Yes, you are correct in that a single individual’s action will make no difference, just like your single vote makes no difference either. However if everyone does their part it can make a massive difference.
While your individual contribution makes no difference, you still should try to do your part. Yes, change takes work and a bit of sacrifice. Just like how it takes time out of your day to do research on candidates and go to the polls.
If you don’t do the work, it doesn’t make you smart or clever, it just makes you an asshole taking advantage of others.
I hate that Google is exerting even more control on the internet with their TLD, but I don’t really think this attack is made all that much worse with .zip TLD. I can already bury a
.com
in a long URL and end it in .zip just fine like so:https://github.com∕foo∕bar∕baz@example.com/foo/bar/baz.zip
Or even use a subdomain to remove the @:
https://github.com∕foo∕bar∕baz.example.com/foo/bar/baz.zip
The truth is most people don’t look much at URLs outside of a domain to verify its authenticity, at which point the
.zip
TLD does not do much more harm than existing domains do.For mitigation, Firefox already doesn’t display the username portion of the URL on hover of a link and URL-encodes it if copy-pasted into the url bar. It also displays the punycode representation when hovering or navigating to the second example.