a stretch.

Now "foo.zip" is a valid URL.

You could have a forum or chat program that you think is quite safe, since it doesn't allow file uploads, and doesn't allow arbitrary link text, and this would upend that.

Not necessarily a reason not to do it, just a reason to be a little careful in rollout.