Inspiration for the project was based off one I made over half a decade ago. And I gratefully got recognized on HN for it! I saw (my) username that posted it, tried a few of my go-to password ’s, and boom, I still got it :)

Here was the thread for a trip down memory lane https://web.archive.org/web/20160322215116/https://news.ycom...

And the new one is called DecentDrops.com - Would have totally used DomainInferno again but looks like some squatter had it, hey that’s what I get for neglecting I guess. Still not sure why.. Updated daily. Sorry I’m bad about rambling and don’t want to do a (bigger) wall of text but if you’ve got questions shoot em!

Notably:

"Pinned" security properties like recursive HSTS may apply until they expire. Even if you have only ever operated http://clown-photos.example.com/ and never https://clown-photos.example.com/ the previous owner of example.com could have set policy saying all names are HTTPS-only.

Certificates issued in the Web PKI as much as three years ago for names in these domains may still exist and be valid. In principle some of them might even not be in CT logs. As new owner you are entitled to have those certificates revoked, but to do that you first need to know they exist.

Adverse user permissions decisions apply indefinitely. If the previous owner spewed notifications, or had unsolicited video content the resulting adverse decisions by users survive the change of ownership. (The other side of this applies too, if you buy a popular cat video sharing site, you're going to inherit lots of "allow autoplay" type permissions) but that's something you'd probably explicitly plan for rather than being a surprise.

White and black lists maintained by third parties may impact you. Whether that's a DNS blacklist that means some PiHoles block your whole site because the previous owner was an advertising network, or a spam blacklist that ensures your newsletter is never seen by its subscribers, that could be a real problem. Some list maintainers are very responsive, others not so much.

Speaking of lists, the domain could be on the PSL. Again you can ask to be removed (or indeed added if your planned use would mean the domain should be on the PSL and isn't). But if you don't realise the domain is PSL listed, you'll be astonished that it's impossible to get a Let's Encrypt certificate for *.example.com, or that cookies and frames and other origin-restricted stuff doesn't work as you expect.

For the next who knows maybe hour or so, from this minute actually, you'll probably notice a few more than average domains one the list are already taken. Don't worry i've got my best robot people on it

In a similar space, I really like https://park.io

Good on you for restricting people from sending "4" or less for the character count; I'd probably hide that too and use that for my own needs in your position, though it only raises the barrier from opportunistic searchers to people with a mild amount of curl/grep knowledge.

b) Kinda sad to read all those names and think that someone once thought, 'hey, this could be my baby.' Sure, I imagine a bunch of them were just hoovered up by domain squatters, but at least a few of them are failed sites, right? … right?

I've got one domain that I think I could actually sell for a decent price, but I just really don't wanna deal with it...

I just registered (majorsportsapparelmaker)golf.com

And yes, they make golf shoes and apparel.

So that's fun.