Someone forgot to renew NodeJS.org(nodejs.org)
nodejs.org
Someone forgot to renew NodeJS.org
http://nodejs.org/
77 comments
File under shit happens and move on. Nothing to see here, people.
[deleted]
Wow, what recourse is available in this situation? None? Does this mean that 100% they are going to now be blackmailed to get their domain back?
Shouldn't be anything to worry about - here’s how the domain expiry process works.
1. Domain ‘expires’, and enters a 40 day grace period. I have read things that imply this can vary from registrar to registrar, but it seems pretty standard from what I have seen.
2. After the grace period, it enters a 30 day redemption period. Again, apparently this can vary, but I have yet to see it (admittedly I have only looked at a small number of domains)
3. Finally, when the redemption period expires, a 5 day ‘pending deletion’ period is entered.
Between 11am and 2pm Pacific Time on the 6th day of pending deletion, the registrars theoretically start dropping the names from the ICANN database.
It is kind of odd that such a domain would only be renewed annually... it's hardly speculative!
1. Domain ‘expires’, and enters a 40 day grace period. I have read things that imply this can vary from registrar to registrar, but it seems pretty standard from what I have seen.
2. After the grace period, it enters a 30 day redemption period. Again, apparently this can vary, but I have yet to see it (admittedly I have only looked at a small number of domains)
3. Finally, when the redemption period expires, a 5 day ‘pending deletion’ period is entered.
Between 11am and 2pm Pacific Time on the 6th day of pending deletion, the registrars theoretically start dropping the names from the ICANN database.
It is kind of odd that such a domain would only be renewed annually... it's hardly speculative!
Your numbers are off.
Grace period (as you have pointed out somewhat) varies by registrar. The basis for what you are saying is how long a registrar has to delete the domain before they can get their money refunded. That time period is 45 days. So on the expiration date the registrar is automatically charged for the renewal. If they delete on day 45 (by a certain time depending on when registered) they will have their fee refunded. Consequently they can give a grace period if they want of up to 45 days but from a practical standpoint it's tricky to wait until the last minute before deleting (if you have a system problem on day 44 that prevents you from deleting 2000 names you're stuck with them).
After they delete the domain (which can theoretically be anytime and keep in mind that "delete" is different than "take off line" "change ownership" etc.) it goes into redemption.
It is in redemption for 30 days during which only the sponsoring registrar can submit the necessary report to get the domain back. With .com .net .org .info the cost for the registrar to get the name out of redemption is $40 plus the renewal fee.
Once 30 days have past it is in pending delete and goes into a 5 day black hole where nothing happens and not even the sponsoring registrar can get it back. After that 5 day period it's released and anyone can grab it, first come first serve.
nodejs.org as I pointed out elsewhere was simply taken offline. It wasn't "deleted" in the sense that it goes into redemption. From the registrars point of view this makes sense since it allows them (if they want) to charge a fee to restore the domain w/o having to incur any extra ($40) costs.
"the registrars theoretically start dropping the names"
The time the domains drop is not controlled by registrars. It's controlled by the registries. The registrars only control (in addition to other things pointed out) when the domain goes offline or gets "deleted" and enters redemption.
" it enters a 30 day redemption period. Again, apparently this can vary"
Can't vary it's 30 days.
Grace period (as you have pointed out somewhat) varies by registrar. The basis for what you are saying is how long a registrar has to delete the domain before they can get their money refunded. That time period is 45 days. So on the expiration date the registrar is automatically charged for the renewal. If they delete on day 45 (by a certain time depending on when registered) they will have their fee refunded. Consequently they can give a grace period if they want of up to 45 days but from a practical standpoint it's tricky to wait until the last minute before deleting (if you have a system problem on day 44 that prevents you from deleting 2000 names you're stuck with them).
After they delete the domain (which can theoretically be anytime and keep in mind that "delete" is different than "take off line" "change ownership" etc.) it goes into redemption.
It is in redemption for 30 days during which only the sponsoring registrar can submit the necessary report to get the domain back. With .com .net .org .info the cost for the registrar to get the name out of redemption is $40 plus the renewal fee.
Once 30 days have past it is in pending delete and goes into a 5 day black hole where nothing happens and not even the sponsoring registrar can get it back. After that 5 day period it's released and anyone can grab it, first come first serve.
nodejs.org as I pointed out elsewhere was simply taken offline. It wasn't "deleted" in the sense that it goes into redemption. From the registrars point of view this makes sense since it allows them (if they want) to charge a fee to restore the domain w/o having to incur any extra ($40) costs.
"the registrars theoretically start dropping the names"
The time the domains drop is not controlled by registrars. It's controlled by the registries. The registrars only control (in addition to other things pointed out) when the domain goes offline or gets "deleted" and enters redemption.
" it enters a 30 day redemption period. Again, apparently this can vary"
Can't vary it's 30 days.
You start by saying my numbers are off, then agree about the variability of the grace period before stating exactly the same numbers as I did?
Thanks for clearing up the redemption period invariability though.
Thanks for clearing up the redemption period invariability though.
You made statements of fact, such as:
"here’s how the domain expiry process works." (might have been better to say "here's how I think").
"Domain ‘expires’, and enters a 40 day grace period" although you qualified this saying it like that gives people the wrong impression of your actual knowledge in this area.
"After the grace period, it enters a 30 day redemption period. Again, apparently this can vary, but I have yet to see it "
You say "it enters" (like a fact) but then say "it can vary, but I haven't seen it yet".
My point isn't to give you a hard time but on HN crowd tends to jump on anything incorrect and it's clear from your summary that you don't have much experience in this area. I've made mistakes when I've said things on HN that I haven't doubled checked or don't know very well. (It's possible of course to even make mistakes on things you know well!)
"here’s how the domain expiry process works." (might have been better to say "here's how I think").
"Domain ‘expires’, and enters a 40 day grace period" although you qualified this saying it like that gives people the wrong impression of your actual knowledge in this area.
"After the grace period, it enters a 30 day redemption period. Again, apparently this can vary, but I have yet to see it "
You say "it enters" (like a fact) but then say "it can vary, but I haven't seen it yet".
My point isn't to give you a hard time but on HN crowd tends to jump on anything incorrect and it's clear from your summary that you don't have much experience in this area. I've made mistakes when I've said things on HN that I haven't doubled checked or don't know very well. (It's possible of course to even make mistakes on things you know well!)
What you say is correct. I'll chip in a bit on "registrar to registrar". In case of Namecheap,renewing a expired domain is just like renewing a regular domain. While other registrars charge re-activation fee, Namecheap has no additional fees. So, Ryan can just renew the domain instantly whenever this comes into his attention.
The "registrar" of this name is actually enom.
In this particular case namecheap is merely a reseller for enom.
Important to point out here that namecheap which is much touted on HN as being so great to deal with is the organization that made the decision to take this domain offline - not enom.com the registrar.
In this particular case namecheap is merely a reseller for enom.
Important to point out here that namecheap which is much touted on HN as being so great to deal with is the organization that made the decision to take this domain offline - not enom.com the registrar.
When people fail to respond to expiration notices, taking the domain offline on the expiration date seems like a good way to bring it to their attention.
Off the top I wonder if an idea might be to do the following, keeping in mind that the registrar would charge extra but ultimately it would be to the registrants benefit and less disruptive if the normal ways (that have no cost) were interupted:
- Send postal notice (some do this already) - Send express or certified letter (charging up front to be notified this way) - Make phone call - Send email to any contact addresses on the website
I would like to point out also that this is a reason also why "privacy" on whois is a bad idea in some cases. In this case it is fairly easy for a third party to get in touch with the joyent contact (someone might know him or have an alternative means of contacting him - even by phone if not the whois phone number). If contact info is protected by privacy that becomes a different issue (you would have to have more specific knowledge).
- Send postal notice (some do this already) - Send express or certified letter (charging up front to be notified this way) - Make phone call - Send email to any contact addresses on the website
I would like to point out also that this is a reason also why "privacy" on whois is a bad idea in some cases. In this case it is fairly easy for a third party to get in touch with the joyent contact (someone might know him or have an alternative means of contacting him - even by phone if not the whois phone number). If contact info is protected by privacy that becomes a different issue (you would have to have more specific knowledge).
Nope, Namecheap doesn't practice the shady conditions practiced by other registrars. The expired domian can be renewed just like a regular domain. No extra fees and fuss involved.
Usually there's a grace period where the owner can still renew it, and before anyone else can. If the domain actually expired 60 or 90 days ago then they're probably hosed.
Yes you are correct about that... It happened to me once on an old domain and I was able to get it back in the following week after expiration but I don't recall seeing a parked page during that period of time.
Doing a quick Whois for nodejs.org show that the name is expiring today:
Domain ID:D157222203-LROR
Domain Name:NODEJS.ORG
Created On:29-Sep-2009 14:50:55 UTC
Last Updated On:20-Sep-2011 00:04:23 UTC
Expiration Date:29-Sep-2012 14:50:55 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Status:OK
Ouch!
Doing a quick Whois for nodejs.org show that the name is expiring today:
Domain ID:D157222203-LROR
Domain Name:NODEJS.ORG
Created On:29-Sep-2009 14:50:55 UTC
Last Updated On:20-Sep-2011 00:04:23 UTC
Expiration Date:29-Sep-2012 14:50:55 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Status:OK
Ouch!
eNom does all kinds of shady shenanigans with domain renewals. There are stories of names going up on their auction block the moment the registration expires (meaning someone has to pay a greatly inflated amount of cash to reclaim the name)
Unlikely. As much as enom sucks I don't think one could misconstrue any of their ineptitude as evil. They do however have the redemption period at inflated prices, but I've never heard of them moving an expired domain to immediate auction.
[citation please]
[citation please]
http://www.ripoffreport.com/Search/Enom.aspx
Start here.
Start here.
None of those reference enom directly -- only resellers of enom. That's like saying I bought a widget off amazon & chase paymentech is fraudulent as a result.
"eNom does all kinds of shady shenanigans with domain renewals."
This wasn't done by enom. It was done by the reseller, namecheap. Their DNS is in the record (and it points to a page controlled by namecheap).
This wasn't done by enom. It was done by the reseller, namecheap. Their DNS is in the record (and it points to a page controlled by namecheap).
According to WHOIS, the expiration date is 29-Sep-2012 14:50:55 UTC.
But it's still registered to Ryan Dahl/Joyent, so it probably can still be renewed.
[deleted]
[deleted]
I don't understand. It looks normal and works for me?
You can use one of the proxy sites. Try this link
http://ninjacloak.com/index.php/1010110A/7dc98701d4de0a559b4...
That means the old DNS entry is cached for you.
Wait half an hour or so, and flush your computer's DNS cache. Your ISP is probably caching the DNS entry.
It's been fixed. So it might be YOU who now have the old, bad DNS entry cached.
Domain Name:NODEJS.ORG
Created On:29-Sep-2009 14:50:55 UTC
Last Updated On:29-Sep-2012 16:27:30 UTC
Expiration Date:29-Sep-2013 14:50:55 UTCIt now shows "Welcome! This domain was registered at namecheap.com. Please check back later!"
I know people make mistakes and overlook things, but really...there is no excuse for this. I get about 8 emails from my registrars warning me before a domain expires...60 days, 45 days, 30 days, 1 week, then one like every day until the date. Unless these emails are going to an address nobody is monitoring I can't see how this can get overlooked.
If an email was sent to a mailbox that wasn't being checked, it doesn't matter how many emails were sent. I don't know if it's the case, just guessing as one possibility.
That's exactly true. Emails bounce and the person who is in charge of the domain often changes jobs and the contact isn't changed. Some go straight to the spam bin.
But you'd be surprised at how many people ignore even postal notices that some registrars send.
What you have to keep in mind is that restoring domains that have expired is a profit center for registrars. [1]
And having incorrect email contact info helps as well since not only does it favor that profit center but it also prevents competitors from soliciting your accounts (as well as preventing spam, right?)
[1] In the case of the nodejs.org domain it was taken offline on the day of expiration. It wasn't deleted it didn't go into redemption. Generally most registrars give some grace period (but if you aren't getting the emails that doesn't really matter, does it?)
There is a new policy being floated by ICANN that addresses these issues. If I can find the link I will post.
But you'd be surprised at how many people ignore even postal notices that some registrars send.
What you have to keep in mind is that restoring domains that have expired is a profit center for registrars. [1]
And having incorrect email contact info helps as well since not only does it favor that profit center but it also prevents competitors from soliciting your accounts (as well as preventing spam, right?)
[1] In the case of the nodejs.org domain it was taken offline on the day of expiration. It wasn't deleted it didn't go into redemption. Generally most registrars give some grace period (but if you aren't getting the emails that doesn't really matter, does it?)
There is a new policy being floated by ICANN that addresses these issues. If I can find the link I will post.
whois nodejs.org
Registrant Name:Ryan Dahl
Registrant Organization:Joyent
Registrant Street1:345 California St Suite 2000
Registrant City:San Francisco
Registrant State/Province:CA
Registrant Postal Code:94104
Registrant Country:US
Registrant Email:[email protected]With the email "[email protected]", it doesn't seem likely that it's an unmonitored email address that would have missed the registration, unless it was seen as spam / junk mail.
It used to be possible to pay for other people's domains (they still own it, you are just gifting the payment).
Someone once renewed a hotmail domain after Microsoft forgot.
Registrars should allowing gifting, source doesn't matter.
Someone once renewed a hotmail domain after Microsoft forgot.
Registrars should allowing gifting, source doesn't matter.
>Someone once renewed a hotmail domain after Microsoft forgot
http://www.doublewide.net/
This is what ck2 is referring to. Its was an interesting incident.
Slashdot discusssion around it: http://slashdot.org/story/03/11/06/1540257/microsoft-forgets...
http://www.doublewide.net/
This is what ck2 is referring to. Its was an interesting incident.
Slashdot discusssion around it: http://slashdot.org/story/03/11/06/1540257/microsoft-forgets...
Many do actually.
There are some problems with allowing that though. In some cases a clueless CSR could allow the person paying for the domain to gain access to it. The assumption is wrongly made that if the person is paying for the domain they have rights to it. After paying they will simply say something like "oh, by the way my address needs to be changed" or open a conversation about something else and end up gaining access.
There are some problems with allowing that though. In some cases a clueless CSR could allow the person paying for the domain to gain access to it. The assumption is wrongly made that if the person is paying for the domain they have rights to it. After paying they will simply say something like "oh, by the way my address needs to be changed" or open a conversation about something else and end up gaining access.
ERROR 500.5150 - Too busy being rockstar tech
As clarified by others, I missed the reference to the album because I never really listened to Van Halen and I apologise for my harshness. But we are on the same boat.
P.S. I need to listen to 5150 now!
P.S. I need to listen to 5150 now!
Please stop using this bs terminology, rockstars, ninjas and all that sort of crap. With all respect to Ryan he is just one of many great programmers.
No one can truly know the mind of another human being, but I'm pretty sure Carson Gross is sick of the term as well.
I do agree with you that sincere language is more likely than sarcastic derision to turn the tide, but you should know that you guys are on the same side.
I do agree with you that sincere language is more likely than sarcastic derision to turn the tide, but you should know that you guys are on the same side.
I thought this was just an allusion to the 5150 in the error message.
http://en.wikipedia.org/wiki/5150_(album) and http://en.wikipedia.org/wiki/Peavey_5150
So rockstar in this context is spot on.
But otherwise, that terminology is complete shit, yes.
http://en.wikipedia.org/wiki/5150_(album) and http://en.wikipedia.org/wiki/Peavey_5150
So rockstar in this context is spot on.
But otherwise, that terminology is complete shit, yes.
I think it's a gag on nodeJS's current trendiness.
Also, 10 year registrations are typically only $80
If you have a serious domain, why not just grab the decade.
Domain prices will only go up, sometimes $1 a year, so there are savings too.
If you have a serious domain, why not just grab the decade.
Domain prices will only go up, sometimes $1 a year, so there are savings too.
"10 year registrations are typically only $80"
Where are you seeing $80 for 10 years (not doubting just curious).
$80 is below the cost that the registrar pays (for .com) to the registry and ICANN variable fees. Not to mention the cost for credit card processing as a variable fee.
Consequently in order to charge that amount the registrar has to make money in other places (could be to charge for things that are free elsewhere as one example).
Where are you seeing $80 for 10 years (not doubting just curious).
$80 is below the cost that the registrar pays (for .com) to the registry and ICANN variable fees. Not to mention the cost for credit card processing as a variable fee.
Consequently in order to charge that amount the registrar has to make money in other places (could be to charge for things that are free elsewhere as one example).
Cheapest I've seen is $98 for 10 years (Dynadot), which is still not bad.
nearlyfreespeech charges 9.49USD per year so that is not too far off for a respected registrar
They are a reseller, not a registrar.
http://faq.nearlyfreespeech.net/full/accredited
http://faq.nearlyfreespeech.net/full/accredited
With inflation that's cheaper than $80 for 10 years. :)
I know there is a joke about event driven programming in here somewhere.
I hope the node installation never did one of these:
curl -s -L http://nodejs.org/some-script.sh |sh
Homebrew, rbenv, rvm, to name a few. Never understood it either. If you could get ahold of a domain write a malicious script at /some-script.sh, you could do a lot of damage.
I agree that it feels insecure, but is there really a difference between this and downloading and running files from a .tar.gz or installing a .deb for example?
Yes.
apt-get:
apt-get:
$ ls -l /etc/apt/trusted.gpg.d/
$ wget http://nmap.org/dist/sigs/nmap-6.01.tgz.asc
$ wget http://nmap.org/dist/nmap-6.01.tgz
$ gpg nmap-6.01.tgz.ascThis is an important part of why Debian and its derivatives are superior to OS X for web development. If you like Mac hardware like I do, at least run a Linux distro as a virtual machine and save yourself the trouble of Homebrew or its contemporaries.
debs are authenticated.
With a .tar.gz you can verify a checksum.
Would adding a hash check for some-script.sh solve the security issue?
A published hash sum on its own only protects against non-malicious errors in the download. This is of limited use, since even regular HTTP is verified with a 16 bit CRC checksum.
Distributing a hash check over HTTPS would offer some protection against man in the middle style attacks, to the extent that TLS protects against man in the middle attacks, but accomplishes nothing if the server has been compromised.
Distributing a signature of the download gives stronger protection, because the private key can be kept offline and encrypted except when in use. Breaking into a server and overwriting a few files is easier than breaking into someone's laptop in the brief moment where they unlock their keypair to sign a release.
Distributing a hash check over HTTPS would offer some protection against man in the middle style attacks, to the extent that TLS protects against man in the middle attacks, but accomplishes nothing if the server has been compromised.
Distributing a signature of the download gives stronger protection, because the private key can be kept offline and encrypted except when in use. Breaking into a server and overwriting a few files is easier than breaking into someone's laptop in the brief moment where they unlock their keypair to sign a release.
I don't know if it did so in the past, but it doesn't currently.
Sorry, folks. My bad.
The root cause here is that some stuff didn't get handed over properly in the switch from Ryan to me as Node.js manager. So, the emails were indeed going to a non-functioning inbox.
It's resolved now, and we're setting it up to auto-renew so that this doesn't happen again.
The root cause here is that some stuff didn't get handed over properly in the switch from Ryan to me as Node.js manager. So, the emails were indeed going to a non-functioning inbox.
It's resolved now, and we're setting it up to auto-renew so that this doesn't happen again.
It's kind of amazing how much certain data (in this case, a record in DNS) comes to mean to people. And how much we come to rely on that little bit of data. And really, how much we trust the DNS system and it's maintainers. "Ruling the world" might be difficult, but "ruling the internet" appears to be a matter of controlling DNS and then mimicking well-known sites well enough to install arbitrary software on every PC and device on the planet via a nefarious auto-update. It's the ultimate MITM attack. Even better if you can take over the DNS system for a short period, get a few million installs, then put the system back.
tl;dr: He who controls the DNS, controls the universe.
tl;dr: He who controls the DNS, controls the universe.
"setting it up to auto-renew"
Auto renew of course assumes that the credit card on file is current. If the email address is wrong and the cc doesn't work auto-renew obviously will fail. As anyone who has to charge credit cards on a repeat basis might tell you, cc's fail fairly frequently.
Since the domain (any domain) is important it's critical that someone manually also keeps track of the expiration date. And by the way if anyone thinks the answer to this is to renew for the max time period that opens up all sorts of problems in the future when the domain expires and people who were in charge years ago no longer exist and any current people aren't even aware that the domain needs to be renewed. This happens which is why there is an entire part of the domain business catering to what is known as "drop catching" deleted domain names and selling them back to the owners.
Auto renew of course assumes that the credit card on file is current. If the email address is wrong and the cc doesn't work auto-renew obviously will fail. As anyone who has to charge credit cards on a repeat basis might tell you, cc's fail fairly frequently.
Since the domain (any domain) is important it's critical that someone manually also keeps track of the expiration date. And by the way if anyone thinks the answer to this is to renew for the max time period that opens up all sorts of problems in the future when the domain expires and people who were in charge years ago no longer exist and any current people aren't even aware that the domain needs to be renewed. This happens which is why there is an entire part of the domain business catering to what is known as "drop catching" deleted domain names and selling them back to the owners.
Isaac, blog.nodejs.org will need CNAME entry recreated as well.
There is a lot of self-righteous dickishness and schadenfraude in these responses. Proclaiming there to be "NO excuse" to someone who has worked their ass off to create a stellar open-source project really says more about yourself than the person you are attacking.
Most certainly there is some sort of explanation, and whether or not it was a terrible mistake, being a jerk about it doesn't relieve you from the terrible mistakes you've made in your past - we all have them. And in the end, this is really not a big deal.
Most certainly there is some sort of explanation, and whether or not it was a terrible mistake, being a jerk about it doesn't relieve you from the terrible mistakes you've made in your past - we all have them. And in the end, this is really not a big deal.
You have hit on the exact reason why I almost never look at Hacker News any more, except when someone explicitly asks me to respond to something.
This site appeals to the absolute worst in everyone. I find myself becoming an asshole every time I come here, and I don't like that feeling.
This site appeals to the absolute worst in everyone. I find myself becoming an asshole every time I come here, and I don't like that feeling.
I don't know about the worst in everyone :). Lots of people still manage to hold their temper. I've certainly gotten snippy here before.
I still come here for great commentary on complex topics, but usually resist the urge to look at comments on gotcha articles like this where I know there is probably nothing constructive to say, so the trollishness comes out.
I still come here for great commentary on complex topics, but usually resist the urge to look at comments on gotcha articles like this where I know there is probably nothing constructive to say, so the trollishness comes out.
It actually pronounced "Schadenfreude" ;-)