<story><title>.io considered harmful</title><url>https://www.beep.blog/io/</url></story><parent_chain><item><author>teddyh</author><text>I would go further and say this: Never treat foreign ccTLD’s (two-letter domains) as anything you can just register and use a domain in.  You should only ever use a ccTLD of your own country or region you actually have your main presence in.&lt;p&gt;Your domain name is often your most secure key to your entire online identity, and you want that to be on as a secure legal footing as possible.&lt;p&gt;Older discussion here: &amp;lt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=32797286#32801880&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=32797286#32801880&lt;/a&gt;&amp;gt;&lt;p&gt;Disclaimer: I work at a domain name registrar.</text></item></parent_chain><comment><author>ak217</author><text>People look at me like I&amp;#x27;m crazy when I suggest that Notion&amp;#x27;s use of the Somalia TLD is a security concern that should give pause to anyone looking to store confidential data. This includes Notion&amp;#x27;s own recruiters.&lt;p&gt;I still think that&amp;#x27;s probably the biggest mistake that company has made. It seems baked in to their architecture now. But I think any company using a vanity domain in this manner is acting irresponsibly.&lt;p&gt;FWIW I don&amp;#x27;t think the &amp;quot;colonialism&amp;quot; argument makes sense for this or other vanity domains. But the use of vanity ccTLDs is still a huge, underappreciated security concern. Companies willingly expose themselves to the risk of their domain being hijacked (or &amp;quot;legally&amp;quot; taken away) with zero recourse - or worse, putting their government in a situation where they have to choose between trying to intervene or having a bunch of their citizens&amp;#x27; data compromised. It betrays a security naivete, oblivious to what state-sponsored APTs out there are capable of once enough is at stake.</text></comment>
<story><title>.io considered harmful</title><url>https://www.beep.blog/io/</url></story><parent_chain><item><author>teddyh</author><text>I would go further and say this: Never treat foreign ccTLD’s (two-letter domains) as anything you can just register and use a domain in.  You should only ever use a ccTLD of your own country or region you actually have your main presence in.&lt;p&gt;Your domain name is often your most secure key to your entire online identity, and you want that to be on as a secure legal footing as possible.&lt;p&gt;Older discussion here: &amp;lt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=32797286#32801880&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=32797286#32801880&lt;/a&gt;&amp;gt;&lt;p&gt;Disclaimer: I work at a domain name registrar.</text></item></parent_chain><comment><author>thiht</author><text>I used to work at a registrar and I completely agree with you. This is exactly my take as well (with a small exception for .eu, just don&amp;#x27;t use it)&lt;p&gt;For your online identity (ie email address) I&amp;#x27;d even go as far as suggesting not using a ccTLD at all, no matter if you check all the boxes. No fancy gTLD either, just use a .com.  I don&amp;#x27;t think any TLD is remotely as reliable as this one (maybe .net because they&amp;#x27;re both Verisign, but that&amp;#x27;s it)</text></comment>