The discussion centers on Verisign's reversal of its plan to terminate 22,000 third-level .name domains and email redirects, a decision driven by significant user backlash and legal pressure. While many users celebrate the preservation of their digital assets, others criticize the underlying fragility of centralized domain ownership and highlight the practical difficulties faced by registrants during the transition.
211 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4publicsuffix
list
Go2016–2026
publicsuffix / list
list
The Public Suffix List
32Distinct people
37Mentions
0Explicit recommenders
3KGitHub stars
What to know before exploring
What it is
The Public Suffix List
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
Mentions over time
HN mentions by year37 dated mentions
Observed mentions: 2016-03-23 19:11:23 UTC to 2026-10-24 18:07:56 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 6 | 1 | 5 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 10 | 0 | 10 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 9 | 2 | 7 |
What Hacker News says
37 sources8O8organicbits·Oct 24, 2026
I've used FreeDNS on occasion for test domain names, one-off experiments, and similar. I'm very appreciative this exists, but there are some pain points that similar services handle better.
The domains are missing from the public suffix list. This impacts how cookies are handled by the domain names, with concerns the browser will allow software to set the cookie on the shared domain name instead of the subdomain. This can be a security problem. Getting added to the PSL may not happen: https://github.com/publicsuffix/list/pull/79
It can be difficult to get a free HTTPS certificate for your subdomain. Let's Encrypt applies per-domain name rate limits and these domain names see lots of issuance requests. There's a process to lift those limits, but last I checked FreeDNS didn't use it. You can still, of course, pay for a certificate.
There's
Read the rest
tons of abuse on free domains so you may find that your domain is blocked on various lists.
Here are some compelling alternatives I use now, which manage these issues better:
- https://messwithdns.net/ - Exceptionally well-made DNS console for learning DNS
- https://open-domains.com/ - Uses Cloudflare, great Discord group
- Even more: https://free.hrsn.dev/#/?id=domains
And the Public Suffix List didn't even attempt to handle .name.
https://github.com/publicsuffix/list/issues/2306
In Tell HN: Remember to migrate away from .name domainThe .name mess is not in the public suffix list.
https://github.com/publicsuffix/list/issues/2306 for more discussion.
In .name TerminationThe correct way to handle this mess is to simply keep things messy. BGP tables are a big mess, for example, because a lot of companies keep their IPs when going from ISP to ISP.
But, assuming that Verisign can’t keep third level domains (as a DNS implementer, I don’t think third level domains is a huge deal; see thread below):
* Third level names where only one person has the second level domain should be transferred to whoever owns that single third level name.
* Third level names where multiple people have the same second level domain should be put up for closed bidding: Only current owners of .name domains with a given second level domain name (e.g. last name) will be able to bid for the second-level domain. So, if one has john.smith.name and joe.smith.name, Joe Smith and John Smith will be in a bidding war for smith.name.
If the iss
Read the rest
ue of .name not being in public suffix is a real issue, Verisign can handle that by disabling new third-level .name registrations, and provide Public Suffix with a list of those registrations (just send all the owners a privacy notice, making it clear that the existence of the name will be made public for security reasons). More reading: https://github.com/publicsuffix/list/issues/2306 (There seems to be issues with this list being too long to keep in the Public Suffix because there’s too much software out there which can’t handle it. That seems strange to me: Even here in 2026 where RAM costs far too much, Deadwood can store a list of 240,000 blacklisted entries in under 10 megs; there are about 22,000 three-level .name domains and I could store that list in a way that could be very quickly looked up in about a meg of memory)
Now, personally, I think Verisign can keep these messy third level names, and are doing things this way so that Neil Fraser has to compete with every single 2-bit cybersquatter out there for the rights to fraser.name.
As an aside, it’s trivial to have DNS servers handle multi-level domains without having to have a zone file for every level; e.g. https://this.is.a.long.name.maradns.org works, and there’s no zone file for name.maradns.org, long.name.maradns.org, a.long.name.maradns.org, and so on.
Also, since people have brought up the “org fuckery” without providing details: https://bluecatnetworks.com/press/the-org-domain-sale-explai...
You know dang well if .org was owned by an investment entity, they would had jacked up the prices as much as they could get away with.
How should we handle the 2LDs of the .name TLD?
4 points · Open discussionSince neither smith.name nor the wildcard *.name appear in the Public Suffix List (https://publicsuffix.org/), browsers would likely allow any page on a *.smith.name domain to set cookies for .smith.name.
There was an effort to properly handle the .name 2LDs, but it was never resolved because there’s no easy way to tell a reserved 2LD (open for 3LD registrations only) apart from a normal 2LD on .name: https://github.com/publicsuffix/list/issues/2306
So yes, this TLD’s setup is in fact pretty insane.
In .name Termination.co.uk is run by the same people as .uk. There is no additional org that you trust when you register a .co.uk: https://en.wikipedia.org/wiki/.uk#Second-level_domains
> do browsers have a wildcard suffix list
Yes: https://publicsuffix.org/ and they have discussed this situation here: https://github.com/publicsuffix/list/issues/2306
In .name Terminationthe main reason they mentioned [1] for radicle.network is because their old domain radicle.xyz was blocked in some places by some lists that they think was because it may have hosted certain UGC that triggered some flags.
> Content about Radicle (explainers, guides, download links, blog posts) which is under control of the Radicle team. We will use radicle.dev for these purposes.
> Content on Radicle (repositories hosted on practically any node on the network) which the Radicle team has only very little control over, accessible via Radicle Explorer. Going forward, our deployment of Radicle Explorer will not be hosted on app.radicle.xyz anymore, but instead it will be hosted at radicle.network.
> The idea is of course that if there are complaints about or issues with radicle.network in the future, we hope that radicle.dev stays largely una
Read the rest
ffected and people can continue to inform themselves about Radicle and learn how to set it up.
On a semi-related note, this is a good time to remind anyone that hasn't yet heard of the Public Suffix List (PSL) [2][3] to make sure you put your domains that may be hosting UGC in the form <usercontent>.<yourdomain>.<tld> (ie: eTLDs) on that list so browsers and other block lists are aware that the user provisioned subdomains are UGC and not from your site so it properly isolates cookies/site grouping and won't flag your entire domain as malicious.
1: https://radicle.dev/2026/04/23/domain-move
2: https://en.wikipedia.org/wiki/Public_Suffix_List
3: https://github.com/publicsuffix/list
The Iranian Government Internet Filtering Machine Is Getting Into Mozilla PSL
5 points · Open discussionIt looks like Mozilla does use DNS to verify requests to join the list, at least.
$ dig +short txt _psl.website.one @1.1.1.1
"https://github.com/publicsuffix/list/pull/2625"
Doing this DNS in the browser in real-time would be a performance challenge, though. PSL affects the scope of cookies (github.io is on the PSL, so a.github.io can't set a cookie that b.github.io can read). So the relevant PSL needs to be known before the first HTTP response comes back.
In Google flags Immich sites as dangerousLast link the menu header: https://publicsuffix.org/submit/
Which then links to: https://github.com/publicsuffix/list/wiki/Guidelines#submitt...
Fairly obvious and typical webpage > documentation flow I think, doesn't seem too hard to find.
In Google flags Immich sites as dangerousAh yeah, looks like it was added in 2022 https://github.com/publicsuffix/list/wiki/Guidelines/_compar...
Thanks for the note!
In Google Safe Browsing incident> [..] projects not serving more then (sic) thousands of users are quite likely to be declined.
from PSL's GitHub repo's wiki [0].
[0]: https://github.com/publicsuffix/list/wiki/Guidelines#validat...
In Google Safe Browsing incidentAuthor here. What kind of security negligence are you referring to? What would be a specific attack vector that I left open?
Regarding the PSL - and I can't believe I'm writing this again: you cannot get on there before your service is big enough and "the request authentically merits such widespread inclusion"[1]. So it's kind of a chicken and egg situation.
Regarding the best practice of hosting user content on a separate domain: this has basically two implications:
1. Cookie scope of my own assets (e.g. dashboard), which one should limit in any case and which I'm of course doing. So this is not an issue.
2. Blacklisting, which is what all of this has been about. I did pay the price here. This has nothing to do with security, though.
I'm sorry to be so frank, but you don't know anything about me or my security practices and your claim o
Read the rest
f negligence is extremely unfounded.
[1] https://github.com/publicsuffix/list/wiki/Guidelines#validat...
Getting on the public suffix list is easier said than done [1]. They can simply say no if they feel like it and are making sure to be able to keep said rights as a "project" vs a "business," [2] which has its pros and cons.
[1] https://github.com/publicsuffix/list/blob/main/public_suffix...
[2] https://groups.google.com/g/publicsuffix-discuss/c/xJZHBlyqq...
In Google Safe Browsing incidentShowing the 15 most recent of 37 sources. Enable JavaScript to search and browse every indexed mention.