Slashdot Mirror
ICANN Asks VeriSign To Stop DNS Wildcarding
MrClever writes "In this article over at the Sydney Morning Herald (AU), it looks as though ICANN may actually be doing something about the VeriSign changes to .com and .net TLD's. Apparently, while they have been noticably quiet, they have been reviewing community reaction and analysed data from a technical perspective. Here's hoping ICANN pull the plug on VeriSign's TLD administration rights!" And TALlama writes "RSS.com.com (dear $DIETY, will it ever stop?) is reporting that ICANN has asked VeriSign 'to voluntarily suspend the service' of wildcarding DNS, 'pending further study.' Calling it a 'service' is a little bit of a misnomer. If I punch people in the face, can I call that a service, too?"
Posters Ask Slashdot To Stop Dupe Posting
Apparently Timothy is a Dork
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
"If I punch people in the face, can I call that a service, too?"
Yes, because so many people need what you are selling.
how we always get the news late here? I swear...
(ICANN) has asked VeriSign to voluntarily suspend changes it made to domain name service zones that have resulted in most mistyped .com and .net domain names being redirected to its own site.
I predict the most common misspelling of VeriSign.com will be VerySued.comICANN said it is investigating complaints over the wilcard service and asked VeriSign to pull it pending further study. The service effectively replaces the common "404 page not found error" that until now has been the default for absent Web addresses.
404? A HTTP response from a DNS request? Please get your facts straight com.com...
I prefer my spamfilters intact.
I prefer that my redundant mailservers actually get used.
Do some reading before trying to justify what's been done.
The sydney morning herald is not known for original reporting, everything is duplicated in the Melbourne Age for starters...
Loop:
Slashdot reports story, smh reports story, slashdot reports smh reporting (slashdot story), smh reports story again (cos Slashdot did).
Repeat until servers full.
-- it must be true, it's on the internet.
For starters, sitefinder doesn't find the slashdot site!
It isn't nearly as helpful or reliable as google (even if google is censored a bit).
It causes me to download more stuff than I would if they didn't have the diversion abusing my bandwith and data allowances that I have to pay for.
I can turn the msn search in IE off. I turned the sitefinder.verisign.com off by modifying my hosts file but that isn't easy for most of the customers I support.
-- it must be true, it's on the internet.
Honestly I don't think VeriSign will stop this "service" because of public pressure alone. I used to have my domains registered at VeriSign but I was tired of never being able to get a password for the web administrative interface.
VeriSign is a great service if you're not planning on making any changes to your domain information. A few years ago I needed to update my name. VeriSign "offered" (the free version was in small print and out of the way) the service to have my name change rushed for over $100.
I suspect ICANN is stepping in due to public pressure, not VeriSign.
You're new hear aren't you? Its been in a decline for 5 years.
-AX
^I'm with stupid.^
Wake me up when it escalates to wrist-slapping.
One line blog. I hear that they're called Twitters now.
If hackers/spammers could compromise any TLD name server, wildcards or not, I think we could see a fair bit of disruption.
One line blog. I hear that they're called Twitters now.
Okay, in simple terms..
DNS is the method of resolving names to IP addresses, it's what turns 'www.slashdot.org' into 66.35.250.151, or 'www.google.com' into 216.239.59.99
Wildcarding DNS is when instead of saying 'www.slashdot.org is 66.35.250.151' you effectively say 'Everything is 66.35.250.151' and so any domain you're asked to resolve goes to Slashdot's IP address.
What VeriSign have done is to add a final rule to their list, saying 'Anything not in the above is 64.95.110.11' (Or whatever the IP is of their SiteFinder service). This has the result that any DNS request that formerly would have returned an 'Unable to resolve' message now thinks it's resolved correctly to the IP address.
The stink this is causing with spam mail is that a lot of anti-spam measures rely on being able to weed out mail from made up domains simply by checking if the domain resolves correctly.
DNS is actually a *lot* more complex than this, but I think that'll do to explain what's going on here.
404 Not Found: No such file or resource as '.sig'
The IAB has issued a set of guidelines for the us of DNS wildcards.
Essentially, they say it's a very bad idea, but you can do it with the informed consent of all delegates in your zone.
The IAB statement in response to Versign has a lot of technical background on DNS wildcards, what they are, and what the problems with their use are.
Unregistered domains now return a plain, comforting error page instead of SiteFinder. Which is nice.
NuNames, the provider of domain names for the island of Niue, has been doing this for a long time. Is ICANN ask them to stop too?
If we all add this command:
;p
iptables -I INPUT -j REJECT 69.94.0.0/15
maybe that will get Verisign's attention
Afterall theres nothing they can do about people blackholing them for a good long while until they say they are sorry. As a penalty they should lower the prices of their domain registration, to something competitive.
I'm still not having this problem. If I browse to http://notarealaddressatall2323.com, my browser just says "Looking up host" and then eventually returns an error.
I've never actually seen this happen. Is it possible that my provider (Earthlink) has blocked this in their own DNS servers?
>dear $DIETY, will it ever stop?
File not found. Bad command or deity.
At first I was kind of pissed about what they did, but what is it really hurting? Anything that relies on a dns failure could easily be changed to accept a failure or a response involving that ip.
Although I know they will never release any stats on the kind of hits they are getting to that ip, it would be an interesting study. I would be interested to find out what the most misspelled domain is.
Of course you can sell your Punch in the Face services. Such services have traditionally gone under names such as
Now, this analogy actually does continue. You, as a sysadmin or someone writing a script that uses DNS, might not really like this service. Just like someone who is trying to take celebrity photographs might not like the Punch-in-the-Face service. But the fact is that this service is provided. And that there are a LOT of people who not only don't see this as a problem - but like it. Or at least think they do.
That is why Verisign thinks they can get away with this - the average person sees a benefit here and sees no drawbacks. The average person watching a boxing match also just sees the benefits and not the drawbacks. Until it is made clear why this isn't as good as it appears, nobody will care. Chances are, nobody will care anyway.
Have any of you read the "terms of use"? http://sitefinder.verisign.com/terms.jsp What a load of bollocks - do they seriously want us to believe that being redirected without our control to some bogus directory site is a legally binding agreement?! Go fsck yourselves Verisign!
Forget thrust, drag, lift and weight. Airplanes fly because of money.
People who grew up on a farm will understand what I mean.
CEE5210S The signal SIGHUP was received.
Many spammers fake domain names. Spam filters check to see if the domain is real and will reject bogus emails. VeriSign broke that by making all domains valid.
In addition to web traffic, they are also intercept email traffic. So if you mistype an email address, they will get the email and keep it and you won't get a bounce.
The Register has an article about how VeriSign Broke My Printer.
The Register also reported that VeriSign is using Web Bugs.
-- Don't Tase me, bro!
Well in Oz we have a 10% Goods and Services Tax (GST) - so technically you would have to give 10% to the government too.
Q.
Insert Signature Here
Hi,
There's a petition available. Now I don't know exactly how effective it will be, but signing is more effective than not.
http://www.whois.sc/verisign-dns/.
rgds
Alan
Tequila - drink of the gods.
...and hang tough.
After all, the IAB says here that "We must emphasize that, technically, this was a legitimate use of wildcard records that did not in any way violate the DNS specifications themselves."
If the decision-makers at Verisign cared about good engineering practice, they wouldn't have done what they did.
They probably regard their own actions as just "sharp business practice" and are probably patting themselves on the back for having found a loophole in the DNS specification that they can use for their own profit.
I don't think jawboning from ICANN, the IAB, or anyone else will have much effect. I don't see how anyone short of the Feds can stop them.
I mean, they have contracts with their SiteFinder advertisers. There's money at stake here.
"How to Do Nothing," kids activities, back in print!
There is an available patch for BIND 8:
.com/.net domains. It was cooked up over 10 minutes of pure anger and has not been properly tested; it would be better to be able to specify which IPs to ignore in the configuration file. Suggestions or improved patches are very much welcomed. (Note that this patch causes SERVFAIL results; NXDOMAIN would be better, but I'm not that well versed in the BIND code.)
This page provides a patch to BIND 8 to ignore the wildcard A record Verisign is now returning for unregistered
This patch was made against BIND 8.4.1.
If you punch the verisign ppl in the face, you can bill me.
"If God created us in his own image we have more than reciprocated." - Voltaire
To start with, only A records resolve to the Verisign servers. MX records don't resolve to anything.
However, most mail servers will try the A record if the MX record doesn't exist. Verisign have set up a server running Postfix which responds with: 550: Client host rejected: The domain you are trying to send mail to does not exist.
At this point, the mail server sends a bounce message and does not pass your e-mail to Verisign.
This is still broken, bad, wrong and evil, but they are not intercepting your mail. Yet.
Predictive text is shiv!
Once Verisign quits doing it, I revert to the damned MSN page every time there's a type-o.
Why isn't anyone bitching about MS?
So, what happens when Verisigns gets its website hacked again? I would think that this would be a prime target for anyone who wnats to get attention. It's just a matter of time.....
Actually they intercept any traffic that attemts to resolve .net and .com addresses against their DNS servers. This could break all sorts of things, internet search engines, FTP clients, IRC server networks and clients, some mirroring services, and the list goes on. This move by Verisign represents a major change in the basic functioning of the internet, and many of the repercussions may not be completely apparent for some time. For instance, what is the additional cost of transfering relatively big (in bytes) webpages as opposed to efficient error responses?
(Score: -1, Stupid)
Those who think you can not make a buck hitting people have not watched the old 80's and 90's televangelists 'heal' people by hitting them in the head. And to complete the financial transaction, these 'healed' people give the evangelist money for the priviledge of being hit while up on stage!
Then there is always the bouncer at your local bar. He provides a service that frequently involves punching people.
Never meddle in the affairs of dragons,
for you are crunchy and good with catsup.
Rich