Slashdot Mirror
OpenDNS As Quick-Fix To DNS Patch Dilemma
CWmike writes "It turns out that problems with the July 8 patch that was rolled out to fix a cache poisoning flaw discovered by researcher Dan Kaminsky are causing headaches for admins. Preston Gralla suggests a 30-second quick-fix, perhaps until everyone is patched up: Use OpenDNS, which has been patched, as your personal DNS. If you run a corporate network and need help getting OpenDNS set up, your best bet is to go to the OpenDNS FAQ page, he writes."
If you run a corporate network and need the FAQ page to help, you should not be running a corporate network.
Then your job should promptly be given to me.
but how does this stop us from being exploided by upstream dns servers?
Like I'm going to switch out my name server on a high-availability server farm, which would require even more testing.
"During the development cycle, we became aware of a potential performance issue on high-traffic recursive servers, defined as those seeing a query volume of greater than 10,000/queries per second," said Vixie.
Emphasis mine.
It's almost as useful as saying the solution to BSoD is Linux. Amusing though. :)
As a rule, I try to avoid applying quick fxes to my servers. After all, if the poster and editor can't even be bothered to spell check, how can I be sure the programmer bug tested their fx? =)
Quick everyone - all of our eggs in the OpenDNS basket!
Just a bit ago my parents bought a new router JUST so they could install OpenDNS to protect me from porn... for once I'm actually glad that did it =P
"Our country is not nearly so overrun with the bigoted as it is overrun with the broadminded." -Archbishop Fulton Sheen
So we can replace possible random DNS hijacking with guaranteed DNS hijacking that's passed off as a feature.
Didn't we get extremely upset at Verizon when they served up adverts and returned bogus DNS responses on domains that don't exist?
What's with the constant OpenDNS slashvertisements?
Why would anyone in their right mind replace a distributed system that gets overloaded often enough with a single point of failure?
Have oodles of servers been slashdotted in vain?
np: Spooky - Belong (Open (Disc 1))
"I'm not anti-anything, I'm anti-everything, it fits better." - Sole
Seriously, this solution has been posted in response to every DNS article on Slashdot this past month and has been mentioned by just about every article talking about the issue.
Does Slashdot really need to post links to Computer World that rehash was has been discussed 100 times already?
ÕÕ
Thankfully, I've been using OpenDNS for almost a year now.
Given the near fanatical privacy concerns on Slashdot, I'm surprised nobody is screaming over this "recommendation." Imagine how valuable it would be to know every web site visited by "millions of people a day." Does anyone think the for-profit company isn't mining then reselling the lookup->client-ip information?
On a technical issue, how effective is their service? I've had hotel/hot-spot links that were proxying DNS queries regardless of my settings. It seems to me that unless you know that your ISP's DNS is way broken and that they aren't intercepting DNS queries, this is of questionable use.
No.
OpenDNS does terrible NX-overriding and other useless, annoying things (logins, etc..)
Instead, just use public, geo-distributed DNS servers which FOLLOW RFC and are patched. Here are the standard suggestions (Level7):
4.2.2.1 through 4.2.2.6.
These have good randomness and are multi-cast addresses for DNS servers all over the country. They are VERY fast in most areas.
How much does Slashdot get paid for running this story?
I wonder how OpenDNS' performance with more users using it due to this flaw.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
4.2.2.1 through 4.2.2.6.
^^This AC speaks 100% solid truthnuggets.
for my home and to address the privacy concerns have written a script which deletes my history automatically, I don't have to personally log in to do it. In any event, I don't care if OpenDNS knows I made a lookup request for any of the sites I visit. If I really want to cover my tracks, I would not use it. However that said, I would never, ever, recommend this service for an enterprise.
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
Ok, so I can deal with all the 'turfing on EVERY FUCKING DNS story that slashdot posts. Fine. I just ignore it and move on.
But now we're getting editors astroturfing..their..own site...
opendns isn't that special. I've looked at it. Anybody who uses it for a corporate network should be shot. You are purposely exposing your internal users to the whims of an external company.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
I use opendns because it allows me to manually refresh the cache (opendns.com/cache) when I am making name server changes on my domains. Then I know immediately if the changes are correct and will propagate to the rest of the internet eventually.
Thanks, learn something new (and useful) daily! I use OpenDNS currently, but wow, response times alone are amazing! = 10ms to the 4.* servers and ~100 to OpenDNS. I might still stick with OpenDNS for now since I use some of their features, but this is certainly food for thought and a useful tool when I get stuck without DNS during some of my travels -- very easy to remember IPs :)
It could be that the only purpose of your life is to serve as a warning to others.
I remember being stateside and getting to control my choice of DNS server. That said, many small third-world ISPs and plenty of colleges and other overly-controlled environments where bandwidth is expensive NAT you and run transparent proxies, locking you in to the DNS server used by said proxy and, even if the stray packet does get to OpenDNS, prevents you from using ddclient or anything else to effectively manage your settings there.
How 'bout an option for us? What ever happened to Tor? Any similar vulnerabilities there? How does it handle DNS?
I'm still using my own BIND installation to bypass Sweden's insane filter system. I've applied the patch now.
I've just had a read around the opendns site, and it seems like a marketing thing more than a good technical idea.
they appear to make their money by sending you to an advertising site whenever a name doesn't resolve. to me, this seems a bad idea imagine the scenario - 'hey bob, the kitties getting a bit empty you know' - 'not a prob boss, just let me tweak some dns resolver timings'
also, their idea that they are 'quicker' because they use a 'large' cache is also bobbins. a dns time to live (ttl) is set by the domain owner, and with very good reason. if you host a website that you're about to change the ip address on, the best way to do it, is to set the ttl to zero, so every machine needs a fresh lookup, then as soon as the move is made, every box on the internet automatically finds it. after that you stretch the ttl back to normal again.
if you artificially change the cache time, you'll get a lot more failed lookups (woohoo! more revenue for opendns!!)
my advice, keep with the dns server your isp is giving, it is (usually) at the end of the wire you're connecting over, and unlikely to be thrashed at all, you need a LOT of dns queries to swamp even a mediocre dns server.
Instead, just use public, geo-distributed DNS servers which FOLLOW RFC and are patched. Here are the standard suggestions (Level7):
4.2.2.1 through 4.2.2.6.
Those aren't actually public DNS servers though, are they? They are private DNS servers which just happen to publicly accessible at the moment. If at some point in the future they block all access from outside their network, which they have every right and incentive to do, you will lose DNS. They have in the past temporarily changed the reverse DNS names for those servers to please-do-not-steal-service.whatever.net, so don't say you weren't warned.
And when it comes to FOLLOWING RFC, I'm pretty sure that "don't use other people's DNS servers" is pretty high on the list.
And when it comes to FOLLOWING RFC, I'm pretty sure that "don't use other people's DNS servers" is pretty high on the list.
And how do you do that? Isn't DNS a hierarchical system, where all the answers you are not authoritative on get resolved through queries to other servers? That implies you can't avoid other people's DNS servers.
Busy helping non technical users of OpenOffice.org - http://plan-b-for-openoffice.org/
Error: it's "Level3", not "Level 7".
Anyway, as far as I can tell, these are intentionally public, and they have been accessible for something like 10 years or more -- no real risk of them going down.
These have good randomness and are any-cast addresses for DNS servers all over the country.
Fixed.
alias sudo="echo make it yourself #" ; # https://pipedot.org/~stderr & http://soylentnews.org/~stderr