Slashdot Mirror

How about something like OpenDNS?

I can't say I've used it for this purpose, but it does seem to support the notion of adult site blocking, and is pretty trivial to configure, even for a non-geek.

This is what http://www.opendns.com/ does.
It provides a dns server that does some filtering such as blocking malicious websites and can spelling in urls. If this is a good thing is up to you.

Where can I find lists of DNS servers I can use instead of my cablemodem's default from my ISP?

OpenDNS

OpenDNS ( http://www.opendns.com/ ) works pretty well. I typically go internal cache, external ISP, openDNS on my systems. Keeps Windows boxes in line, especially.

-theGreater.

208.67.222.222
208.67.220.220

I don't work for OpenDNS, but they've got some nice DNS servers out there for use. http://www.opendns.com/

Kind of sad, the first thing I thought about when I started reading about this was, "Wow... Who'd a thought you needed TOR to get proper DNS resolution?"

There's no Great Firewall of Sweden, it's not gonna be impossible to reach the site from within Sweden, it's just a DNS blacklist. The police maintains a small list of sites that they think/know traffics in child pornography. All Swedish ISPs can subscribe to this list and add it to their DNS servers so that any of their customers that tries to lookup these addresses will instead get the IP to a webserver that informs you that the site you wanted is bad.

If you use an ISP that does not subscribe to this list, nothing happens. If you don't use the DNS that your ISP supplies, nothing happens. You're not blocked from the content, your DNS lookup is hijacked in some sort or attempt at policing the internets.

It's kinda hard to say that the idea was bad from the start, but I can't say it was very good either. However, what we have now is a perfect example of the slippery slope in action. There is a censoring system in place, and someone decides to use it for their own agenda. Annoying, but in the end everyone that cares is just gonna switch away from their ISP's DNS servers to open alternatives such as http://www.opendns.com/

Easy way to defeat the phishers, OpenDNS. Or you could actually look at the status bar to see what site you are clicking on...

Sorry, should have posted a link. The OpenDNS forum thread about this is here.

$ host www.google.com
www.google.com is an alias for google.navigation.opendns.com.
google.navigation. opendns.com has address 208.67.217.230
google.navigation.opendns.com has address 208.67.217.231
www.google.com is an alias for google.navigation.opendns.com.
www.google.com is an alias for google.navigation.opendns.com.

$ host google.com
google.com has address 64.233.187.99
google.com has address 64.233.167.99
google.com has address 72.14.207.99
google.com mail is handled by 10 smtp4.google.com.
google.com mail is handled by 10 smtp1.google.com.
google.com mail is handled by 10 smtp2.google.com.
google.com mail is handled by 10 smtp3.google.com.

$ host www.google.com
www.google.com is an alias for google.navigation.opendns.com.
google.navigation. opendns.com has address 208.67.217.230
google.navigation.opendns.com has address 208.67.217.231
www.google.com is an alias for google.navigation.opendns.com.
www.google.com is an alias for google.navigation.opendns.com.

$ host google.com
google.com has address 64.233.187.99
google.com has address 64.233.167.99
google.com has address 72.14.207.99
google.com mail is handled by 10 smtp4.google.com.
google.com mail is handled by 10 smtp1.google.com.
google.com mail is handled by 10 smtp2.google.com.
google.com mail is handled by 10 smtp3.google.com.

Go to this page: http://google.navigation.opendns.com/
I hope you can see that that isn't Google.

If you know how DNS works and look behind the curtain, you'll notice that the OpenDNS resolvers don't return A records for www.google.com, but a CNAME (alias) record "google.navigation.opendns.com", which makes the resolver lookup that name instead. That resolves to 208.69.34.231, which is in an OpenDNS network range of IP addresses. That's the server you connect to when you use OpenDNS and go to www.google.com. The URL bar won't change because according to the OpenDNS resolver, 208.69.34.231 is the IP address of www.google.com, which is just a non-canonical name of that IP address, and that is a BIG FAT LIE.

Show of hands: Who uses OpenDNS and is aware of that hijacking? Now who's the spy?

This URL shows a blank page when the browser (Firefox) has Javascript disabled:

        * http://guide.opendns.com/?url=microsoft.xom

What kind of user experience is that?

Read your own privacy policy and then evaluate if calling your own service "spyware" is appropriate.

http://www.opendns.com/privacy/

It appears to me by using your dns service instead of the one provided by an isp, I forfeit the ability to have my dns lookups remain anonymous. That seems to fall closer to the definition of spyware in my book.

I certainly hope you have insurance against a disgruntled worker replacing www.mybanknamehere.com with www.myphishingsite.com

• http://www.google.com/hws/dell/afe?hl=en&s=http:// microsoft.xom
• http://www.google.com/hws/gateway/afe?hl=en&s=http ://microsoft.xom
• http://www.google.com/hws/sony/afe?hl=en&s=http:// microsoft.xom
• http://www.google.com/hws/emachines/afe?hl=en&s=ht tp://microsoft.xom
• 
  with
  
• http://www.google.com/search?hl=en&q=microsoft.xom &btnG=Google+Search

• http://guide.opendns.com/?url=microsoft.xom

Using OpenDNS redirects mistyped URLs to their own site.

http://www.opendns.com/faq/#how_does_opendns_make_ money

How does OpenDNS make money?

OpenDNS makes money by offering clearly labeled advertisements alongside organic search results when the domain entered is not valid and not a typo we can fix. OpenDNS will provide additional services on top of its enhanced DNS service, and some of them may cost money. Speedy, reliable DNS will always be free.

Now, to be fair I use OpenDNS at home, but I find it hard to take this kind of warning from a person who makes money the same way.

Open DNS -- well, one word and one acronym. Maybe just a URL. http://www.opendns.com/

I highly recommend OpenDNS, available for free at http://www.opendns.com./ They also redirect your typos to a search page, but you can brand the pages with your own logos. They provide many other useful services such as phishing site blocking and DNS usage statistics. You don't even need an account to use their DNS servers, if you don't want the statistics and custom settings.

I have 7 /24 networks registered with them now, and I can't thank them enough. I have zero DNS problems now, and it even seems much faster.

I'm not surprised ISPs are doing this. More will be doing this. What does surprise me is how ISPs try to do this silently and behind closed-door without informing their customers, or even their tech support in some cases.

Think about it this way: Any change an ISP makes that results in 1% (or more) of their customer base calling in for technical support is a cost nightmare. Customer Service is a (*the*) major cost center for ISPs. I guess we have to imagine that they are making more money than the pain of doing the customer service is costing them.

The other thing that surprises me (and obviously I'm biased since I run OpenDNS) is that the search results page linked above is 100% ad-driven. There are no no organic search results for my typo (as far as I can tell). Moreover, when I click on a category to "refine" my results they totally remove the typo'd domain that I had there in the first place instead just giving me generic ads for a category (which is a mediocre CPC on their side) and a crappy search experience on the user side. There is absolutely no user-benefit to what Charter has done here.

I'm proud to say that our page is getting better and better every single day. Compare and contrast. Not only that, but we're driving more and more innovation in both user navigation and fundamental DNS operations. These things go hand in hand. Fundamentally the DNS is about navigation. It's about helping users get where they are trying to go. That's exactly what we intend to help our users do. We know that the changes we have made to how our DNS servers operate aren't for every user which is why we are so clear about how our system works and is why make sure we can manage account settings on a per IP basis (CIDR-style preferences down to /32's).

As usual, I'm happy to answer questions where I can.

-david ulevitch

I'm not surprised ISPs are doing this. More will be doing this. What does surprise me is how ISPs try to do this silently and behind closed-door without informing their customers, or even their tech support in some cases.

Think about it this way: Any change an ISP makes that results in 1% (or more) of their customer base calling in for technical support is a cost nightmare. Customer Service is a (*the*) major cost center for ISPs. I guess we have to imagine that they are making more money than the pain of doing the customer service is costing them.

The other thing that surprises me (and obviously I'm biased since I run OpenDNS) is that the search results page linked above is 100% ad-driven. There are no no organic search results for my typo (as far as I can tell). Moreover, when I click on a category to "refine" my results they totally remove the typo'd domain that I had there in the first place instead just giving me generic ads for a category (which is a mediocre CPC on their side) and a crappy search experience on the user side. There is absolutely no user-benefit to what Charter has done here.

I'm proud to say that our page is getting better and better every single day. Compare and contrast. Not only that, but we're driving more and more innovation in both user navigation and fundamental DNS operations. These things go hand in hand. Fundamentally the DNS is about navigation. It's about helping users get where they are trying to go. That's exactly what we intend to help our users do. We know that the changes we have made to how our DNS servers operate aren't for every user which is why we are so clear about how our system works and is why make sure we can manage account settings on a per IP basis (CIDR-style preferences down to /32's).

As usual, I'm happy to answer questions where I can.

-david ulevitch

Although the recommendation to switch to OpenDNS has the same flaws from what I have read. They, too, redirect unknown domains to their "organic search" page.

You, sir, are not using your brain.

From the OpenDNS FAQ:

How do I turn off phishing protection or typo correction?
Create a free account to manage your network preferences.

In fact you can turn those "features" off. You have to opt-out, which means you have to register.

Although the recommendation to switch to OpenDNS has the same flaws from what I have read. They, too, redirect unknown domains to their "organic search" page.

You, sir, are not using your brain.

From the OpenDNS FAQ:

How do I turn off phishing protection or typo correction?
Create a free account to manage your network preferences.

In fact you can turn those "features" off. You have to opt-out, which means you have to register.

How does OpenDNS make money?

OpenDNS makes money by offering clearly labeled advertisements alongside organic search results when the domain entered is not valid and not a typo we can fix. OpenDNS will provide additional services on top of its enhanced DNS service, and some of them may cost money. Speedy, reliable DNS will always be free.

That's close to what OpenDNS does. If the name does not resolve, it will give a best guess and show you an advertising page. They will also redirect you around known phishing sites.
  http://www.opendns.com/what/smarter.php
  http://www.opendns.com/what/safer.php

No difference in typosquatting results, but instead of getting a "not found" error you'll get an ad page if it's a typo they can't resolve.

That's close to what OpenDNS does. If the name does not resolve, it will give a best guess and show you an advertising page. They will also redirect you around known phishing sites.
  http://www.opendns.com/what/smarter.php
  http://www.opendns.com/what/safer.php

No difference in typosquatting results, but instead of getting a "not found" error you'll get an ad page if it's a typo they can't resolve.

• when I download huge files (usually, .debs from a Debian mirror), I get my 80Kb/sec download speed, as I paid for; and I always did , even when in mid Dec everybody was crying wolf
• I dont usually use P2P or BitTorrent; but AFAIK P2P and Bittorrent do not use DNS, they go by IP, so I do not understand how DNS or OpenDNS would ever make a difference
• and I do not understand how Telecom can use a faked DNS problem to cover a bandwidth problem,
• and, no , I do not use OpenDNS... I use the plain DNS that Telecom is telling me to use thru pppd

Switch to using OpenDNS for your DNS queries:
http://www.opendns.com/

This will work unless they actually manage to block the YouTube IP range...

OpenDNS will do phishing detection for you. Not only that, it'll correct common typos and speedup name resolution on your entire network. Oh yeah, it's also free, but it won't block those annoying fake search pages.

http://opendns.com/

you mean like this ?

Of course, with zero quality control even accepting their cybersquatter to display Google ads.

Yes, you know the deal, you make a typo in domain name and some porn/spyware site opens up. Now, one guy was clever to get "goggle" (not giving URL,spyware injection) and he also has Google ads. Yes REAL ones. Instead of getting sued, he even gets Google ads on his main company site.

Without getting into too much theoretical discussion about who owns Google name/term or not, think about this: The user wanted to go to Google, typed wrong and landed to a spyware (future phish?) site. Lets blame the user for all of this... It still gives no logical explanation to the issue described in this URL

http://blog.opendns.com/2006/09/13/why-pay-interne t-bad-guys/

Google's cybersquatter (or whatever called) is also a Google advertiser. Not just that, they run Google ads on their company site (can't dare to give URL,check blog).

The pirates abusing Usenet since Google got into it with ZERO control. They purchased Deja you know. There is every kind of scam coming from Google users in addition to clear pirate "forum" advertisements. People got fed up and started to locally kill-file Google groups. Professional services/Hosts may follow soon. It is highly possible.

What happens if you are running a secure OS and dare to click those pirate forums? I am not speaking about those serial number etc. guys, I am speaking about full BSA software piracy via disk images. How could a person dare and afford such thing? Answer: They all run Google ads.

There were some re-packaged, stolen open source software (not parallels) trying to trick Mac users that they can run Vista even. What they used for advertising? Google! Their disgusting piece of open source stolen code appeared on Mac forums everytime when someone mentions windows.

When you get such an image, big companies prefer quality controlled advertising platforms such as Yahoo.

Apparently that can be changed now.

FYI, a few weeks back, David Ulevitch blogged that this is no longer a problem.

OpenDNS is not a solution to this problem those with dynamic IPs, which includes most Earthlink customers (like me). By default, they do exactly the same thing Earthlink does: from their webpage: "...when we can't fix your typo we take you to a page with a set of search results." They do allow you to turn that behavior off on their prefs page, but only if you have a static IP. And I somehow doubt that there isn't a speed hit going off your ISPs own network for all your DNS queries, anyway.

The correct solution, of course, is to ditch Earthlink. Or in my case, not renew with them the next time I change my service -- unfortunately, changing now would be expensive. Until then, I'm going with Earthlink's secret, unbroken servers over OpenDNS.

OpenDNS is not a solution to this problem those with dynamic IPs, which includes most Earthlink customers (like me). By default, they do exactly the same thing Earthlink does: from their webpage: "...when we can't fix your typo we take you to a page with a set of search results." They do allow you to turn that behavior off on their prefs page, but only if you have a static IP. And I somehow doubt that there isn't a speed hit going off your ISPs own network for all your DNS queries, anyway.

The correct solution, of course, is to ditch Earthlink. Or in my case, not renew with them the next time I change my service -- unfortunately, changing now would be expensive. Until then, I'm going with Earthlink's secret, unbroken servers over OpenDNS.

From the http://www.opendns.com/what/ site: We're not perfect (yet) so when we can't fix your typo we take you to a page with a set of search results. Sounds like they do the same thing as Earthlink...

Ahhh, but with opendns you can turn off those features http://www.opendns.com/prefs/, restoring you to standard DNS functionality. Earthlink on the other hand doesn't give you the choice.

That's cool, I didn't know about that. Unfortunately the page you referenced says:

you need to have a static IP address to use opendns preferences

Ahhh, but with opendns you can turn off those features http://www.opendns.com/prefs/, restoring you to standard DNS functionality. Earthlink on the other hand doesn't give you the choice.

If they want to play that game then maybe you should just use:

http://www.opendns.com/

They have easy to use instructions for changing your computer to point to their servers.

If you don't like their service, you can always revert back to what your are annoyed with now...

I have been using them for more than a month with no problems.

I don't know if your wondering, but opendns (http://opendns.com/) does this as well. Its another way on income. This is one of their explanations: http://www.opendns.com/faq/#is_it_like_site_finder . Its not as bad when an isp does this compared to the whole world, and on the root dns servers like verisign did, which could of slowed down the entire .com/.net space. If users of earthlink have a problem with that, they can simply switch dns servers or start there own dns server easilly.

Wonky DNS servers: Tough luck.

See for example OpenDNS, David Ulevitch's startup that aims to give everybody access to superior DNS service for free.

Sadly, the people who screw up URLs or don't use bookmarks are the kind of people who could most benefit from using OpenDNS, which does take common typos and automatically redirects you to the correct site.

Ignorance is bliss, and I'd agree with your statement, and even extend that all people (yes, everyone) won't learn (or put effort into anything for that matter) unless they see to profit in some way themselves from it, monitarily or otherwise. That said, who's going to ignore "If you click on links in e-mail, you could have large amounts of money stolen from you"? Accompany it with horror stories and the general person will ease into a mindset of what those familiar with internet and e-mail would call 'common sense', which helps everybody. I'm also looking forward to see if OpenDNS (http://www.opendns.com/) will take off, and if it could actually have an effect on phishing schemes like this.

FWIW: EveryDNS is the same guy.

http://blog.opendns.com/2006/06/28/why-i-started-o pendns/

"To understand why I created OpenDNS requires a little background. I'd moved to San Francisco after graduating from Washington University in St. Louis, and was managing EveryDNS, a popular and reliable DNS management service which I started five years ago."

-- Terry

Ahh, yes - Yet Another Root Domain Name System, like AlterNic.

From their FAQ: Is OpenDNS a root nameserver?: "No. OpenDNS is a recursive nameserver. OpenDNS software talks to the root nameservers when necessary."

Only on slashdot could you be completely wrong and Insightful at the same time.

OpenNIC is a totally different organization. They are an alternate root. We're (OpenDNS.com) not anything close.

We're about giving you control over your recursive DNS, something you should want. If you don't want us catching typos for you, that's fine. Just check out our FAQ and learn a bit more.

-david

That part was definitely written incorrectly, but we all know what he meant (I hope).

No, look at the site. It claims to respond to failed DNS lookups with advertising and customized 404 messages. Look at the screen shot here. It includes a plug for OpenDNS. I don't know how a DNS lookup is translated to an http response, but I net it's pretty ugly.

From the FAQ:

How does OpenDNS make money?

OpenDNS makes money by offering clearly labeled advertisements alongside search results on error pages. OpenDNS will provide additional services on top of its enhanced DNS service.