Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Patents

Wildcard DNS, Session Management And Prior Art 177

Posted by Cliff from the interesting-idea-bad-patent dept.
Alowishus asks: "A company called sevenval has an interesting, but obvious, use of Wildcard A-Records in the DNS to encode Web session management IDs in the hostname of the site. Interesting, because if you are using relative URLs on your site, you do not need to do anything (i.e. setting a cookie or appending GET parameters) after the initial redirect to maintain a user session. See www.fahrschulportal.de for an example. Sevenval is applying for a patent on this technique, and Kristian Kohntopp, the author of a PHP session management library, is looking for prior art. He would like to find uses of hostnames that encode state or session information. Has anyone seen this before? It's an exceptionally useful technique, and I'd hate to see its use restricted by another improper software patent. "
This discussion has been archived. No new comments can be posted.

Wildcard DNS, Session Management And Prior Art More

Wildcard DNS, Session Management And Prior Art

Comments Filter:
  • I'm wondering how the search engines treat this. Will they traverse the pages even though they have a different hostname? And if so, each page could be spidered across an infinite number of times, making a really bad recursive puzzle for a spider. (Either a lot of pages will be double cached, or a lot of pages will be missed because it gives up, or both.)

    Is this a search engine advantage or disadvantage?

    BTW... I do like the idea of wildcard DNS hostnames, oddly enough. If there is no prior art, hats off to this guy.

  • Good thing (Score:1)

    by Anonymous Coward
    It might be a good thing if thei really got their patent. Then other sites could not just use this technique and our caches will be kept clean.

  • Now aren't session vars in URLs prior art? (Score:1)

    by Anonymous Coward
    The usual session tracking does exactly the same: include a session identifier anywhere in the URL. Is it really a new idea just because 7val includes the session identifier at the beginning of the URL?

    I think not! The fact that you have to use a wildcard DNS entry and some scripts to rediscover the session identifier in this part of the URL doesn't make it patentable, IMHO.

    Just compare:
    http://12345.myhost.com/blah.htm
    http://www.myhost.com/12345/blah.htm
    http://www.myhost.com/blah.htm?s=12345
    http://www.myhost.com/blah.cgi/12345

    I don't see the big difference...

  • Re:unpoison (not depoison) (Score:1)

    by Anonymous Coward
    this is Tom, so let's try to clarify some of my points: in general, yes I am picky about standards and abusing things. I'm not a friend of inventing your own stuff on top of standards, and while netscape's HTML add-on aren't that bad, don't forget about stuff like layers (anyone using them?) or M$'s marquee tag. states on HTTP: there is a fundamental difference between cookies and Location Poisoning. cookies reside on my machine and get served through my webbrowser - they are under MY control (it doesn't count that the user might be too stupid to use that control). cookies also get actively read on the server - some cgi, PHP3 or whatever must evaluate them, so the programmer IS ALSO in control. Location Poisoning removes control from both programmer and customer. which means that neither has the option to DISABLE it.
  • As soon as you go to amazon.com, you're redirected to a URL with a unique cookie ebmedded in that URL (why muck with DNS?). This lets amazon keep track of stuff in your cart ***WITHOUT*** requiring cookies to be enabled. Other sites cannot fetch these "quasi-cookies" back since they no longer exist once you leave amazon (save maybe the 1st site from the referer URL, but not the 2nd, 3rd, nth sites down the line). IMO, this is the RIGHT way to do things that has traditionally required cookies (the minimalist solutions are beautiful). WHY CAN'T OTHER WEB STORES DO THIS including fatbrain (revered on slashdot), dvdexpress, etc. I HATE COOKIES. And I have not shopped at web sites that require them unless they're waaay cheaper than amazon (Hint, hint, retailers). There is really very little that absolutely requires cookies to accomplish, and with the potential for tracking abuses and use for evil, they are best left disabled. And the amazon style cookies can even be bookmarked thus saving data between visits on *their* side of the connection. Name me one useful thing that can't be done without cookies.
  • is DEADBEEF.ipt.aol.com.

    - A.P.
    --


    "One World, one Web, one Program" - Microsoft promotional ad

  • there actually is a difference.

    the last two require that you change your links. the second might be accomplished with some nifty rewriting and might work very much like the first (7val) without the DNS trouble. it'll still break caching.

  • Personally, I think the unpoison guy is a little paranoid. He does make some valid points about DNS issues and non-cacheability, however; I tested this exact same idea about a year ago (3453453454.suchandsuch.com) and probably a bunch of other people did too, but abandoned it for various reasons, including those above.

    There are ways to do this using mod_rewrite, and they're probably better for ya in the long run.

    I don't think it's unique enough an idea to support a patent, especially considering the way in which it is implemented: a wildcard DNS. _That_ has a lot of prior art.
  • Hithere!

    This is really OLD stuff.
    I put the calculator in the URL up along with rfc-in-a-url, clock-in-a-URL, and my calculator-in-a-URL up in 1998!

    DYNAMIC URL:S ARE AS OLD AS SLICED BREAD.
    A patent of this would be as silly as trying to patent dynamic content in the webpages or decimal URL:s (http://195.3565592/ [195.3565592]). My site is more than 1 year of prior art.

    /Magnus Bodin - owner of x42.com, calculator-in-a-URL, etc.
    http://x42.com/ [x42.com]
  • It works in any netscape browser 2.04+

    BUT: Some proxies, firewalls etc block WIERD chars in urls, like $, and paretheses.

    /magnus
  • Patent laws need to be fixed, but that doesn't mean all patents are bad.

    But all patents are bad! Copyrights protect specific expressions of an idea, and that's a good thing. Patents protect an idea itself, and this takes the idea of intellectual property way too far. Nobody should own an idea, at best you should own your expression of it. I do not believe there is such thing as a proper use of patent law -- the idea is flawed to begin with. Software patents are not a special case, requiring patent law to be fixed. They simply make more glaringly obvious the flaws that have always existed in patent law. It's a bad idea from the start. It shouldn't be fixed, it should be dropped...

    --

  • > He does make some valid points about DNS issues and non-cacheability

    Actually, intelligent site design gets around the cachability aspect; simply refer all your images (or other multimedia content, such as audio or video) to the master host by explicit URL references. Or, better yet, send all "large data" requests to a separate hostname entirely, which you could then optionally build out as a distributed file-serving cluster to handle increasing demand over time.

  • This may not entirely be in the same cathegory, but just to show some usage of *.domain.tld:

    Inspired by a "useless trick of the year"-page, which gave the possibiliy of making matemathical calculations only using the hostname, I got inspired for about a year ago to make my own utilities.

    My domain is trc.dk (a danish roleplaying club; nevermind that :-) - and I've made the following possibilities, using a *.trc.dk-record, and some PHP to react on the HTTP_HOST-env-variable:

    http://something.a.trc.dk/
    Perform a search for "something" in AltaVista

    http://something.b.trc.dk/
    Perform a search for "something" in AltaVista (text-only)

    http://something.g.trc.dk/
    Perform a search for "something" in Google

    http://something.l.trc.dk/
    Perform a search for "something" in Google, using the "I Feel Lucky-feature"

    http://something.i.trc.dk/
    Perform a search for a movie named "something" in IMDb (Internet Movie Database)

    http://something.j.trc.dk/
    Perform a search for "something" in Jubii (danish search-engine)

    http://someone.k.trc.dk/
    Perform a lookup for the name "someone" in a edition of the danish "White Pages"

    http://slashdot.org.s.trc.dk/
    Perform a check of what webserver, "slashdot.org" is running.

    http://slashdot.org.q.trc.dk/
    Perform a HTTP-query for "slashdot.org"

    These "tools" have been a great aid, and saved a lot of time. There really isn't any reason first going to the Altavista/Google/IMDb-frontpage, just to submit some data. Then rather go to the result-page.

    Oh yeah, I like bookmarklets too :-)
  • We did something like this for Developbusiness.com. So you can type in http://slashdot.developbusiness.com and get redirected to an intranet of the company "slashdot". I wrote some code that would tear apart the url that the client said it was comming from, and set a cookie of the company name "slashdot" on the browser, and do a header redirect, point the client to the real url "http://developbusiness.com". I thought it was pretty ingenious myself at the time, since you only stay at the fake url for a bit, you don't encounter many "Location poisoning" Since then, we have heard of intranets.com doing a similiar thing, although I never really researched much what they were doing, since I was only a programmer, not someone bent on stealing technology of the competition... :) Unfortunately due to situations way beyond my control, developbusiness.com was shut down by the owners. (they just contracted us out to design and program the site) Oh well things like that happen, and I worked my ass off on that site too, along with only one other programmer and one designer.

    I think you can still take a look at a demo copy of it in our portfolio. Located on http://STEEM.COM [steem.com]. Check out... it's a beautiful page that unfortunately I had nothing to do with designing. :)

    ---

  • When it comes to patents, someone's always getting knifed in the back or forked over.
  • This seems to bring up another interesting point. Although we should be upset that a patent is being filed for this obvious yet stupid idea, we shouldn't make such a big deal out of this particular thing because the idea itself is stupid! C'mon now, how many serious sites out there would actually use such a thing? And how many non-serious sites out there actually have their own DNS server?

    --

  • Sorry to turn this into an ASP vs. Java thing, but it is sort of on topic, right?

    Sites that run on NT and ASP can't do this simply because ASP's built-in session management requires that cookies be enabled. If they aren't, it will just stick you inside of a redirecting loop. The redirecting loop is easily fixed with a "please enable cookies" message. Anything beyond that... well...

    Naturally, there are ways around this, but they require elaborate hacks, generating every link on your page yourself, and so on. In other words, rewriting the session management on your own. You cannot manually retrieve or switch sessions.

    Java, on the other hand, allows you to create a session object by just knowing the session ID. It also has automatic URL rewriting, that can be always, never, or no-cookies-only enabled. And you also have full control over this, so you can tweak it as needed.

    I definitely agree with you about the cookie-only sites. I understand that there are many good uses for cookies, but I like to choose whether I want the site to store cookies on my computer, not the other way around. I just run a proxy that blocks all cookies on all sites except for the ones I specify. If a site requires cookies to browse, I usually leave and don't come back.

    --

  • The DNS records you posted map _any_ host onto the address 195.122.187.3, using the * wildcard DNS record, whether or not the hostname was generated by their server. It's actually quite trivial to set up a CGI/PHP/ASP/whatever script to redirect you to a randomly generated hostname
    --
  • Umm... for $500 you can get a certificate from Thawte that is *.yourname.dom, which would work fine. Or, you can be your own CA and do the same.
  • [sigh] I KNEW I should have previewed first!

    There's a web site http://www.lemuria.org/Software/unpoison [lemuria.org] that calls this technique "URL Poisoning" and mentions that this could be considered a Bad Thing, because using this technique, people cannot easily "opt out" from being profiled, as you can by, say, disabling cookies in your browser.

    Refer to the above link for an explanation of URL Poisoning, and for a pointer to a Squid redirector plugin that can be used to disable URL poisoning.

    I personally don't have any opinion on this; I can see how it can be used, as well as how it could be abused. [shrug]
    --
  • They have a product called Manila which is a Web authoring tool. I don't know much about it, but you can set up your ????.registereddomain.com using the software to create a new web site. While it is not the same as what this situation is, there may be enough prior art involved to not allow this patent.

    An example of this product in practice is at: http://www.editthispage.com/ [editthispage.com]

  • I have email an describing GoTo.com's ability to encode the serch terms in the wildcard part of the domainname. eg: http://linux.docs.goto.com/ [goto.com] or http://gnu.goto.com/ [goto.com] My email is dated 2/17/99 and they must have had that feature sometime before then.

    IANAL but I think this could be considered very similar and Goto.com has a bunch of money (I think) and maybe if they were made aware they would want to fight it.

    I'd be happy to provide my email but I doubt a dated email from someone's sent folder is proof of prior art in the laws eye.

    Citrix
  • http://www2.merton.ox.ac.uk/~security/bugtraq-1998 04/0085.html

    There is a Bugtraq posting in 1998 where Oskar Pearson describes a way of tunneling through a Firewall ** by encoding data into DNS-Names ** (and Replies).

    I think this could be considerd as a "superset" of the sevenval.de idea.

    bye..adrian

  • I did this in 1996 when I was building a shopping cart for collecting tax forms. It didn't work very well because it messed up DNS, foobarred my test proxy server, and confused the firewall. I wish I had some evidence of the prior art, but it was actually a stupid idea and would have prevented my site from achieving the performance levels it did, so I did the thing that seemed right at the time and abandoned it.
  • Hmm, this isn't very useful, but amusing for the first few minutes.
    You can change the characters in that semingly random bunch of chars that they use, such as
    http://X199DAASOFTWARE84PATENTS71CBLOW3E.sevenva l.com/
    *grins*
    As long as it remains the same length, you can replace mostly of the garbage with words..
    Enjoy.
  • I agree with RMGiroux:

    • dynamic content doesn't get cached by proxies, but images present in dynamic pages get very well cached. With location poisoning, this caching is not possible. So caching matters!
    • HTTP and DNS are protocols, while HTML is a language. There are standards and standards.
    • Abusing of the DNS protocol is like using the <B>-tag to do italics (it can be done with style-sheets), while adding a new <BLINK>-tag is in no way an abuse of standards (BLINK was not defined previously for other purposes).
    Oh, you're using your mouse with your toes... now I understand the whole 'feel free to flame'. I didn't see this post marked as 'funny'. Hey, moderators, moderate this as funny!
  • ok better now.
  • The SSL site cert problem is real, but to play devil's advocate, it's easy enough to forward the user back to the main domain when it comes time for the secure transaction, as this is the way most third-party small business ecommerce providers work (e.g. have the user browse your-id-here.domain.com, but have the billing done on sales.domain.com).

    (But if you do this, then you still end up needing to use some traditional state mechanisms to pass around on the billing server. Oh well.)
  • > So what if I use this for dynamic content? In that case, caching doesn't matter anyway.

    Speeching as a cache admin for a large(ish) ISP, most dynamic content isn't *that* dynamic. Even if the page has user specific entries on it, the images are probably cachable - think slashdot, I (probably) have my preferences on what slashboxs I get set as different from yours, however the icons for story sections can (and should) be cached as those won't be dynamic.

    As for the 404 error for footfetish.com, well if you haven't paid then you're not going to get access - so permission denied is kind of appropriate ...
  • Thawte's search function is down right now, but i distinctly remember reading in one of their docs about several web client/server combinations that had problems handling wildcard certificates. And no e-commerce vendor wants to limit their audience.
  • Of course you forgot one other method:

    http://www.myshop.com:625/some/file.html

    I wouldn't be too surprised if someone would get a patent on this _unguessable_ way to store a session identifier into the URL.

    It is indeed very much the same to fetch the session id from the URL, regardingless where it's located. And making a redirect to such an URL in case no session id is present, is also no rocket science. All this will be less than 10 lines of code.

    The DNS method combines two advantages: You don't need to produce relative links, and you don't have to rely on cookies.

    But I don't think that it's worth a patent, it's really obvious. And if anything that is not too complicated would be patented, we would need even more lawyers than we already have.

    I hereby claim the patent on putting beer into the fridge.

    Kai

  • It is possible that users of lbnamed [stanford.edu], the Perl DNS server, have done things like this for assorted reasons. Particularly as it's a little easier to modify lbnamed to do odd pattern things than it is to modify bind. I know that I considered this same DNS poisoning technology a year ago (as an SSL obfuscated verification trick...a hidden tripwire) but didn't need it yet.
  • In the LISA '95 lbnamed presentation [usenix.org] there is an example of using DNS to pass parameters to a program.

    See where "random.stanford.edu" is shown, where "100.random.stanford.edu" will return a TXT entry with a random number in a 100-number range, and "10.random.stanford.edu" will use only a 10-number range. There's also a "passwd.ns.stanford.edu" example which mentions a database.

    This example is not attached to HTML, but it does show that the concept of using DNS to give information to a server was published in 1995.

  • This would lead to extremely user-unfriendly domain names

    agreed, but no more than session tracking done through URLS like this :
    "http://slashdot.org/comments.pl?sid=00/03/05/23 45247&op=Reply&threshold=3&commentsort=3&m ode=thread&pid=50"

    and surely it would really bugger up users trying to bookmark the site (stale sessions could stay in bookmarks for a LONG time).

    No. If the session id expires then just assign them a new one on reconnect and if they try to access any previous session information let them know it has expired. Same as it works now. But it works if people have cookies turned off.

    Personally I think it's a great idea. If it was obvious, how come no one used it before? This falls into the area I would think is patentable.
  • he bad thing about how this company does it is you have no way to shut it off. With cookies, you do. That makes me sad.

    I suspect that it shouldn't be too hard to add the ability to "unpoison" URLs to the Internet JunkBuster. The author of Unpoison himself suggests that it should be rewritten in C or some other non-interpreted language for performance reasons.
  • It is exceedingly obvious. The reason we arent using this sort of technology in our web browsers is it _stinks_, for various reasons mentioned.
  • This is such a bad tecnology that only the really clueless will buy it.

    And yet, Microsoft thrives.

    Flamebait aside, companies have nothing to lose by implementing this. The customers and people who connect to them are screwed, but for many companies, the extra information gleaned about customers may be a worthwhile exchange for the extra technical hassle.

  • Patent application:
    Title: Use of wildcard DNS records to generate high server usage charts

    Description:
    for i = 1 to 100,000,000,000
    launch_netcraft_test(www$i.myserver.com)
    next

    Desired result:
    next month's news...
    "Server X showed a 98% increase in usage in web sites globally, driven mostly by a large number of new sites in the myserver.com domain."

    --
  • Does anyone here know of prior art in the use of Ethernet frame pacing? Someone is trying to patent that technique, but it seems pretty obvious also. I seem to recall that Cisco routers have a setting for Ethernet pacing.
  • i dont't think this technique is so much useful, at least for site visitors. dynamic generation of hostnames (if used blindly) will drag your TCP_HIT rate hell down. i believe that even load-balancing via www?.domain.com is a bad idea, and much better way to handle it is multiple ip's assigned to single fqdn.
  • i'd love to, but I can't get to their help pages- their using that urlcalc stuff.
  • DNS is several many years old (at least by internet age) This has been available to anyone who's wanted to use it. Obviously the creator of the DNS spec thought of a similar situation. What these people are doing, in my opinion is discovering that you can "fix" a computer with a hammer, and patenting that.
  • i'm using NS4.7... This isn't working for me. Any tips?

  • While you can reduce the overall poisioning of the net that this technique causes by serving images from a non-poisoned host, the fact is that if I run a large proxy server, and a lot of people visit sites using this technique, that site is going to cost me a huge amount of money in forced hardware upgrades, because every session is taking up a host space in my proxy cache. Plus, there's the extra DNS traffic, which isn't much, but overall, location poisoning SUCKS [fuckingsucks.net]

    Personally, I would set up all proxies to deny a site using this technique.

    Maybe, it's obvious, maybe it isn't, but Sevenval SUCKS!!! [fuckingsucks.net]. If there's one thing that the recent Doubleclick nonsense shows, it's that the general public will only stand for getting the shaft on privacy issues for so long. And the location poisoning technique is too obvious, so people will raise a stink.

    It's one thing to patent a sucky technique, but since the technique sucks too much to have real commercial value, you can just let this thing die on it's own, sucking for air.

  • It's sort of like patenting the use of teeth to open beers. Everyone's thought of it but nobody actually does it for obvious reasons.
  • And that site also contains the true reason [fuckingsucks.net] why they shouldn't get this patent...

    -
    We cannot reason ourselves out of our basic irrationality. All we can do is learn the art of being irrational in a reasonable way.
  • RFC1034 suggests labels of the form:

    &lt label&gt ::= &lt letter&gt [ [ &lt ldh-str&gt ] &lt let-dig&gt ]

    ie a name starting with a letter. This is to prevent problems with older software (eg MTA's). It's not a hard requirement.

    There's also some "prior art" e.g. 3com.com.
  • Chuckle.

    You'll probably find your browser ate a couple of angle brackets in the perl statement. It should read:

    perl -e 'while(&lt&gt){print pack("H32",$_)}'
  • Check out the CERN server notes/newsgroups/docs back in last quarter of 1993.

    Before some of us started hacking the server there was no context but the ip numbers. If I remember right it took a seperate server per ip number and at that time that did mean a seperate interface.

    Talk to the people who did the early virtual IP addresses as this was discussesed.

    Too bad deja* isn't that old. (why does it have all my '95 postings but not all the '96 or current postings? and aparently broken html on the new(TM) power search)

  • I doubt if thi is prior art, since it does not track you during your session.

    So it's neat, but only for geeks. Whereas the patent app. is neat, but only for 'expletive-deleted' marketeers.



    EZ
    -'Press Ctrl-Alt-Del to log in..'
  • two things that haven't been mentioned so far:

    the whole Location Poisoning scheme is a mighty tracking system. since your ID stays the same among various sites, they can cooperate and pool the data you entered. your address here, your buying habbits there, a questionaire over there and the words you entered in that search engine - doubleclick was nothing, they only get the sites you visit, not what you enter there.

    7val claims that they'll require customers to sign a contract that they won't do that. which to me has the base purpose of removing *7val* from responsibility. this SCREAMS abuse. I bet it will be used for profiling as described above.

    now since (2nd thing not mentioned) 7val is in germany and applying for european patent, the EUROPEAN patent law applies, NOT the US which has been quoted here. in european patent law, patents can be refused if they are overtly abusive. for example, you couldn't patent something if it's only use is illegal. since Location Poisoning begs to be abused, and the "advantage" of following visitors even when they leave your site is one of its strong marketing points, I do believe a point can be made for the patent to be abusive in nature.
  • I doubt if thi is prior art, since it does not track you during your session.
    7val's patent isn't about pure session tracking either, as that's been around for ages. Their system is different because it uses the hostname to store the session identifier. The only claim on innovation that they have is using the hostname to store data for their program, which the urlcalc site also does.
  • The author knew that this was an important breakrhrough. From the results page:
    This is a demonstration of having a dynamic subdomain to be the input of a program on the web. What this also demonstrates is that you really can send weird stuff on the url even in a subdomain name. (Note: There's no cgi-param-passing-here or path-info.)

    It's a demonstration of technology this broad: dynamic subdomain being the input of a program. Well, that's exactly what 7val is doing. So what if the program does something specific - it's still a web program that "tracks sessions" instead of a web program that "does math". Web programs that "track sessions" are nothing new. The only new part is the dynamic subdomain, for which there is prior art.

    The author of the domain math software was aware of other potential uses for this ground breaking technology, clear from his description in italics above, and only used the calculator example to demonstrate that it could be the input to any program. Ergo prior art.

    QED!

  • I think you need to work on your deductive reasoning skills. An image that lampoons frivolous patents does not by extension lampoon all patents as frivolous.
  • Comment removed based on user account deletion

  • Brilliant point. Forgot about this.

    What these i... are claiming is to "revolutionize web commerce". What are they talking about? What commerce without sertificates and encryption? Relying on HTTP-Referrer which is supplied by the browser so any kid can fake it maybe?

    If this gets enough publicity they are not getting any money. Which is good (TM).

  • Good points, good article. I'm not sure I agree with all of the points it raises, though.

    The author states that "Location Poisoning disables proxy servers, DNS caching and other mechanisms that reduce the amount of net traffic." This is true, but the situation isn't as dire as you might think at first blush. Without having any numbers to back up my claim, I'm going to assert that in the average web transaction (from DNS lookup to the last request fulfillment on a single page), transmission of images takes up the vast majority of the bandwidth used. If the page author serves images from a central location (<img src="http://images.etcetra.org/blah.gif">) they'll still be cached normally by web proxies. So, it's bad, but it can be mitigated somewhat by clever design.

    On the other hand, I detest what this does to bookmarks. Bleah.

    In the end, I don't see this technology as having much value, even if you strip out all the negatives. Even if you don't have to screw around with passing cookies or GET args as session identifiers, you still need to change state in your database for any reasonably useful application (read: shopping cart). If you can set something like that up, then there's no reason you couldn't have set up some other, less objectionable form of session management.
  • If anyone has info on this tech that doesn't require me to brush up on my long forgotten knowledge of German I'd love to see it. Hell, I'd like to see any info that WAS in German. Sevenval's news page appears to only contain the word news repeated several times with some plus signs thrown in for variety.
    --Shoeboy
  • How about we all make sites that use this technology? And set our copyright dates to last year as well. Then we can prove that this is prior art (but faking prior may be illegal though, not too sure about that)

    Actually maybe I can change GPLTrans to use this...something like http://helloworld.english2spanish.translator.cx/

    or maybe http://www.yahoo.com.english2spanish.translator.cx /Computers_and_Internet

    (note those URL's do not work in reality)
  • Actually, its worse than that, it searches for the first instance of really heh. OOPS. maybe i should fix it.

    First one to send me php code to split into a string array wins... well... hrm. nothing.
  • Regardless of my stance on patent issues, this goes contrary to what the internet is about.
    IF this kind of attitude was used in previous years, we would be nowhere right now. The Internet would not have happened.

    Nobody patented the use of putting stateful information in the path portion of a URL, why should they be able to do it in the host portion?

    NO PATENTS! PATENTS should be for REAL RESEARCH, that costs REAL DOLLARS.

    One could argue that this is no different than a web server differentiating between virtual websites based on the hostname. The 'state' that is stored in the hostname is the one that determines which site is being visited, (as opposed to a simple IP lookup). This is not something patentable, and should not be patented.
  • I'm not quite sure how broadly or narrow you need to interpret the word "state". I know that contorting the URI to do wierd things is not unusual. In a PhD a long time ago I used a combination of techniques to effectively pass commands encoded within the URI to an interactive state engine embedded within a simple web server (experiments in doing simulation on demand on a multiprocessor). The use of altering the DNS has a couple of tradeoffs though, it involves a layer outside the HTTP server-server level but it is faster as one step in the parsing is removed. Thus some portability is sacrificed for performance which in the overall scheme of things I'm not sure is superior because a lot of the lower level network will get hardwired (eventually) into network boxes which is permanent infrastructure whereas you want to have flexibility in modifying the interactions. Sorta the difference between ripping out a wall and repainting the wallpaper.

    The internet pace does have a disadvantage in that it is impossible to weed out *bad* or useless ideas out of the volume generated every day. How many inventions actually become a commercial success? Building a better mousetrap does not always equate to getting rid of more mice.

    LL
  • If you go to 7val.com [7val.com] it works -- but it shouldn't! IIRC, domain names must start with an alpha character (I don't remember which RFC this is in though.).

  • Can we replace the icon for Patents? Or at least have another icon for the more legitimate (or patents under scruntiny?)

    I understand it's all in the name of humor (and the icon is indeed very funny), but I also think that the icon unconsciously biases any posters or readers to think of any patent to be trivial, or frivolous.

    Patent laws need to be fixed, but that doesn't mean all patents are bad. If I had a patent on some groundbreaking device, I would hate to get the attention of Slashdot, who would pigeonhole my creation with an icon of patenting knifes and forks.

  • You need to work on your reading skills. I did NOT say the image infers that all patents are frivolous, but that the image subconsciously affect's someone's opinion since they see the image.
  • akamai does something simmilar with thier image caching ... check out yahoo's front page and the images on it.
  • No, 7val.com is correct. This is a common misconception, and indeed many DNS servers follow this misconception. (i.e. if you choose a name starting with a digit, some DNS servers will not be able to resolve the name).

    Goto Network Solutions [networksolutions.com] and attempt to register any name starting with a digit. Indeed, the name could be completely digits (i.e. 411.com). However, try to begin a name with a dash; you'll see it doesn't work.

  • Two years ago, when developing a beta version of a product, I put a feature whereby the product would encode the IP and user name in a DNS request and did a lookup on it. (The beta did have splash screen clearly stating the product would contact our website).

    I still have the source code for the little DNS server I wrote that received and decoded that traffic back into its consitituent components. I'll sign an affidavit if need be.

    BTW, as a hacker, I've already found several ways of breaking this scheme after a few moments of trying. (Heck, one of the flaws I already solved in my implementation mentioned above; stupid of them). Therefore, you can attack the patent. Their implementation is still rough, so simply find flaws in it and patent the solutions ($500). When they fix their implementation, sue 'em.

  • Damn (Score:2)

    by PhiRatE ( 39645 )
    I came up with that as a solution to our load balancing issues over a year ago, unfortunately our network architecture didn't really support the concept.

    However on this basis I note that it must be "obvious", certainly it never occured to me that others might not have thought of it. Unfortunately this isn't enough I guess, and I never implemented anything to test the idea, so..no prior art from me. Sorry :/

  • How do you know it's not obvious, Andrew Cady?

    RYan
  • If I understand your request, then you might want to check www.href.com.

    They make a server side web development toolkit for Delphi developers, that uses state management, wild card ids, no cookies, and supports server clustering (among their own app servers). They have been doing this since Delphi 2 as far as I can tell. They are not the only either, but I can't remember the names of the other companies doing this.
  • I KNOW that I saw a page somehwere describing how to do something almost identical in Apache for PHPLIB (the package the Kristian excellently maintains, btw). Alas, I cannot find the URL now, but if someone could post it, that would be great.

    I think it used mod_rewrite, but I could be mistaken.

    Eric

    Want to work at Transmeta? Hedgefund.net? Priceline?

  • *Not* a troll, but this looks like prior art, too... http://slashdot.really.fuckingsucks.net/ [fuckingsucks.net]

  • Abused tracking is, of course, but this is such a clumsy method that it is not likely to spread.

    Indeed, I'm not too concerned about this being patented since the URL http://bgfv3wz0.software-patents-are-bad.com/ has no obvious advantage over http://www.software-patents-are-bad.com/bgfv3wz0/.

    A few weeks ago I was on a talker (toth.org.uk) discussing ways of storing client information, and someone suggested "storing a session ID at the start of the URL", meaning the second URL above. We, of course, joked that he had meant at the start of the domain name and that could be done using DNS wildcards but - ho! ho! ho! - what a damned stupid idea that would be.

    Not exactly prior art since it wasn't that long ago and in any case toth doesn't log, but still that makes it obvious in my book. Same problem as ever though: what's "obvious" to a bunch of web developers who read RFCs is not generally "obvious" to bunch of patent clerks who read the National Enquirer.


    --
    This comment was brought to you by And Clover.
  • I think that the above examples of using the hostname to encode search strings, or parameters to a function, should be good enough for prior art, this really is a good idea. It's not (only) about customer tracking as in shopping carts. From the web page:

    ...bietet eine absolut neue Möglichkeit des Customer-Trackings, die unkompliziert auf einem Webserver zu installieren ist und für den Benutzer kein Sicherheitsrisiko darstellt, wie z.B. ein Cookie. Jedem Besucher einer Website wird bei der Anfrage der Webseite ein eigener (virtueller) Webserver zugeteilt: www.ID-Nummer.Domain.de und gleichzeitig ein Hostname vergeben.

    "...offers an absolutely new possibility in customer tracking, that is simple to install on the webserver, and poses no security risk to the user, like, e.g. a cookie. Every visitor will be assigned their own personal hostname upon visiting the page."

    I don't see this as a being for the purpose of knowing who you are dealing with when you are actually serving the pages (allthough no doubt it could be used for that), but rather that you can make this change to your webserver, and then you have a very simple method of looking at what individual users did from your log files. For example, how many pages does the average user visit? It would require a lot of overhead in cookies and stuff while the user is doing the reading to be able to tell that. Add sevenval's software, and you just have to change the places where the user enters, then you can more easily analyse your log files.

    I didn't read the whole page because my german sucks, so maybe this is just a side point, but it seems like it would be a cool ability to have.

    --Kevin
  • Try: dig @138.195.138.195 goret.org. axfr | grep '^c..\..*A' | sort | cut -b5-36 | perl -e 'while(){print pack("H32",$_)}' | gzip -d That's the neatest hack I have seen in a long time! (I won't explain it as half the fun is figuring it out!)
  • Well no cause for alarm IMHO

    This is such a bad tecnology that only the really clueless will buy it. Anyone tried editing the "server name" string? No problem. Oops I'm suddenly a different customer in 7val's eyes.

    Session tracking is not evil by itself. Abused tracking is, of course, but this is such a clumsy method that it is not likely to spread.

  • what if nobody had invented an answering machine before? ...it's still just 3 things stuck together

    The distinction I would draw is whether the 3 things stuck together are doing something new or not: the ball in the mouse is just a ball, but it's doing a very un-ball-like thing (ok, sometimes I drag'em across the desk, but... ha ha) So, is an answering machine patentable? maybe a little piece having to do with answering the phone with a switch, maybe some of the "algorithms" (mechanical or otherwise) for juggling the tape... but I would pretty much think that once tape recording is invented, it's obvious that it can tape phone calls.

    I realize I'm talking about a fuzzy standard, but I'm just moving the fuzzy line that will always exist. Here's how I think of obviousness: I don't think the idea "phone answering machine" is patentable on it's own (and I think the patent office agrees). So, if you as an engineer are given the task "build phone answering machine" and you think "tape recorder" and anyone would think "tape recorder", well that's obvious. If I tell you "the UI has too many clicks to buy a book" and you show me how you'd do one click using cookies, it's hard to imagine that how you did it would be anything but obvious. The idea is not patentable.

    This wildcard DNS seems more clever than one-click ordering, but really only because it's weirder. The feature was sitting there, and the multihosting webservers are just sitting there. Here's one for you: let's patent one-click ordering using wildcard DNS! You see, all the technologies exist but we'd be combining them in a novel way, using no cookies! We could even use it for an affiliate bookstore program!

    There's some similarity between engineers piecing together parts to build things and lawyers building their cases. They don't allow patents on novel legal defenses. Unfortunately, they seem to hold sway over the rest of us and they are as a rule stupider than engineers and they don't give us the same protection for our toolboxes that they give themselves. Oh, IANAL.

  • I share many of the sensibilities about intellectual property that you lay out, but I'm not sure if I draw the same conclusion. In the Amazon discussion someone pointed out the cotton gin as an example of "patentable, but obvious in retrospect". I see that, but it was an invention of something that didn't exist before. Think of the mouse pointing device: seems patentable: it has that "why didn't I think of this" feel of obviousness, but it is something that didn't exist before. And I don't mean that because it is a physical object. Compression or encryption algorithms: they are new things.

    But this DNS trick, like Amazon and cookies and confirms, doesn't invent anything. The feature of the DNS they are using was invented by someone else. Cookies were invented by someone else. Am I rambling here? I'm just trying to explore the space. A few years ago, I heard about a patent that was something like "using a hard disk to store digitized telephone messages". I hear that and think, "give a patent to the hard disk guy, to the A/D guy, and to the telephone guy. But using technologies in combination to do what they were invented to do is not patentable, even if it's clever."

  • Seems that what they're trying to patent is, essentially, trying to store state using DNS.

    Isn't that exactly what the Fox project's IP-over-DNS thing does? (As referenced in the Firewall Piercing Mini-HOWTO, 27 November 1998.)

    --Dave

  • 1st of all, who are you to be assuming who we are, getting upset about these issues.

    2nd of all, I developed a system for user management (not session, but very similar) based on wildcard DNS aliases (A Records). In my system, a user comes to the site via username.mysite.com and then logs in to his/her personal section. This is prior art! As soon as I get my client's permission, I'll post more info on the SIMPLE, OBVIOUS process I used. Furthermore, this is not hindsight, I devised the system on my own, with no external help.
  • The Sevenval system is useful, because

    - it makes pages fairly uncacheable in a central proxy while at the same time retaining local cacheability of the pages, thus keeping the back button alive

    - you do not have to propagate the session id manually, but only have to use relative links in your pages. This will even would on static pages.

    - you can easily log by host and get customer tracking with current tools

    Sevenval implements this with a wildcard A-record in the DNS system, which has been around for quite some time, and an initial 302 redirect to a unique hostname. That hostname is long (a 128 bit value) and randomly generated, making it unguessable. Changing the hostname will simply restart your session, as with any other session tracking systems.

    © Copyright 1999 Kristian Köhntopp

  • DNS record.. (Score:3)

    by EraseMe ( 7218 ) on Friday March 10, 2000 @04:04AM (#1212607)
    According to the DNS record for sevenval.com, how exactly are the dynamic A records held? I'm fairly sure there is an implementation of DDNS in the latest version of BIND (ala Windows dynamic WINS updates in DNS), but how is this stored?

    I don't see anything even remotely dynamic below, but their hostname is extremely dynamic when viewing their webpage. I would assume its the * record, but what sort of application generates the hostname?

    2000011802 ; serial
    8H ; refresh
    2H ; retry
    1W ; expiry
    1D ) ; minimum

    1D IN NS ns.buy-world.de.
    1D IN NS ns.r-tec.net.
    1D IN MX 1 wilson.office.sevenval.de.
    1D IN A 195.122.187.3
    * 1D IN HINFO "IBM-PC" "UNIX"
    1D IN A 195.122.187.3
    cvsserver 1D IN A 62.96.224.212
    1D IN HINFO "IBM-PC" "UNIX"
    *.cologne 1D IN A 62.96.224.211
    1D IN HINFO "IBM-PC" "UNIX"
    wilson.office 1D IN A 62.96.224.210
    1D IN HINFO "IBM-PC" "UNIX"
    tim.office 1D IN A 62.96.224.222
    1D IN HINFO "IBM-PC" "UNIX"

    EraseMe

  • It's been called "URL Poisoning" (Score:3)

    by lar3ry ( 10905 ) on Friday March 10, 2000 @05:00AM (#1212608)
    There's a web site http://www.lemuria.org/Software/unpoison that calls this technique "URL Poisoning" and mentions that this could be considered a Bad Thing, because using this technique, people cannot easily "opt out" from being profiled, as you can by, say, disabling cookies in your browser. [lemuria.org]

    Refer to the above link for an explanation of URL Poisoning, and for a pointer to a Squid redirector plugin that can be used to disable URL poisoning.

    I personally don't have any opinion on this; I can see how it can be used, as well as how it could be abused. [shrug]
    --

  • Improper? (Score:3)

    by Foogle ( 35117 ) on Friday March 10, 2000 @04:29AM (#1212609) Homepage
    This is hardly an improper software patent. If it was so obvious, we'd all be using this sort of technology in our web-browsers right now. Now, you may not want to see it patented -- so that everyone can use it freely -- but that doesn't make it "improper". This is the very heart of what patent's are about.

    -----------

    "You can't shake the Devil's hand and say you're only kidding."

  • Re:depoison... and THIS(!) (Score:3)

    by Sun Tzu ( 41522 ) on Friday March 10, 2000 @05:59AM (#1212610) Homepage Journal
    Hostname information encoding has been done here [fuckingsucks.net] as well. ;)

    This site works with all text I have tried, separated by periods. I don't know how long it's been up, but it has been there for quite a while.
  • I could of course be smoking der crackenpipen, but I think the stuff I see in the URLs when I visit www.bookpool.com (amazingly cheap prices on computer and tech books, way cheaper than amazon or fatbrain in my experience). I don't know how long they've been around, but I've been shopping there since april of last year. Mike

    --

  • depoison (Score:3)

    by dsb3 ( 129585 ) on Friday March 10, 2000 @03:49AM (#1212612) Homepage Journal
    Freshmeat already has a program registered called 'depoison' that will remove this session management information. I'm sure it was for a different web site, so perhaps THAT is prior art in itself?

  • unpoison (not depoison) (Score:3)

    by dsb3 ( 129585 ) on Friday March 10, 2000 @03:55AM (#1212613) Homepage Journal
    My mistake. It's actually called unpoison and is written by Tom Vogt.

    Freshmeat Application Page [freshmeat.net] reads as follows:
    unpoison.pl is a simple Squid redirector plugin that disables (and returns the favor of) a new customer-tracking scheme developed by 7val.com that the author has labeled "Location Poisoning". The Web page explains how Location Poisoning works and why the author considers it a Bad Thing(tm).

    The App home page [lemuria.org] gives more information, including the patent request by 7val.com ... (which in all liklihood is the same deal as sevenval.de now I've woken up enough to remember how to spell my numbers)

  • AOL doing this for years -- serious prior art (Score:3)

    by webg2.com ( 137147 ) on Friday March 10, 2000 @06:34AM (#1212614)
    AOL has been encoding session info into the DNS names given to its users' ip addresses for years.

  • Is this really groundbreakingly useful? (Score:4)

    by stab ( 26928 ) on Friday March 10, 2000 @05:11AM (#1212615) Homepage
    Why is this technique so useful compared to session-id tracking? I don't believe that it really is, or why such a fuss should be kicked up about it :

    If I understand it correctly, it simply replaces the session ID normally stored in as a cookie/get-var in the hostname.

    This would lead to extremely user-unfriendly domain names, and surely it would really bugger up users trying to bookmark the site (stale sessions could stay in bookmarks for a LONG time).

    Also, its simply not as efficient as session IDs, which after one unfriendly GET, tend to store their results in a cookie which is transparently passed around. Surely dynamic DNS would all have to have really low TTLs and generally slow down site access if you have to do a large number of DNS lookups (which can be the slowest stage in an http access cycle?)

    As I see it, the only problem with the session-id method is that it complicates serverside scripting, but with simply superb tools like PHPLIB [netuse.de] all those details are abstracted away from the user. And also PHP4 [php.net] has built in session handling to simplify things further. IIS has similar modules for ASP developers, and I'm sure others exist forother scripting languages (mod_perl? dunno ...)

    So while this might be of interest to some specific applications, I can't see it revolutionising the whole ecommerce industry with its cunning "new" user tracking system.

    But then again, I might be talking bull :) Do correct my bullshit if it is that, please.

  • Re:IM SO SICK OF PEOPLE COMPLAINING (Score:4)

    by slashdot-me ( 40891 ) on Friday March 10, 2000 @07:08AM (#1212616)
    It IS obvious. One of my projects is a web search engine and I have given dns-based session control quite a bit of thought. As a spider designer, it gives me the heebie-jeebies.

    No one uses dns encoding because it poisons dns caches. Remember, dns lookups that aren't cached on a nearby server require sending a request/response from at least two other machines. Here's what a session might look like.

    ////////////////////

    First query the local server. Very fast since the connection is probably ethernet.
    me -> dns.ryans.dhs.org

    Now my local dns goes off and searches for the ip address.

    Local dns queries the root servers.
    dns.ryans.dhs.org -> b.root-servers.net
    dns.ryans.dhs.org ns1-auth.sprintlink.net
    dns.ryans.dhs.org - ns1-auth.sprintlink.net

    Local dns sends me the answer
    me - dns.ryans.dhs.org

    Start tcp session

    ////////////

    As you can see, the name lookup needed one short-haul and two long-haul roundtrips. If it was cached only one short-haul conversation would have been needed.

    Ryan

  • Calculator in the URL - prior art (Score:4)

    by bvark ( 58049 ) on Friday March 10, 2000 @03:57AM (#1212617) Homepage
    http://x42.com/urlcalc/ looks a lot like prior art to me.

  • Useless for SSL (Score:4)

    by DSCreat ( 95104 ) on Friday March 10, 2000 @04:56AM (#1212618) Homepage
    SSL site certificates are bound to a very specific host name, so this session tracking soution would work only for non-secure sites.

  • I've been doing this. (Score:4)

    by Kyler Laird ( 148368 ) on Friday March 10, 2000 @05:53AM (#1212619)

    This has been one of the features I've been trying to hype for our new Web server cluster. I love wildcard A records. There not only useful for non-cookie sessions (I *hate* cookies.) but I have been playing with them to support being able to "log out" an HTTP authenticated connection. (So you'd authenticate with auth1234.foo.com and then the server could invalidate your authentication with that specific host name.)

    I have public examples of my use of wildcard A records through purdue.org:

  • Possible candidate (Score:5)

    by jbrw ( 520 ) on Friday March 10, 2000 @04:06AM (#1212620) Homepage
    Not session tracking, but a similar idea:

    http://type.something.here.real ly.fuckingsucks.net/ [fuckingsucks.net]

    (and sorry for the sailor talk).

    Replace "type.something.here" with, say, a company name.

    ...j

  • Re:unpoison (not depoison) (Score:5)

    by Shoeboy ( 16224 ) on Friday March 10, 2000 @04:17AM (#1212621) Homepage
    Ok, checked out the homepage of this user and don't get a lot of his complaints.

    As customer, you are paying, so that the company owning the web-pages can profile you. Not only is tracking the default, there also is no way out, no "I don't wanna be tracked" button.

    Ok, so I definitely don't understand all of this "location poisoning" technology, but I don't see anywhere that they are getting more information about you (IP address, pages viewed, etc...) than any other web site collects. Don't know about your friends and coworkers, but all the major websites that I've heard of and interviewed with do major tracking (300Gb data warehouses and such) of all hits and don't offer an opt-out option. How is this different?

    With "paying" I do literally mean money and time. Location Poisoning disables proxy servers, DNS caching and other mechanisms that reduce the amount of net traffic. More traffic means waiting longer for pages to appear, and if you pay for your traffic (most small businesses do) it also means you are paying money that you shouldn't have to pay.

    So what if I use this for dynamic content? In that case, caching doesn't matter anyway.

    Location Poisoning also abuses HTTP and DNS standards.

    Last time I checked, most of what web developers do abuses standards (mainly html) Ever noticed that client side scripting gets buried in comment tags? That's actually part of the standard, but it doesn't make it any less fucked up.

    The reply to an initial request is a 302 error code, reserved for "Temporarily Moved" documents. Giving this reply is somewhat akin to a lie by the remote webserver.
    Yeah, just like how giving me "permission denied" is a bit of a lie on footfetish.com, what they ought to be sending me is the (forget the number) "payment required" http response. Those bastards!

    Abusing standards for one-sided gains should not be endorsed. It undermines the standards and punishes those who try to respect them.
    How do you feel about all the html tags that netscape introduced? That was an abuse of the html standards process, but it's hard to deny that it dramatically improved the web. Why should http standards be different?

    Location Poisoning tries to transparently add states to a stateless protocol. This is a bit like dehydrated water - sounds interesting, but doesn't make much sense.
    Come on, every web developer I know spends time trying to establish states on this stateless protocol. Like cookies are an elegan solution.

    There are several ways to add states to HTTP, but they are far from transparent. So it appears that in the long (by IT standards) history of the web, absolutely everyone missed this quite simple solution? Hardly a believable claim, is it?
    Quite possible. I improve my throughput by using the mouse with my toes. My coworkers insist they've never heard of anything so daft.

    Finally, Location Poisoning is a proprietary solution. If you use it, you are binding yourself to one partner. If at a later date you wish to work with someone else, you will have to completely redesign and re-implement your whole customer tracking system. Other mechanisms are open and can be taken over by your new partner. Location Poisoning is patented (or will be soon), and thus can't be used by someone else.
    Ever talked to a mac user. They're all pretty relaxed about being married to a single company. (OK, so they were pretty nervous about it a few years ago, but really)

    If I'm missing the point here, feel free to flame.

    --Shoeboy

  • Calculator in the URL (Score:5)

    by HugoRune ( 20378 ) on Friday March 10, 2000 @04:00AM (#1212622)
    This looks like a similar idea to me.
    http://$urlcalc(about).x42.com/ [x42.com]

    According to the copyright notice on the page, this has been up since 1998-06-23, and has won the "Useless site of the year award" for 1998.

    Perhaps it wasn't so useless after all.

  • aka "Location Poisoning", not good (Score:5)

    by RMGiroux ( 28149 ) on Friday March 10, 2000 @04:07AM (#1212623) Homepage

    Check out this article [lemuria.org] for a counter argument to this approach.

    Quoting from that page:

    Why you should oppose Location Poisoning as a customer

    As customer, you are paying, so that the company owning the web-pages can profile you. Not only is tracking the default, there also is no way out, no "I don't wanna be tracked" button.

    With "paying" I do literally mean money and time. Location Poisoning disables proxy servers, DNS caching and other mechanisms that reduce the amount of net traffic. More traffic means waiting longer for pages to appear, and if you pay for your traffic (most small businesses do) it also means you are paying money that you shouldn't have to pay.

    Location Poisoning also abuses HTTP and DNS standards. The reply to an initial request is a 302 error code, reserved for "Temporarily Moved" documents. Giving this reply is somewhat akin to a lie by the remote webserver.

    Abusing standards for one-sided gains should not be endorsed. It undermines the standards and punishes those who try to respect them.

    Location Poisoning also undermines the purpose of DNS and hostnames. Instead of using DNS to give human-readable names of server machines ("www.lemuria.org" instead of 195.244.121.251), it abuses the DNS to identify a client machine - i.e. you, the customer.

Slashdot Top Deals

Understanding is always the understanding of a smaller problem in relation to a bigger problem. -- P.D. Ouspensky

Close