Slashdot Mirror
ICANN Asks VeriSign To Stop DNS Wildcarding
MrClever writes "In this article over at the Sydney Morning Herald (AU), it looks as though ICANN may actually be doing something about the VeriSign changes to .com and .net TLD's. Apparently, while they have been noticably quiet, they have been reviewing community reaction and analysed data from a technical perspective. Here's hoping ICANN pull the plug on VeriSign's TLD administration rights!" And TALlama writes "RSS.com.com (dear $DIETY, will it ever stop?) is reporting that ICANN has asked VeriSign 'to voluntarily suspend the service' of wildcarding DNS, 'pending further study.' Calling it a 'service' is a little bit of a misnomer. If I punch people in the face, can I call that a service, too?"
Posters Ask Slashdot To Stop Dupe Posting
Apparently Timothy is a Dork
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
"If I punch people in the face, can I call that a service, too?"
Yes, because so many people need what you are selling.
(ICANN) has asked VeriSign to voluntarily suspend changes it made to domain name service zones that have resulted in most mistyped .com and .net domain names being redirected to its own site.
I predict the most common misspelling of VeriSign.com will be VerySued.comICANN said it is investigating complaints over the wilcard service and asked VeriSign to pull it pending further study. The service effectively replaces the common "404 page not found error" that until now has been the default for absent Web addresses.
404? A HTTP response from a DNS request? Please get your facts straight com.com...
I prefer my spamfilters intact.
I prefer that my redundant mailservers actually get used.
Do some reading before trying to justify what's been done.
The sydney morning herald is not known for original reporting, everything is duplicated in the Melbourne Age for starters...
Loop:
Slashdot reports story, smh reports story, slashdot reports smh reporting (slashdot story), smh reports story again (cos Slashdot did).
Repeat until servers full.
-- it must be true, it's on the internet.
For starters, sitefinder doesn't find the slashdot site!
It isn't nearly as helpful or reliable as google (even if google is censored a bit).
It causes me to download more stuff than I would if they didn't have the diversion abusing my bandwith and data allowances that I have to pay for.
I can turn the msn search in IE off. I turned the sitefinder.verisign.com off by modifying my hosts file but that isn't easy for most of the customers I support.
-- it must be true, it's on the internet.
Honestly I don't think VeriSign will stop this "service" because of public pressure alone. I used to have my domains registered at VeriSign but I was tired of never being able to get a password for the web administrative interface.
VeriSign is a great service if you're not planning on making any changes to your domain information. A few years ago I needed to update my name. VeriSign "offered" (the free version was in small print and out of the way) the service to have my name change rushed for over $100.
I suspect ICANN is stepping in due to public pressure, not VeriSign.
Wake me up when it escalates to wrist-slapping.
One line blog. I hear that they're called Twitters now.
Okay, in simple terms..
DNS is the method of resolving names to IP addresses, it's what turns 'www.slashdot.org' into 66.35.250.151, or 'www.google.com' into 216.239.59.99
Wildcarding DNS is when instead of saying 'www.slashdot.org is 66.35.250.151' you effectively say 'Everything is 66.35.250.151' and so any domain you're asked to resolve goes to Slashdot's IP address.
What VeriSign have done is to add a final rule to their list, saying 'Anything not in the above is 64.95.110.11' (Or whatever the IP is of their SiteFinder service). This has the result that any DNS request that formerly would have returned an 'Unable to resolve' message now thinks it's resolved correctly to the IP address.
The stink this is causing with spam mail is that a lot of anti-spam measures rely on being able to weed out mail from made up domains simply by checking if the domain resolves correctly.
DNS is actually a *lot* more complex than this, but I think that'll do to explain what's going on here.
404 Not Found: No such file or resource as '.sig'
The IAB has issued a set of guidelines for the us of DNS wildcards.
Essentially, they say it's a very bad idea, but you can do it with the informed consent of all delegates in your zone.
The IAB statement in response to Versign has a lot of technical background on DNS wildcards, what they are, and what the problems with their use are.
Unregistered domains now return a plain, comforting error page instead of SiteFinder. Which is nice.
NuNames, the provider of domain names for the island of Niue, has been doing this for a long time. Is ICANN ask them to stop too?
If we all add this command:
;p
iptables -I INPUT -j REJECT 69.94.0.0/15
maybe that will get Verisign's attention
Afterall theres nothing they can do about people blackholing them for a good long while until they say they are sorry. As a penalty they should lower the prices of their domain registration, to something competitive.
>dear $DIETY, will it ever stop?
File not found. Bad command or deity.
Of course you can sell your Punch in the Face services. Such services have traditionally gone under names such as
Now, this analogy actually does continue. You, as a sysadmin or someone writing a script that uses DNS, might not really like this service. Just like someone who is trying to take celebrity photographs might not like the Punch-in-the-Face service. But the fact is that this service is provided. And that there are a LOT of people who not only don't see this as a problem - but like it. Or at least think they do.
That is why Verisign thinks they can get away with this - the average person sees a benefit here and sees no drawbacks. The average person watching a boxing match also just sees the benefits and not the drawbacks. Until it is made clear why this isn't as good as it appears, nobody will care. Chances are, nobody will care anyway.
The point of standards is that you can rely on them. The internet standards are decided on a lengthy consensus process, and at this point the basic protocols of the internet are only changed very slowly and for very good technical reasons. Thus, once you have implemented a service or component based on a standard protocol such as DNS, you can be happy and count on not needing to maintain the component any more. It would set a horrendous precedent if internet infrastructure could be changed at will for marketing reasons, with no repercussions. Suddenly *every* piece of software relying on internet would need a maintenance team ready to change them at a moment's notice. This costs a lot of money, especially for services that are ready, done and just work.
Many spammers fake domain names. Spam filters check to see if the domain is real and will reject bogus emails. VeriSign broke that by making all domains valid.
In addition to web traffic, they are also intercept email traffic. So if you mistype an email address, they will get the email and keep it and you won't get a bounce.
The Register has an article about how VeriSign Broke My Printer.
The Register also reported that VeriSign is using Web Bugs.
-- Don't Tase me, bro!
Hi,
There's a petition available. Now I don't know exactly how effective it will be, but signing is more effective than not.
http://www.whois.sc/verisign-dns/.
rgds
Alan
Tequila - drink of the gods.
...and hang tough.
After all, the IAB says here that "We must emphasize that, technically, this was a legitimate use of wildcard records that did not in any way violate the DNS specifications themselves."
If the decision-makers at Verisign cared about good engineering practice, they wouldn't have done what they did.
They probably regard their own actions as just "sharp business practice" and are probably patting themselves on the back for having found a loophole in the DNS specification that they can use for their own profit.
I don't think jawboning from ICANN, the IAB, or anyone else will have much effect. I don't see how anyone short of the Feds can stop them.
I mean, they have contracts with their SiteFinder advertisers. There's money at stake here.
"How to Do Nothing," kids activities, back in print!
There is an available patch for BIND 8:
.com/.net domains. It was cooked up over 10 minutes of pure anger and has not been properly tested; it would be better to be able to specify which IPs to ignore in the configuration file. Suggestions or improved patches are very much welcomed. (Note that this patch causes SERVFAIL results; NXDOMAIN would be better, but I'm not that well versed in the BIND code.)
This page provides a patch to BIND 8 to ignore the wildcard A record Verisign is now returning for unregistered
This patch was made against BIND 8.4.1.
If you punch the verisign ppl in the face, you can bill me.
"If God created us in his own image we have more than reciprocated." - Voltaire
Once Verisign quits doing it, I revert to the damned MSN page every time there's a type-o.
Why isn't anyone bitching about MS?
So, what happens when Verisigns gets its website hacked again? I would think that this would be a prime target for anyone who wnats to get attention. It's just a matter of time.....
Assuming you have ten fingers,10% is 1 finger... and I know which one I'd give to the gov't.