Slashdot Mirror

Try opendns.org. I have been using it for a while now and have been very happy with how well it blocks so many categories of sites. It is customizable, password protected (is you choose) and all you have to do is set the dns of the computers to use it and select the types of content to block.

InnerWeb

My home ISP was vulnerable (201.251.7.2) and so was a friend's. I just changed my DNS entries to OpenDNS and told my friend to do the same; took about two minutes. If you find you're vulnerable and don't want to risk being hit by this exploit, just change your DNS servers to the ones listed at http://www.opendns.org/ until this is patched (208.67.222.222 and 208.67.220.220)

Do we know that the ISP is actually using "deep packet inspection" to "hijack" DNS error responses to serve a webpage instead?

Frankly, I doubt it. Chances are more likely that the ISPs DNS software has been customized to serve up a webpage instead of respond with a DNS error flag. I don't know what you think constitutes "deep packet inspection", but this certainly doesn't (nor, in my opinion, does it constitute worthiness of a Slashdot story).

Furthermore, nothing about this violates the principle of network neutrality. No packets have filtered, throttled or shaped in any way. I'm afraid that, unless we can prove they are actually checking packets from DNS requests going to other DNS servers, testing for a DNS error, and then serving up a webpage; "net neutrality", "DPI" and "hijacking" have become mere buzzwords to throw around aimlessly to shamelessly attract media attention.

Can someone on a Roger's connection change their TCP/IP or router settings to use OpenDNS and see what happens on a DNS error?

I set this up for my sister.

Point the computers DNS to OpenDNS and setup an account there. Block the porn with that. Don't give the user admin access so they can't change the nameservers.

Works like a charm. My sisters 16 yr old son no longer gets porn... at home.

http://opendns.org/

In your internet router, force the dns to use the opendns information...

Works, somewhat well. Doesn't stop you from using google images, though.

But seriously, isn't this already addressed well through OpenDNS?

jZnat, I have run my own DNS servers for many years, and I can now be completely free of that burden thanks to OpenDNS. Take a look at http://www.opendns.org/ and some of the features they have. Working for a global corporation, my favorite feature is their impressive infrastructure- DNS queries are just milliseconds away no matter your location in the world. Let's see your "do-it-yourself" DNS box do that :)

Now that we are educated on what the ads support- I would like to comment on the ads themselves. They are extremely Adwords-esque- minimally intrusive and well-targeted. The most prominent feature on the search/phishing blocked/etc. page is the logo that YOU upload.

This has nothing to do with ICANN and global DNS policy- just better service to end-users.

For this we have OpenDNS, couple it with a good HOSTS file and that's most of your potential problems sorted.

I've been slowly implimenting both across all windows machines that I privately maintain (family/friends) and the decrease in support calls is apparent - considering the 30 seconds of effort required, it's a damn good return on investment. Using either/both on Linux/BSD isn't hard either - you're icing the cake of ingrained security...