iiinova — where your digital self keeps evolving

Replies

Filippo Valsorda @filippo.abyssdomain.expert · 13/02/2024

We kinda need a better story for domain loss of control in the Go ecosystem. The sumdb protects existing versions, so the risk is limited to upgrades, but it's still not great. Has *any* ecosystem fixed this? Email and ActivityPub haven't. Maybe the vulndb, if it was checked on upgrades?

Brad Fitzpatrick@bradfitz.com

I used to make fun of people and companies using ccTLDs from unrelated countries for real purposes. Then I used one of my joke domains for something real "temporarily" and forgot my rule. And now people can't access some of my Go modules because they were taken by the Taliban. 🤦‍♂️ RIP, inet.af. 🇦🇫

inet.af

5173

Paul Jolly @myitcv.io · 13/02/2024

Would there be some way when proving you own a domain you can also include some kind of kill switch, that allows you to revoke the ability to publish future versions under that module path (when you lose control to a new owner)?

100

Filippo Valsorda @filippo.abyssdomain.expert · 13/02/2024

We could definitely design one, but would people actually use it? Hold on to the revocation keys for when they need them? And it’s also an abuse vector from past maintainers if there’s no way to defuse it, but a way to defuse it would defeat the point.

210