Slashdot Mirror

← Back to Stories (view on slashdot.org)

Blocking SiteFinder Service

Posted by timothy on from the masking-tape-on-monitor dept.

apankrat writes "Given VeriSign's position on wildcard redirection service, it looks like it's time for a simplier and more efficient ways of bringing things back to where they were. For those running BIND there is a patch; for those on the client side - there is a dnsfix for Windows and the usual iptables hackery under Linux. Aware of any other clean and easy ways to block wildcarding ? Post below."

3 of 38 comments (clear)

  1. dnsmasq has a fix by hummassa · · Score: 4, Informative

    here.
    version 1.16 is ok.
    others have fixes, too, you can find them in this place.

    hope I have helped,

    --
    It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
  2. or just add a line to etc hosts by coyote4til7 · · Score: 4, Informative

    The way I've dealt with it under both XP & OS X is to modify etc/hosts.

    Under OS X, Solaris, Linux, etc., it's "/etc/hosts". Under Windows XP, it's "C:\Windows\system32\drivers\etc\hosts"

    In either case, add this to the end of the file:
    0.0.0.0 sitefinder.verisign.com

    Wah-lah!

    --

    the clock on the wall says 4 til 7
  3. do NOT blackhole/block 64.94.110.11! by graf0z · · Score: 5, Informative
    ... because then mails to mistyped domains will end up waiting in MTA-queues instead of being bounced immediately (some other protocols may have weird behaviour, too). Instead:
    • Read this and this before you panic
    • ask your ISP for patching bind (or whatever ns-software they use)
    • install a patched bind (djbdns, ...) locally as a caching dns
    • if you have no chance of using a patched nameserver (why that?), you may reject (not: drop) 64.94.110.11:80/tcp only and install one of those patches to your MTA (postfix, sendmail, ...)
    • if you are customer of verisign, ask them for suspending their new "service"
    /graf0z.