CORE Association is applying for the .src TLD as a standard gTLD to provide a reliable, secure, and intuitive namespace for open source projects. Domain names registered under this TLD can be used directly for repositories of open source software code or other types of open source related content.
It can be used for content delivery end points, as well as other open source related activities such as funding, licensing, development, community discussion and distribution. Furthermore, the .src TLD can be used to create and maintain domain names to provide the environment for the portability of source code location, serving as long-term persistent certification anchors for projects hosted on other domain names or on repository URLs.
Design features to support the open source community within the .src TLD comprise a safe data model including object history, and a reliable identification model based on privacy-preserving identifiers.
In addition, CORE commits to closely work with all open-source organizational layers to design and implement additional policy and technical features to enhance the .src TLD space.
CORE commits to promote activities based on the open source principles, including the search of funding for open source projects, the adoption of open source software, and outreach activities for the different open source collectives.
According to many different metrics, open source penetration is extremely high in commercial software (97% of audited commercial codebases contain open-source components), as open source has evolved from an alternative cost-saving measure to being a foundational component of the architecture of global software development.
The internet has changed how software is created: the free and open source community has created billions of lines of code in a distributed manner. There is obviously wide usage of domain names throughout the software supply chain because of that, which has been a major enabler but is also an unrecognised liability. This is because of a structural mismatch between the considerations for internet operations and information management. Internet operations deals with real-time consumption ('where do I find this particular machine on the internet'), while information management is using domain names as a recall mechanism over a prolonged period --- as much as decades.
Anywhere in the lifecycle of a software project developers may acquire a domain name and proceed to use that --- for publishing their source code, a blog with release announcements, (documentation) websites, mailing lists, issue trackers, et cetera. They use a variety of top level domains for this: .org, .io, .ai, .rs, .eu, .foundation, .app, and many more.
While any given project is under active development, this of course is very convenient: users reliably know how to find www.example.org, can clone the software from git.example.eu with confidence and trust reported vulnerabilities and emails with new releases or urgent security notifications from example.eu. The well-known domain name of the project helps users to establish trust in the provenance of related information.
This is also the issue: these *non-persistent* domain names are depended upon by the infrastructure ecosystem at large as a *trust signal*. Software distributions authoritatively point to these names, helpful postings on internet fora and social media nudge users towards the domain name in question, and manuals and documentation of other applications refer to them.
That means that once these domain names are abandoned, and a new owner silently picks them up, they can be used for impersonation and a variety of other nefarious purposes --- and only manual intervention by vigilant users, on a case by case basis and across the entire chain can prevent this.
Any software project domain name is therefore *one missed renewal* away from landing in the hands of actively hostile parties. Mistakes are easy to make. The attack surface is huge and hard to monitor: to an attacker a domain name for an unassuming low level library has significant economic value as part of a layered attack chain, whilst for downstream developers it is one of many dependencies and for the upstream developer it represents a never-ending cost. Domain names may not be that expensive, but certainly they are not free either --- and over time these costs do start to add up.
Once a domain name is in use, developers are 'stuck' with a significant responsibility for their uninterrupted upkeep: either they continue to foot the bill for each and every domain they were kind enough to register for their (regularly unpaid) contribution to the digital commons. Or they hand it over to someone sternly promising to take good care of it (but potentially does so with ulterior motives, e.g. see the 'XZ' attack). Or they leave it to whomever happens to circling around the renewal date of the domain.
dotsrc creates a safe landing ground for free and open source software projects made available via the internet, which doesn't suffer the same problem of short-lived identifiers. It provides a new future proof top level domain name that will not have any cost for upkeep for maintainers and developers of digital commons. Instead, the users and stakeholders directly bear the cost of the top level domain and all its registered domains as a whole through donations. In other words: a prepaid domain available as a public utility, with no financial friction for the contributors.