Submitting a review for consideration is easy; please first read Slashdot's book review guidelines. Updated: 2008114 by samzenpus
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.
malware (Score:5, Insightful)
Another great press release about how it will be helpful and a "service" for users, while the main purpose is just to gather extra advertisement revenue (while breaking internet standards). I mean, this is what malware do. Oh well, atleast these non-us ISP's dont do such dirty acts to their customers here. Time to voice your opinion maybe?
Re:malware (Score:5, Funny)
while breaking internet standards
What are those? The last RFC that I read was titled "How to make the largest pile of cash while providing the least amount of service". I think it's RFC666 and is the one that most modern day ISPs seem to operate under.....
Parent
Re:malware (Score:5, Funny)
I tried to find this RFC, but when i opened the page, it redirected me to some 404 search page for my ISP.
Parent
Re:malware (Score:4, Insightful)
Parent
Re:malware (Score:5, Informative)
In what way is this relevant to OpenDNS? They actually do the same dirty trick aswell. Just because they have "open" in their name doesn't mean they're great and everyone should use them. They run their DNS servers to make profit from non-existing domains and hell, they even redirect requests to google.com to their own servers.
Thankfully there are open dns servers that dont do such either, for example university in Gothenburg, Sweden: 129.16.1.53 and 129.16.2.53 and several others. Those that have the technical knowledge can also set up their own dns recursive dns servers on their linux box and use those directly (while it fetches the results from root servers)
Parent
Re:malware (Score:5, Informative)
Try looking at the entire service. So far as I have been able to tell, you can turn off every single one of their "features", giving you a simple, straightforward dns service.
And for those replying to you confused about the google thing - they don't
. What they do is provide a dns entry for www.google.com that points to their own servers. These servers proxy the real www.google.com to strip out some functionality that opendns found particularly offensive (I have not experienced the functionality, and can't say whether I agree or disagree with their views). However, like every other "feature" I've found at OpenDNS, you can turn this off. Yes, at first you couldn't. I stopped using OpenDNS for awhile. Now you can.
Parent
Re:What would this look like? (Score:5, Informative)
If you don't believe it, try the commands for yourself:
-=-=-=-=-
overmind% nslookup
Default Server: localhost
Address: 127.0.0.1
> set querytype=a
> www.google.com
Server: localhost
Address: 127.0.0.1
Non-authoritative answer:
Name: www.l.google.com
Addresses: 74.125.53.147, 74.125.53.104, 74.125.53.99, 74.125.53.103
Aliases: www.google.com
> server 208.67.220.220
Default Server: resolver2.opendns.com
Address: 208.67.220.220
> www.google.com
Server: resolver2.opendns.com
Address: 208.67.220.220
Non-authoritative answer:
Name: google.navigation.opendns.com
Addresses: 208.69.36.230, 208.69.36.231
Aliases: www.google.com
-=-=-=-
Talking to my local DNS server, www.google.com resolved to IP addresses in the 74.125.0.0/16 netblock, which is assigned to Google.
Talking to resolver2.opendns.com, www.google.com resolved to 208.69.36.230 and 208.69.36.231, which have no reverse information, but are in the 208.69.32.0/21 netblock which is assigned to OpenDNS.
Parent
Re:malware (Score:5, Interesting)
Just wanted to remind everybody that a few weeks ago, another slashdot article about comcast DNS hijacking appeared, and everybody wound up calling this specific blogger a liar.
What if before introducing mass trials, they randomly selected MAC IDs and did this in specific locations? Perhaps that blogger actually did break news.
But then, it wouldn't be the first time we trolled a legitimate story because its legitimacy was hard to validate at the time. :)
Also, this discredits Comcast's massive twitter efforts as ComcastBonnie so kindly made a slashdot account after seeing the twitter output from the article, and told us that the engineers promised no form of DNS hijacking was underway. Underway or not, it was certainly being planned, and coverups should not be appreciated.
Just my two cents
Parent
Re:malware (Score:5, Insightful)
modern corporate culture demands profit growth. not just continued profit, but growth of profits. how do you expect that to happen in a saturated market?
Parent
Re:malware (Score:5, Insightful)
Parent
Re:malware (Score:5, Informative)
Easy, through innovation and distinct added value. Shouldn't take a rocket scientist to figure it out but apparently it does. Recently, our ISP decided to offer a brand new service allowing you to double your bandwidth simply by adding another DSL line. Guess what, they are now the fastest growing ISP in Canada.
Schemes like DNS redirection are a scam and should be banned unless they contain no advertising or indirect revenue generation whatsoever.
Parent
Here We Go Again (Score:5, Informative)
Some may remember when VeriSign tried this back in 2003, where it also failed.
Oh yeah, way back in the day. But let us not forget Earthlink's [slashdot.org] attempt at this [slashdot.org] or Canadian Rogers Cable [slashdot.org] or Charter [slashdot.org] or NJ Cabelvision [slashdot.org] or ... I'm sure you could find no end to this stream of providers offering their customers something the customers simply do not want.
And I'm pretty certain most of those ended or resulted in customers bitching out the provider. Yet here we go again. Why? Well, that's simple: ad revenue.
Re:Here We Go Again (Score:5, Informative)
If I'm not mistaken (although I often am, sorry in advance) Cox has been doing this for months now, and nobody posted anything about that. If I 'typo' a URL at home, when connected via my (or my neighbor's) Cox cablemodem, I get a Verisign page indicating that www.whateveriswas.com is Under Construction.
Is this not muchly the same thing??
It pisses me off, but not enough to hunt down a better alternative.
Parent
Re:Here We Go Again (Score:5, Interesting)
I'd gladly post examples but I'm at work and my AirCard is at home at the moment.
I would gladly switch to another ISP, but I'm locked-in to a 2-year contract. Unless I can argue that their DNS hijacking violates the TOS, but I doubt it.
Parent
Re:Here We Go Again (Score:5, Informative)
No, you threaten to sue them for lost company profits caused by their DNS hijacking and interfering with your work routine, and that you can 100% prove it and have documented everything relevant. That'll get you out of your contract in a hurry.
I just used that to help a motor sports company out here in CA get out of their contract with Comcast.
Parent
Keep trying till you succeed (Score:5, Insightful)
When in doubt, keep trying. When rejected, keep trying. Enough people do this, it becomes the norm. Sad, but true.
Parent
Re:Here We Go Again (Score:5, Informative)
Parent
Who's providing a backdoor DNS service? (Score:5, Insightful)
Sounds like time to pick some semi-standard alternate port number and start setting up some alternate recursive DNS servers, something between alt.* and TOR.
Re:Who's providing a backdoor DNS service? (Score:4, Insightful)
Parent
Re:Who's providing a backdoor DNS service? (Score:5, Informative)
It's not like Comcast is going to be intercepting all DNS traffic and routing it through their spammy DNS servers.
Why not? As raddan posted above me, Sprint already did this with their aircard service. The huge majority of customers won't notice the difference since they don't know about alternative DNS servers.
Parent
Call it what it is (Score:5, Interesting)
Re:Call it what it is (Score:5, Interesting)
Parent
Re:Call it what it is (Score:5, Interesting)
Many people don't realize that there's TONS of traffic going to typo domains (whether registered or not). For instance, youtuve.com [youtuve.com] (notice the v instead of the b) got 358,751 visitors over the last 31 days. It redirects to another domain for cloaking purposes, but here is the traffic report [sedo.com]. This level of traffic provides the financial incentive to implement these DNS schemes.
By the way, there's a new, free typosquatting [aliasencore.com] scan tool at aliasencore.com. It shows you all the registered
Full disclosure: I am Graham MacRobie, the CEO of Alias Encore, Inc. We help companies recover cybersquatting domain names, but we focus solely on "slam-dunk" typosquatting cases (obviously only registered domain names). I can speak from personal experience in this field that the very last thing we need is wholesale typosquatting at the DNS level.
Parent
I just signed up the competition... (Score:5, Interesting)
AT&T doesn't touch my bandwidth. They don't cap it, they don't filter it - they aren't keeping a database of my URL lookups. That's worth a great deal to me - and Comcast will never get my business. I urge everyone else to do the same, even if it is some other DSL provider or dish provider.
Re:I just signed up the competition... (Score:5, Informative)
AT&T ... they aren't keeping a database of my URL lookups7.
Until the NSA asks [eff.org] them to. Let's not pretend that AT&T isn't evil.
Parent
A LOT of ISPs already do this... (Score:5, Informative)
I don't want to name names, but Netalyzr [berkeley.edu] showed that several major ISPs already do this, and allows you to check for yourself what the behavior is on your network.
Comcast is following the lead of other major ISPs which have been doing this for some time now.
Problems with this (Score:4, Interesting)
I speak from the perspective of being a RoadRunner user rather than a Comcast user, but RR implements a similar service. They have a link in the lower right of their results page where you can click to set your preferences and disable the "feature". Except just the other week that preference broke for me, and I was stuck with DNS hijacking. I phoned their customer service line, the person on the other end of the line had absolutely no idea what I was talking about.
DNS hijacking is a bit like Phorm without profiling really. Well, assuming there is no profiling. If there was profiling they'd make more money from the ads they'll inevitably insert there to "support" the service (Edit: oh look, they already have!). Personally I put this issue, along with Phorm in a whole category of problems related to the fact that we still don't secure and authenticate most of our activities on the internet (http, dns, yadayada). ISPs can do what they like and it's hard to stop them. Third-party DNS services seem to be the way to go recently. Of course without security/authentication your ISP can put a stop to that quite easily too.
This is all before you get in to the technical details of clients that may implement specific behavior for when bad DNS queries are expected to fail but don't.
Lots have failed, but some have succeeded (Score:5, Informative)
Bad assumption being made (Score:5, Interesting)
This is all done under the assumption that the DNS query is for an HTTP request.
What happens when other services run afoul of this setup?
For example: Is my POP client going to hand my login credentials to a Comcast server, if my email service's DNS does not resolve for some reason?
it can fail badly (Score:5, Interesting)
My ISP did it for a while. The problem was that it was badly implemented and increased to load on the upstream DNS services.
So if the middle layer DNS cache was empty and I asked for
mybank.com the bottom level DNS timed out and it failed over to the advertising page.
---
Think of searching on coke.com or any real address then the system failing and redirecting you to pepsi.com.
Think of the lawsuits. Think of the denial of service attacks possible
a) register not_mybank.com, have spoof of mybank.com page ready to launch
b) pay to have a fail on mybank.com route to not_mybank.com
c) denial of service attack to root servers for mybank.com, flip in your spoof page
d) have the ISP's magically send people to your spoof site from their saved URL's and collect passwords
Yeah this is a good idea.
Not the same at all. (Score:5, Interesting)
> Some may remember when VeriSign tried this back in 2003, where it also failed.
Not the same at all. VeriSign tried to do it with the TLD servers, which nobody can avoid. These guys are just doing it with their own servers, which you can bypass unless they block you. Even if they do you can, at least in theory, switch ISPs. They aren't likely to bother with blocking, though, because the number of people who will bypass is tiny.
What about non-HTTP? (Score:5, Interesting)
Also, this statement from Comcast's blog is blatantly false:
Normally you would *never* "sit and wait for the Web browser to time out" (well, these *are* Comcast's DNS servers after all, so in this specific case it might be true). Normally, your browser would get a DNS resolution failure and show you a built-in error page instantaneously. Now, on the other hand, you have to wait until your browser goes off and loads a page of Comcast ads.
Domain Helper my a$$!
Oblig. (Score:4, Funny)
Re:The Sky isn't faling. (Score:5, Interesting)
The sky isnt falling.
It is if you were foolish enough to believe that the RFC/protocol standards would be obeyed and wrote code that relies on a NXDOMAIN response to detect a bad hostname. Now you are going to an 'A' record that points to a Comcast server. This will break various applications but they don't give a damn because it's all about the ad revenue and who uses the internet for anything other than surfing anyway?
Parent
Re:The Sky isn't faling. (Score:5, Interesting)
This could easily be done in the browser in a non-evil way. When you type in a name and get a non-response, similar names typed after would be recorded. Then, when you make the same spelling error, gooogle.com, it takes you to where you want to go. Since it's in the browser, people could edit and share their commonly misspelled domain names.
Parent
Re:The Sky isn't faling. (Score:5, Insightful)
Providing a nice GUI on a DNS lookup fail is the job of the web browser not the DNS server. DNS is infrastructure not user interface.
Parent
Re:The Sky isn't faling. (Score:5, Informative)
It doesn't redirect you to a third-party site owned by the NSA; it redirects you to a third-party site, full stop. This not only breaks a whole host of applications relying on DNS to inform them that a domain name doesn't exist, but it is in violation of the standards that hold the Internet together.
Parent
Re:The Sky isn't faling. (Score:5, Insightful)
If a domain name does not exist, I want my systems to receive an error telling them so, not be redirected to a system that they were not expecting to be directed to.
Parent
Re:The Sky isn't faling. -- Actually yes (Score:5, Interesting)
This screws with "what is valid URL". Basically, now all URL are valid. So for example you want "coke.com" anyway you mistype that request: cole.com, Coce.com, koke.com, cooke.com and ... will be a valid URL, even if it does not exist.
Another way of looking at this is cybersquatting. They are taking the whole URL domain. So if you have a new URL, guess where it will not show up for a long while.
And third you can think of it as "DNS poisoning", since if you are running your own DNS, comcast will be suppling you fake information, with its own time out.
Parent
Re:The Sky isn't faling. (Score:5, Insightful)
If you think it's OK to hijack DNS think about what happens if you mistype an email address, or what happens when your configured NTP server goes offline.
Parent
Re:So should... (Score:5, Informative)
OpenDNS does exactly the same. (unless you register account and change it, but thats the case with this comcast thingie aswell)
Parent
Re:So should... (Score:5, Informative)
OpenDNS does the exact same thing. To avoid DNS highjacking if you use OpenDNS, you have to have an account with them, change your preferences and always be identifiable to OpenDNS so that it can apply your preferences. It's easier to opt out at Comcast than to opt out at OpenDNS. Besides, OpenDNS also redirects www.google.com to OpenDNS servers, not just nonexistent domains.
Parent
Re:So should... (Score:5, Informative)
Parent
Re:So should... (Score:5, Insightful)
No.
Knock this shit off and mods, wise the fuck up. Just because it has "open" in the name doesn't make it suddenly good and benevolent, They do the exact same fucking thing.
Anyone who's been on slashdot for more than a week or two probably has seen dozens of comments suggesting OpenDNS in cases like this, always modded up. Every single time people post corrections pointing out that they do the same thing. Does anyone ever listen?
Wise the fuck up
Parent
Re:So should... (Score:5, Informative)
Why do these OpenDNS posts keep getting modded up? OpenDNS utilizes the very practices this article bemoans! If you query a domain that does not exist, your browser is redirected to OpenDNS's ad-laden spam site.
Despite their claims to the contrary, OpenDNS's servers are likely farther away from you than your local ISP's. They also keep permanent logs of all queries, which could be subpoenaed by a government entity. Their joke of a privacy policy allows them to sell your logs to "Affiliated Businesses", which pretty much means anybody. Not that it really matters - they could amend their privacy policy tomorrow morning and be selling your info by the afternoon.
I think many people read the "Open" part of the OpenDNS name and turn their brains off.
Parent
Re:So should... (Score:4, Funny)
Are you kidding, or do you work for OpenDNS?
Because I switched to OpenDNS because of people (you?) mentioning it here on Slashdot.
And then I noticed, that OpenDNS also does DNS redirection!
Parent
Re:So should... (Score:4, Informative)
Parent
Re:So should... (Score:5, Informative)
Except for the bit where Comcast users not using Comcast DNS servers are unaffected, as per TFS.
Unless you're complaining that they could, in theory, redirect port 53. Frankly, anyone remotely familiar with how the Internet works should know that your ISP *could* completely and arbitrarily control any nonauthenticated protocol, including DNS.
Parent
Re:Best DNS alternative w/o redirection? (Score:5, Informative)
I use Level3's anycast dns resolvers. They are fast and work great. Pair them with a local dns cache and you'll be golden.
4.2.2.1, 4.2.2.2, 4.2.2.3, 4.2.2.4, 4.2.2.5, 4.2.2.6
In case you don't know about anycast.
http://en.wikipedia.org/wiki/Anycast [wikipedia.org]
Parent
Re:I'm done. I'll be switching as soon as possible (Score:5, Insightful)
Me too.
Oh wait, Comcast doesn't have any competition for high-speed where I live.
Go go gadget free market!
Parent