Comcast DNS Redirection Launched In Trial Markets

An anonymous reader writes "Comcast has finally launched its DNS Redirector service in trial markets (Arizona, Colorado, New Mexico, Oregon, Texas, Utah, and Washington state), and has submitted a working draft of the technology to the IETF for review. Comcast customers can opt-out from the service by providing their account username and cable modem MAC address. Customers in trial areas using 'old' Comcast DNS servers, or non-Comcast DNS servers, should not be affected by this. This deployment comes after many previous ISPs, like DSLExtreme, were forced to pull the plug on such efforts as a result of customer disapproval/retaliation. Some may remember when VeriSign tried this back in 2003, where it also failed."

Comments

malware

[sopssa]

Another great press release about how it will be helpful and a "service" for users, while the main purpose is just to gather extra advertisement revenue (while breaking internet standards). I mean, this is what malware do. Oh well, atleast these non-us ISP's dont do such dirty acts to their customers here. Time to voice your opinion maybe?

Re:malware

[Shakrai]

while breaking internet standards

What are those? The last RFC that I read was titled "How to make the largest pile of cash while providing the least amount of service". I think it's RFC666 and is the one that most modern day ISPs seem to operate under.....

Re:malware

[xvx]

Comcast is great. So I pay them for an internet connection, the price won't go down, and they get extra advertising revenue from there users. How long will it be until they start injecting ads into websites?

Re:malware

[jank1887]

modern corporate culture demands profit growth. not just continued profit, but growth of profits. how do you expect that to happen in a saturated market?

Re:malware

[jeffasselin]

You over-exploit the natural and human resources of the area where you operate, strip it bare, then move on to the next one?

The problem is that the "next area" is another planet, and we kinda lack the technology to get there for now...

Re:malware

[MrMr]

Have the government outlaw your product?

Re:malware

[hal2814]

Planet? Someone obviously hasn't seen Moon.

Re:malware

[basementman]

How is this different from OpenDNS? OpenDNS shows ads if your page can't be found. That said I much prefer my ISPs ad free DNS service to OpenDNS.

Re:malware

[John Hasler]

> How is this different from OpenDNS?

One actively chooses to use OpenDNS. You get your ISP's servers by default.

Re:malware

[sopssa]

In what way is this relevant to OpenDNS? They actually do the same dirty trick aswell. Just because they have "open" in their name doesn't mean they're great and everyone should use them. They run their DNS servers to make profit from non-existing domains and hell, they even redirect requests to google.com to their own servers.

Thankfully there are open dns servers that dont do such either, for example university in Gothenburg, Sweden: 129.16.1.53 and 129.16.2.53 and several others. Those that have the technical knowledge can also set up their own dns recursive dns servers on their linux box and use those directly (while it fetches the results from root servers)

Re:malware

[Anonymous Coward]

I tried to find this RFC, but when i opened the page, it redirected me to some 404 search page for my ISP.

Re:malware

[Anonymous Coward]

Just wanted to remind everybody that a few weeks ago, another slashdot article about comcast DNS hijacking appeared, and everybody wound up calling this specific blogger a liar.

What if before introducing mass trials, they randomly selected MAC IDs and did this in specific locations? Perhaps that blogger actually did break news.

But then, it wouldn't be the first time we trolled a legitimate story because its legitimacy was hard to validate at the time. :)

Also, this discredits Comcast's massive twitter efforts as ComcastBonnie so kindly made a slashdot account after seeing the twitter output from the article, and told us that the engineers promised no form of DNS hijacking was underway. Underway or not, it was certainly being planned, and coverups should not be appreciated.

Just my two cents

Re:malware

[Anonymous Coward]

OpenDNS redirects www.google.com, not google.com. Just in case somebody wants to verify it and finds that you're full of shit.

Re:malware

[dimeglio]

Easy, through innovation and distinct added value. Shouldn't take a rocket scientist to figure it out but apparently it does. Recently, our ISP decided to offer a brand new service allowing you to double your bandwidth simply by adding another DSL line. Guess what, they are now the fastest growing ISP in Canada.

Schemes like DNS redirection are a scam and should be banned unless they contain no advertising or indirect revenue generation whatsoever.

Re:malware

[Anonymous Coward]

OpenDNS provides a ton of options beyond simple DNS services and they are faster, I realize the trade off and I have the option to use them or not. Most non-savvy users (see 99% of Comcast's customer base) have no clue the problems they are about to get to deal with.

Re:malware

[snowraver1]

I assume that you are referring to Teksavvy and MLPPP. I tried to sign up seeing as I was 3-4 blocks from the CO. I got 5m down and 316k up on an interleave profile. If I got two and tied them togeather, I would have 10/.6m service for about $70/mo. Through Shaw I get 15/1 (acutal is like 22/1) for about $50/month with lower 1st hop latency.

I wouldn't exactly call the MLPPP innovation. It's more like a subpar solution. The real solution is for DSL to not suck.

Re:malware

[jtownatpunk.net]

Yeah, it's exactly the same thing. Except opendns is very clear about what they're doing and any computer or network using opendns must explicity configure their system to use the opends servers. Heck, I'm looking at an opendns redirect right now. It's hard to miss the big opendns logo. And the "Why am I here?" link. And the "did you mean" links. Yeah. Exactly the same "dirty trick".

Re:malware

[Ardx]

I found the press release quite valuable. Being in Oregon, it notified me (seeing as the bstards didn't in email) what they were doing so I could immediately go opt-out.

Re:malware

[geekoid]

No, but innovation.
Plus some epople like them, and a good one churns up the correct address in the top3.

I hate them, becasue I know what mistake a made and can fix it, but for somepeople, this is a value add.

oh, noes more advertising.

Re:malware

[Anonymous Coward]

Really? I've used OpenDNS for over 2 years now, and while yes they do display ads on some bad url typings, I have yet to have any request to google redirected to OpenDNS servers. I have google as my home page. Google is the only search engine I use. I have no issues whatsoever with that happening.

Re:malware

[LuxMaker]

It has been said that being too early is the same as being wrong. Parent illustrates this clearly.

Re:malware

[deraj123]

Try looking at the entire service. So far as I have been able to tell, you can turn off every single one of their "features", giving you a simple, straightforward dns service.

And for those replying to you confused about the google thing - they don't

redirect requests to google.com to their own servers

. What they do is provide a dns entry for www.google.com that points to their own servers. These servers proxy the real www.google.com to strip out some functionality that opendns found particularly offensive (I have not experienced the functionality, and can't say whether I agree or disagree with their views). However, like every other "feature" I've found at OpenDNS, you can turn this off. Yes, at first you couldn't. I stopped using OpenDNS for awhile. Now you can.

Re:malware

[Anonymous Coward]

The last RFC that I read was titled "How to make the largest pile of cash while providing the least amount of service". I think it's RFC666

Actually, for those curious:

Network Working Group
M. Padlipsky
Request for Comment: 666
26 November 1974
NIC: 31396

Specification of the Unified User-Level Protocol

Yeah, yeah, I know... woosh.

Re:malware

[ACalcutt]

the difference is that this is opt-out, not opt-in like opendns or other free dns servers

Re:malware

[Tacvek]

The real nasty issue with these services are that they are claimed to be helpful to users. The issue is that it is not helpful. Modern browsers already provide options to redirect NXDOMAIN's to a search engine, or other useful things.

For example, Google chrome provides a nice page that says "DNS error - cannot find server" in the corner, and provides a helpful search box that is pre-filled with the words found in the domain name. (I have no idea what algorithm is being used to find the word breaks, but it seems to work reasonably well.)

If you have Google Toolbar installed in IE, it does the same thing (except for having Google Toolbar branding rather than Chrome Branding).

Other common search toolbars provide similar services.

I will admit that IE's default error page, and Firefox's default error page are not as helpful to most users, but rather than hijack DNS, why don't you (ISPs) just add the "feature" to the IE toolbar you provide on your Set-Up CD. Those who have no use for such a service don't use those CDs anyway.

Re:malware

[therealkevinkretz]

First, you *choose* OpenDNS. Second, you can configure OpenDNS to behave the way DNS is supposed to behave.

Re:malware

[ACalcutt]

its transparent to the user... unless you register your ip you do not have the option to disable the redirection for example...a ping of www.google.com gives this with charters dns servers

>ping www.google.com
Pinging www.l.google.com [64.233.169.103] with 32 bytes of data:
Reply from 64.233.169.103: bytes=32 time=18ms TTL=244

but when using opendns (without OpenDNS proxy disabled) gives this

>ping www.google.com
Pinging google.navigation.opendns.com [208.67.217.230] with 32 bytes of data:
Reply from 208.67.217.230: bytes=32 time=14ms TTL=49

notice www.google.com resolved to google.navigation.opendns.com

Re:malware

[Anonymous Coward]

They at least give you a service in exchange. It doesn't look like Comcast does. I work in a small office and have everyone using OpenDNS because I was tired of TWC crapping out on me and I can filter (for free) stuff I don't want my people looking at.

I don't have a very restrictive setup, but it's nice to have a free, easy to use, hard for people to get around, not installed on the local client, way to block p0rn.

Re:malware

[HeronBlademaster]

Just a side note, Comcast's CD refused to run on Windows 7... and they provide no other method of self-registering your cable modem that doesn't involve a call to tech support.

Re:malware

[GumphMaster]

Malware asks, "how do you expect that to happen in a saturated market?" You shuffle the available money around between competitors until there are no competitors left then you set your price each year. Eventually you'll fall foul of monopoly laws, thereby ending the endless growth illusion and necessitating deployment of the golden parachute.

In the last large company I worked in this is exactly what they expected from their essentially saturated/monopoly position: each year the percentage by which income should exceed costs had to increase. Given the orders were essentially fixed, the increases came from cutting cost (and by extension quality and timeliness). However, achieving an ever increasing margin in these circumstances is far more likely than convincing a bean counter that you cannot have perpetually increasing profit margins even in an unbounded market. Exponential growth is a bitch with big teeth.

Re:malware

[ScrewMaster]

You over-exploit the natural and human resources of the area where you operate, strip it bare, then move on to the next one?

The problem is that the "next area" is another planet, and we kinda lack the technology to get there for now...

We lack the technology .... but the Borg do.

Re:malware

[ScrewMaster]

The real solution is for DSL to not suck.

I dumped Comcast a few months ago in favor of AT&T U-Verse. I'm on the supposedly 18 mbit/sec tier, and I've been getting 22 so I'm happy. It's not true DSL, of course ... it's VDSL but so far it hasn't sucked. Problem is, once AT&T has milked enough customers from Comcast, they'll probably go back to being who they really are, SBC. Which will suck. But for the time being the service is great.

Re:malware

[misexistentialist]

Customers still only have a finite amount of money. The population simply does not increase enough to allow businesses to make the fistfuls of cash they desire without trickery. The only way to squeeze more money out is to do less and cut costs, while pretending to offer the same service for a modest price increase.

Re:malware

[Anonymous Psychopath]

"How to make the largest pile of cash while providing the least amount of service"

That's just Business 101 stuff. The difference between how much the service costs to provide and how much money you make from providing it is what we call "profit". On the other hand, losing customers by degrading their service experience is bad for business.

The real problem is that in many markets there are still only limited choices for broadband. If you have to choose between DNS redirection or dial-up, what would you do?

Re:malware

[jd2112]

Have the government outlaw your product?

It worked for alcohol back in the '20s and is working for drugs today...

Re:malware

[DrEldarion]

With bandwith use increasing like crazy, who's to say this isn't the alternative to raising rates?

Not that I like it, but I'd prefer this to a more expensive cable bill.

Re:malware

[Jane Q. Public]

We don't lack the technology. That is really not a problem. What we have lacked is the willingness to spend the necessary money and time on it.

Re:malware

[ls671]

Here you go:

http://www.faqs.org/rfcs/rfc666.html

Re:malware

[ls671]

> Those that have the technical knowledge can also set up their own dns
> recursive dns servers on their linux box

Yep, I totally vouch for this as one of the best solution ! ;-)

Re:malware

[Captain Cabron]

after self registering once, the same addresses & procedure works for the future

and don't feel singled out, Comcast's CD also refused to run on Windows XP ;)

Re:malware

[Anonymous Coward]

Another great press release about how it will be helpful and a "service" for users, while the main purpose is just to gather extra advertisement revenue (while breaking internet standards). I mean, this is what malware do. Oh well, atleast these non-us ISP's dont do such dirty acts to their customers here. Time to voice your opinion maybe?

I voiced my opinion, by disconnecting my comcast cable as soon as I had another option available. The only thing comcastic about their service is how comcastically slow and crippled their service is.

Re:malware

[Anonymous Coward]

Does they both give the same search results? Then who cares?

Re:malware

[Spike15]

but it's nice to have a free, easy to use, hard for people to get around, not installed on the local client, way to block p0rn.

How is changing your DNS server hard to get around?

Re:malware

[node 3]

That's just Business 101 stuff. ...

The real problem is that in many markets there are still only limited choices for broadband. If you have to choose between DNS redirection or dial-up, what would you do?

I'd stop dismissing harmful activities as, "that's just business 101 stuff", for starters.

Re:malware

[node 3]

And who's to blame for that? You and your husband John, that's who Jane Q. Public, that's who.

Re:malware

[node 3]

With bandwith use increasing like crazy, who's to say this isn't the alternative to raising rates?

And who's to say there's not a pot of gold at the end of the rainbow? Really, when I word it like that, any absurd notion gains a certain level of legitimacy, such as:

Not that I like it, but I'd prefer this to a more expensive cable bill.

Because somehow Comcast doesn't want more money.

Comcast is going to charge what they consider their optimal rate, no matter what other income they have. If you win a lottery that gives you $1,000/month for life, are you going to tell your boss you don't want a raise? Probably not. Do you further think that Comcast is more honest and generous than you are?

Re:malware

[AlamedaStone]

its transparent to the user

You seem to be arguing against using OpenDNS, but I'm not sure I understand your objection. Why is what they do bad for a consumer (e.g., me)?

Re:malware

[HeronBlademaster]

You want me to walk my mom through changing her DNS server on their wireless router over the phone?

By the way, their "opt out" thing must be a manual process - when you've filled out the form they tell you it'll take two business days (!!) for the change to be made. Now, they could be saying that's how long it'll take for the average DHCP lease to expire, but that's most likely not it; they say they'll send you an e-mail once the change has been made, and besides, I think their DHCP leases are for 24 hours, and there would be no reason to say "two business days" rather than "two days".

Manually changing an account's DNS servers? I smell something fishy.

(I'm not making this up - I just did it myself. Rather than wait two days, though, I'm just using L3's DNS servers until I bother to set up my own locally.)

Re:malware

[psyclone]

Um, this concerns me quite a bit:

These servers proxy the real www.google.com to strip out some functionality that opendns found particularly offensive...

What? That doesn't make any sense. They only appear to proxy the first page, enough to capture what you type in the search box.

Lets examine the evidence:

$ dig @resolver1.opendns.com www.google.com A
www.google.com. 30 IN CNAME google.navigation.opendns.com.
google.navigation.opendns.com. 30 IN A 208.67.216.231
google.navigation.opendns.com. 30 IN A 208.67.216.230

$ whois 208.67.216.231
OrgName: OpenDNS, LLC

Now visit both:
http://208.67.216.231/
http://www.google.com/

Notice anything different in the footer? Say the link that says Go to Google.com

There may be a good faith relationship between OpenDNS and Google, but it still means that OpenDNS is proxying your queries! Thus tracking your search queries.

It appears OpenDNS never responded to the many questions on their own forum

DNS redirection is bad, and proxying to collect information is evil. Both methods are employed by scammers and phishers.

Re:malware

[Anonymous Coward]

The non-us companies have the greed to do it but not the intelligence. Stupid fuckers. Wait and they will discover it.

Re:malware

[Anonymous Coward]

It doesn't take a rocket scientist to figure out. Really. They have just realised that cheating and being fucking fraud bitches is easier than innovation and actually adding value.

Re:malware

[L4t3r4lu5]

This result was brought to you by Whoosh! Search Solutions, hosted by Comcast.

Click here for fr33 v14gr4! Guaranteed member of bigging to be!

Re:malware

[Anonymous Coward]

You want me to walk my mom through changing her DNS server on their wireless router over the phone?

The rare real nerds that don't live in their Mom's basement have secure remote access to the networks they maintain. Seriously, you actually consider that to be an obstacle?

Re:malware

[Salgak1]

And, of course, with the STERLING record of Comcast for customer service, it looks like yet MORE proof of Comcraptic! service to paying customers. . .

Re:malware

[Anonymous Coward]

It's different because you _choose_ to send DNS traffic to OpenDNS. If you want to send your traffic to another DNS server that doesn't show you ads, you have a choice. This article suggests that ALL DNS queries destined for any other DNS server will be intercepted by Comcast which means you won't have that choice any longer. Thankfully they offer an opt-out option but how long will it be before that's revoked?

Re:malware

[Casualposter]

Actually, that's wrong. It's not the public. The government and the lobbyists around the current political military industrial complex do not care about the moon, or the rest of the solar system. They are make heaps of cash and taking control of vast territories on earth and have no interest in spending billions on going to the moon. The US has already spent more money than it would cost to land men on Mars and bring them home on the war in Iraq. As soon as their is a tangible military advantage to owning the moon, it will be colonized.

Re:malware

[rajkiran_g]

Here it is:
http://tech.slashdot.org/article.pl?sid=09/06/09/1731238

Re:malware

[Jane Q. Public]

"They are make heaps of cash and taking control of vast territories on earth and have no interest in spending billions on going to the moon."

Which is a massive and potentially fatal strategic error.

Here We Go Again

[eldavojohn]

Some may remember when VeriSign tried this back in 2003, where it also failed.

Oh yeah, way back in the day. But let us not forget Earthlink's attempt at this or Canadian Rogers Cable or Charter or NJ Cabelvision or ... I'm sure you could find no end to this stream of providers offering their customers something the customers simply do not want.

And I'm pretty certain most of those ended or resulted in customers bitching out the provider. Yet here we go again. Why? Well, that's simple: ad revenue.

Re:Here We Go Again

[northernboy]

If I'm not mistaken (although I often am, sorry in advance) Cox has been doing this for months now, and nobody posted anything about that. If I 'typo' a URL at home, when connected via my (or my neighbor's) Cox cablemodem, I get a Verisign page indicating that www.whateveriswas.com is Under Construction.

Is this not muchly the same thing??

It pisses me off, but not enough to hunt down a better alternative.

Re:Here We Go Again

[Anonymous Coward]

Rogers is still doing it.

Re:Here We Go Again

[Anonymous Coward]

Some may remember when VeriSign tried this back in 2003, where it also failed.

Oh yeah, way back in the day.

Shit. 6 years ago is now "way back in the day"? I'm even older than I thought.

So, I guess, get off my lawn.....

Re:Here We Go Again

[jank1887]

I believe my Verizon DSL service does this. It can be disabled either by changing your computer DNS settings or modem settings depending on which modem you use.

Verizon Support - Opting out of DNS assistance

Re:Here We Go Again

[Anonymous Coward]

There is one difference, comcast is bringing their expertise of how to reduce the customer complaints when screwing them over. Their trick is to offer an opt out. If you complain then simply remove yourself from the program. This way they can keep the people 90% that wont fight for their rights and still increase the ad revenue.

Re:Here We Go Again

[woddfellow2]

Add Windstream to that list.

I was able to opt out of it, though...

Re:Here We Go Again

[rminsk]

To "opt-out" all you have to do is change the last octet of the DNS servers they supply to you to 14. So if Verizon default DNS server is 123.123.123.12 change it to 123.123.123.14.

Re:Here We Go Again

[raddan]

Sprint currently does this with their AirCard service. In fact, even if you try to query a specific DNS server, it hijacks your request and redirects your packets to its own. I discovered this after wondering WTF my DNS server was not operating correctly-- it turns it that my new DNS record had not propagated to Sprint's DNS. Since I run our company's DNS, this is a major PITA to me. Oh yeah, they appear to mess with DNS record TTLs as well.

I'd gladly post examples but I'm at work and my AirCard is at home at the moment.

I would gladly switch to another ISP, but I'm locked-in to a 2-year contract. Unless I can argue that their DNS hijacking violates the TOS, but I doubt it.

Re:Here We Go Again

[woddfellow2]

I never experienced that with Cox Communications. They must not have done that in Tulsa...

Re:Here We Go Again

[nizo]

I have keyboards older than you. Now get off my lawn!

Re:Here We Go Again

[Anonymous Coward]

You can certainly make it violate the TOS. Host some bizarre protocol on UDP 53 and see how they handle it.

Re:Here We Go Again

[Khyber]

No, you threaten to sue them for lost company profits caused by their DNS hijacking and interfering with your work routine, and that you can 100% prove it and have documented everything relevant. That'll get you out of your contract in a hurry.

I just used that to help a motor sports company out here in CA get out of their contract with Comcast.

Re:Here We Go Again

[Anonymous Coward]

I am using a Cox connection right now, with the Cox DNS servers (dhcp gives me 68.105.28.12, 68.105.29.12, 68.105.28.11), and randomstringofletters.com fails to resolve.

I'm connecting through Washington, DC, if that matters.

Perhaps you are hitting specific camped typo-domains?

Re:Here We Go Again

[Anonymous Coward]

and how the fuck am I suppose to do that on a DHCP assigned address? On most cheapo linksys routers I've seen, you either get your DNS from DHCP or you specify a static IP - what if I have no static IP?

I'm going to call them and bitch for all the comcast users I have to support.

Re:Here We Go Again

[ls671]

This is trivial to do, I do it for security reasons on my LAN, it doesn't matter which DNS you query, computers on my LAN always end up querying my internal DNS server.

Of course this breaks internet standards, it takes for granted that only DNS run on the ports queried while one remote server could actually have another application running on these ports :

for redirport in 53
do
$IPTABLES -A FORWARD -i $EXTIF3 -p udp --dport $redirport -m state \
--state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A PREROUTING -t nat -p udp -i $EXTIF3 -d 0.0.0.0/0 --dport $redirport \
-j DNAT --to $PORTFWIP3:$redirport

$IPTABLES -A FORWARD -i $EXTIF3 -p tcp --dport $redirport -m state \
--state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A PREROUTING -t nat -p tcp -i $EXTIF3 -d 0.0.0.0/0 --dport $redirport \
-j DNAT --to $PORTFWIP3:$redirport

done
   

Re:Here We Go Again

[Anonymous Coward]

It's actually something like 4.2.2.1 through 4.2.2.20 ;)

Re:Here We Go Again

[truesaer]

AT&T / Yahoo DSL does this. I really despise it...first, they seem to "lose" DNS entries for sites at times. And second when it redirects you due to a minor typo the address bar get changed and you can't easily correct a single letter typo.

Re:Here We Go Again

[smoker2]

Probably because all traffic is set to go through their proxies. My 3G provider does the same thing. FTP didn't work, even simple HTTP downloads didn't work, until I completely wiped their settings from the phone, and created a new dial up profile, using just the standard username and password which can be found on the net. Suddenly, no more issues.

Re:Here We Go Again

[Omestes]

Using Cox cable in Phoenix, Az and I haven't noticed this. I get the general "server not found" page when I hit a type that hasn't been squatted, or go to "www.whateveriswas.com", as per your example.

This might only be true here, though. It seems we're generally the last to get "improvements".

Re:Here We Go Again

[Anonymous Coward]

haha stupid shit. Routers can have a dns address specified to use whether or not they use dhcp to obtain an ip themselves.

Who's providing a backdoor DNS service?

[argent]

Sounds like time to pick some semi-standard alternate port number and start setting up some alternate recursive DNS servers, something between alt.* and TOR.

Re:Who's providing a backdoor DNS service?

[644bd346996]

Why? It's not like Comcast is going to be intercepting all DNS traffic and routing it through their spammy DNS servers. Only the people who get their resolvers from DHCP (ie the people who don't know enough to care) will be affected.

Re:Who's providing a backdoor DNS service?

[Anonymous Coward]

Manually assigning DNS servers is a pain in the ass compared to using DHCP provided ones. I care, and I would MUCH rather use DHCP assigned servers.

Re:Who's providing a backdoor DNS service?

[TheSpoom]

It's not like Comcast is going to be intercepting all DNS traffic and routing it through their spammy DNS servers.

Why not? As raddan posted above me, Sprint already did this with their aircard service. The huge majority of customers won't notice the difference since they don't know about alternative DNS servers.

Re:Who's providing a backdoor DNS service?

[ZosX]

Why should I care? If I type in google.com and it gives me google what is the problem? If I misstype and it sends me to some cybersquatting bogus search page then oh well, I just type it again. This isn't anything new. I'm sure someone has registered gooogle.com, just to use an example. (well, not totally sure) So now cockcast is doing it on their level. I understand it might suck once in a blue moon when you type something in wrong, but is it the end of the world or a massive loss of our rights? Doubtful. Unless there is something I'm missing here, like it fucking up legitimate dns requests. Oh and has anyone been having a problem maintaining video streams over cockcast lately? Seems like anything streamed is immediately penalized or something. Doesn't matter if it is youtube or anything else......

Re:Who's providing a backdoor DNS service?

[totally bogus dude]

It's a problem because DNS is used by more things than web browsers with human operators. A "this host does not exist" response at DNS-level contains information that a "404 not found" response at HTTP-level does not provide. And that's even assuming they have the common sense to make their "default search page" return an error status code; it's highly likely it'll return an OK status, since as a general rule the people who understand how the internet works at a technical level will refuse to be involved in these kind of projects, which means people who don't really understand what they're breaking are in charge of it all.

When Verisign did this a few years ago, they set up an SMTP rejection service so that mistyped domain names in email addresses would result in an immediate bounce, rather than sitting in the mail queue attempting to be delivered to an address that didn't accept mail for a few days before finally being bounced. This service didn't actually work properly, with the result that if you had more than one incorrect domain in the recipient list, you would get a bounce for only some of the wrong domains. This is because the people that implemented the service didn't think it was necessary to actually parse the SMTP commands, and instead just responded with a scripted "Hello, Ok, Reject" over and over again regardless of what the input was. Needless to say, this was very confusing for actual mail servers.

In addition, people using web browsers that are configured to do something useful in the case of a non-existent domain name get screwed, because now every domain resolves and serves up web pages. If Comcast's "not found" service is not as good as whatever their browser was previously doing, too bad.

At least Comcast provide an opt out, and most of their customers are presumably using Comcast's SMTP relay servers, which one would hope use real DNS servers, so the problems should not be as widespread as when Verisign did it to the entire .com namespace. However whenever you change how a fundamental part of anything works (and has worked for decades) there will always be fallout and unanticipated issues. This is also complicated by the fact you can't differentiate DNS lookups by web browsers from DNS lookups from anything else; with a result being that even when you do anticipate issues, you can't provide a 100% adequate solution to mitigate it.

Re:Who's providing a backdoor DNS service?

[argent]

It's not like Comcast is going to be intercepting all DNS traffic and routing it through their spammy DNS servers.

I remember when I believed stuff like that. That was before all the reports of ISPs redirecting 25, 53, 80, and other usual suspects through their transproxies. Yes, there's every reason to assume that Comcast will be doing exactly that.

Re:Who's providing a backdoor DNS service?

[ZosX]

Thanks for clearing that up!

Call it what it is

[wilsoniya]

Didn't RTFA, but lets call a spade a spade--this is typosquatting

Re:Call it what it is

[TheRealJobe]

No it isn't they are not directing you to a externally developed app, their simply adding a GUI interface to a bunk DNS return. They aren't forcing you to an external domain and you dont have to click on any of their links. Lets call this what it is, overeacting think tanks.

Re:Call it what it is

[Anonymous Coward]

Totally agree.... corporate chumps.

Re:Call it what it is

[Anonymous Coward]

BS they are in no way 'adding a GUI' to a DNS.

They are mucking with DNS to force users to their page with (potentially) ads and other garbage instead of letting the normal browser error page come up.

If anybody actually wants this it should be implemented in the browser NOT in DNS.

Doing it as part of DNS is worse than typo squatting. It's practically browser hijacking. It's an absolutely terrible and dangerous idea.

P.S. OpenDNS is just as bad. It's a crappy solution no matter who does it.

Re:Call it what it is

[Anonymous Coward]

I have a question about this. If someone typo's something in my domain, I created my own custom 'page not found' that .htaccess redirects invalid pages to.

Will this cause people to no longer see this custom 'page not found', and replace it with their own? Because if so, that'd piss me off.

Re:Call it what it is

[Zontar_Thing_From_Ve]

This reminds me of a little known incident that happened in the mid 1990s. For a while, AT&T ran a service called 1-800-OPERATOR where you could call this number and get AT&T to connect you to a long distance call. For those who don't know, we're required (at least in most of the USA if not all of it) to pick a long distance service provider. That company does not have to be who you get local telephone service from. It was possible to place long distance calls with someone other than your long distance provider by simply dialing an access number that belonged to that company and you would get billed for the call from that company. So for example you might have, say, BellSouth as your long distance provider, but you could dial an access number and place calls on Sprint if Sprint offered a better rate. No need to change providers that way. So AT&T decided that it would be smart to get in on this too and lower their rates. So the way it worked was that you called 1-800-OPERATOR and someone at AT&T would connect you to your long distance call and charge you whatever rate AT&T had for the service. AT&T promoted this service on national television commercials and spent a lot of advertising money on it. Anyway, I had a friend at the time who worked for MCI in their marketing department. She told me that MCI had reserved the telephone number that corresponded to 1-800-OPERATER. MCI spent zero dollars advertising and simply waited for people who couldn't spell to call that number and they placed the call for the person and made the money off it. She told me "You would not believe how much money we made off this". Some months after the campaign started, AT&T quietly pulled the plug on it. I always assumed that too many people couldn't spell "operator" correctly and they were tired of giving business to MCI for nothing.

Re:Call it what it is

[Hurricane78]

Yes it is. What you described is the very definition of typosquatting, if you add the point of what you see on this "GUI interface" (which is the job of your browser to create, btw.)

And if you think about them paying for servers to display this "interface", you will know that there is a reason they do this:
To make money. Obviously.

And what is the reason, that typosquatters add a "GUI interface" to unused domains?
Also to make money. Obviously.

Point proven. :)

Re:Call it what it is

[FictionPimp]

I love the whole idea of long distance calling. Send telephone signal to the house next door..oh that's free. Send it to the house across town? Oh thats 8 cents a minute. Send it to japan, oh that's 15 cents a minute.

Send a voip signal over the internet to japan..oh that's free. See a little known fact that data is more expensive when sent by phone.

Re:Call it what it is

[typosquatting]

Totally agreed - it is absolutely typosquatting on a massive scale.

Many people don't realize that there's TONS of traffic going to typo domains (whether registered or not). For instance, youtuve.com (notice the v instead of the b) got 358,751 visitors over the last 31 days. It redirects to another domain for cloaking purposes, but here is the traffic report. This level of traffic provides the financial incentive to implement these DNS schemes.

By the way, there's a new, free typosquatting scan tool at aliasencore.com. It shows you all the registered .COM domain names that are one character misspellings of any Alexa top 100,000 site you enter. It also displays screenshots of those typosquatting sites. It's a nifty way to get a quick idea of the rampant growth of typosquatting. Here's an example that shows the 431 registered .COM domain names that are one character away from google.com.

Full disclosure: I am Graham MacRobie, the CEO of Alias Encore, Inc. We help companies recover cybersquatting domain names, but we focus solely on "slam-dunk" typosquatting cases (obviously only registered domain names). I can speak from personal experience in this field that the very last thing we need is wholesale typosquatting at the DNS level.

Re:Call it what it is

[swb]

Didn't some third party long distance providers create services called "Whatver" and "You Choose" and "I don't care", so that when people were asked for a carrier and said those things they actually got a carrier with that name (who also charged $.25/minute)?

Re:Call it what it is

[geekoid]

And you get what you pay for.

VOIP to Japan is a pain in the ass quality wise.

Re:Call it what it is

[Anonymous Coward]

See a little known fact that data is more expensive when sent by phone.

Witness IM over cell phone. (never mind that the data fields in which texts are transmitted are getting sent all the time, whether they have text in them or not)

Re:Call it what it is

[TinBromide]

there was a company called "Your Long Distance Company" or "Your Phone Company" (i forget which) that would call you during dinner about switching something or other. So people switched and got hit with higher charges.

Re:Call it what it is

[SL Baur]

Will this cause people to no longer see this custom 'page not found', and replace it with their own? Because if so, that'd piss me off.

That would depend on the typo. Mistyping http://www.bar.com/index.html as http://www.bar.com/index.htm would still go to your site, assuming you own bar.com. Mistyping as http://foowww.bar.com/index.html, would presumably be redirected if you don't have a DNS record for `foowww.bar.com'.

Re:Call it what it is

[Anonymous Coward]

For those who don't know, we're required (at least in most of the USA if not all of it) to pick a long distance service provider.

Not I. My copper line is used for dial-up and I can't dial long-distance. No long-distance carrier is selected.

Re:Call it what it is

[Phroggy]

No, typosquatting is registering a domain name similar to a popular domain, e.g. goggle.com, so that when someone makes that particular typo when trying to reach the popular web site, they'll end up at your site instead. The key here is that typosquatting involves registering a domain name, thus preventing anyone else from registering the same domain for their own legitimate purposes (e.g. selling swim-related accessories), hence the "squatting" part.

This is completely different. Comcast isn't registering any additional domains; they're not preventing anyone else from registering whatever domains are available. What Comcast is doing is configuring their DNS servers so that for any domain that doesn't exist, instead of returning a "this doesn't exist" message (NXDOMAIN), they're returning the IP address of their own web site. This is similar to typosquatting in that the end user could end up an a web site they weren't expecting if they make a typo while entering a URL, seeing a page of advertising instead of just getting an error message. However, while typosquatting is merely annoying, what Comcast is doing breaks things.

The simple explanation is that the Internet is not the World Wide Web. Domain names are used for other things besides web sites, and getting an IP address back for a domain that doesn't exist causes all sorts of technical problems. For example, to cut down on spam, my e-mail server automatically rejects any incoming e-mail where the "From" address is at a domain that doesn't exist, but if my DNS servers lie to me, my e-mail server will think that all domains exist, and it won't reject anything.

As long as your ISP makes it clear what they're doing, and provides a simple way to opt out, this shouldn't be a huge problem. It was a huge problem when Verisign tried to do it, because they're not an ISP; they operate the Registry for all .com/.net domain names, so they are the authoritative source that everyone has to rely on. You don't have to use your own ISP's DNS servers, though (unless they firewall port 53, but that's not common).

Re:Call it what it is

[DigiShaman]

Good point, and I agree with you. Perhaps what Comcast and OpenDNS are doing should instead be called "typoredirection" for the sake of future discussions on this topic.

Re:Call it what it is

[Anonymous Coward]

This also happened when making collect calls when the operator asked you what telco you wanted to use. Telco's named "Anyone" and "I don't care" showed up on the scene to charge the people who gave that answer ridiculious rates.

Re:Call it what it is

[zsadecki]

Which is likely why it became 1-800-CALL-ATT. And Carrottop even spelled it out multiple times during the commercials so if you didn't have the capacity to spell those words they forced it into your long term memory through repetition...

FYI for Colorado

[Anonymous Coward]

Qwest has 20Mb/s FTTN DSL installed in much of Colorado now. Qwest isn't a panacea either but is considerably less heinous than f**king Comcast. They're running promotions right now as the FTTN installed base is new.

Re:FYI for Colorado

[Anonymous Coward]

You know what, fuck Qwest. They do the same goddamn thing. Sure you can opt-out but they shouldn't do this in the first place. It breaks the web. They also block traffic and filter ports and raise rates. Fuck them.

The Sky isn't faling.

[TheRealJobe]

Before you go calling me a troll, just hear me out, this isn't that big of a deal. It doesnt redirect you to another 3rd party site owned by the NSA, it simply provides a web GUI that suggest sites on what the system thought you wanted to see. You dont have to go any sites you dont want to. The sky isnt falling.

Re:The Sky isn't faling.

[Shakrai]

The sky isnt falling.

It is if you were foolish enough to believe that the RFC/protocol standards would be obeyed and wrote code that relies on a NXDOMAIN response to detect a bad hostname. Now you are going to an 'A' record that points to a Comcast server. This will break various applications but they don't give a damn because it's all about the ad revenue and who uses the internet for anything other than surfing anyway?

Re:The Sky isn't faling.

[Anonymous Coward]

Don't you have a mass mail marketing webinar to attend somewhere? Get lost.

Re:The Sky isn't faling.

[Maximum Prophet]

No, it will only show those pages that have paid to be listed as what you want to see. (at least after an initial trial run)

This could easily be done in the browser in a non-evil way. When you type in a name and get a non-response, similar names typed after would be recorded. Then, when you make the same spelling error, gooogle.com, it takes you to where you want to go. Since it's in the browser, people could edit and share their commonly misspelled domain names.

Re:The Sky isn't faling.

[hobot]

Yeah, because a GUI suggesting sites is what I was trying to go to in the first place!

Re:The Sky isn't faling.

[s7uar7]

There's more to the internet than just the www.

Re:The Sky isn't faling.

[xvx]

True, for anyone tech savvy they would know better. But what about people that don't know better and that extra ad revenue. Will that be passed back to the customer? Absolutely not.

Re:The Sky isn't faling.

[mdmkolbe]

Providing a nice GUI on a DNS lookup fail is the job of the web browser not the DNS server. DNS is infrastructure not user interface.

Re:The Sky isn't faling.

[Anonymous Coward]

As others have mentioned before, DNS is unaware of what you need it for and some of us use it for other things than just surfing the web (read : HTTP protocol).

Getting a valid IP on an invalid name while trying to set up an FTP, SMTP, POP, etc connection (to name a few) could break the app (which assumes the internet standards are obeyed).

Re:The Sky isn't faling.

[doshell]

It doesnt redirect you to another 3rd party site owned by the NSA, it simply provides a web GUI that suggest sites on what the system thought you wanted to see.

It doesn't redirect you to a third-party site owned by the NSA; it redirects you to a third-party site, full stop. This not only breaks a whole host of applications relying on DNS to inform them that a domain name doesn't exist, but it is in violation of the standards that hold the Internet together.

Re:The Sky isn't faling.

[Anonymous Coward]

Doesn't IE already do that by redirecting you to bing.com with a search pattern?

Re:The Sky isn't faling.

[NeverVotedBush]

When you find a way to do a job cheaper or faster, or that brings in more revenue, do you tell your employer it's OK to lower your salary a corresponding amount?

I'm betting you don't.

Re:The Sky isn't faling.

[SCHecklerX]

If a domain name does not exist, I want my systems to receive an error telling them so, not be redirected to a system that they were not expecting to be directed to.

Re:The Sky isn't faling.

[Tony Hoyle]

If you think it's OK to hijack DNS think about what happens if you mistype an email address, or what happens when your configured NTP server goes offline.

Re:The Sky isn't faling.

[TheRealJobe]

I cannot begin to comprehend your example.

Re:The Sky isn't faling.

[edalytical]

It's not the same thing jackass. We are paying for a "standard" connection to the Internet at rate X. If a company is going to break that standard and make money in the process we are no longer paying for "standard" Internet at rate X. The company is making X+b for a broken Internet connection and the customer is getting F*cked. The least they could do is offer the connection at X-b. Employee != customer. An employee serves the company, the company serves the customer. Got it?

Re:The Sky isn't faling.

[Anonymous Coward]

Providing a nice GUI on a DNS lookup fail is the job of the web browser not the DNS server. DNS is infrastructure not user interface.

That's the old way of thinking, man. You've got to change the paradigm, baby! DNS as user interface is the way of the future!

Re:The Sky isn't faling.

[nizo]

It is sorta like being run over with a free car. Or something like that.

Re:The Sky isn't faling.

[Anonymous Coward]

Dude, take your meds and calm down.

Re:The Sky isn't faling.

[blueg3]

think about what happens if you mistype an email address

Okay. If I'm using a Comcast SMTP server, a webmail service, or any SMTP server not behind Comcast, then this doesn't affect it at all. If I or my organization (whose ISP is Comcast) is running their own SMTP server (as a Linux user might well do), then the mail still won't be sent, unless Comcast provides valid MX records for their redirect domains, which would be a stunningly bad idea.

what happens when your configured NTP server goes offline

The same thing that happens when it goes offline without redirection, unless by "goes offline" you mean "has its domain name expire". If the latter, your NTP client will attempt to contact the IP address for the redirection server... which will only produce interesting results if that server happens to be running an NTP server. That would be a bad idea, just like above.

Re:The Sky isn't faling.

[NeutronCowboy]

Yeah, but how do you make money from end-users when you're an infrastructure provider? After all, not breaking standards to avoid making money is just not right.

Re:The Sky isn't faling.

[Jedi Alec]

When you find a way to do a job cheaper or faster, or that brings in more revenue, do you tell your employer it's OK to lower your salary a corresponding amount?

No, I tell him I that I can now do the same job in 8 instead of 16 hours so he can give me 8 hours more work each week..

Attempt?

[XanC]

Aren't they still doing it? I know Earthlink is. Morons.

Re:Attempt?

[Timex]

I use Earthlink for an ISP. I also know how to change my "default" DNS servers, so I don't have to deal with their antics.

If people don't like what the ISP does to things like this, they should either learn how to fix the problem (because their ISPs will simply say there IS no problem because it's functioning as it was designed to do) or look for another ISP.

Why do I stay with Earthlink? Simple:

• Cable modem service is cheaper than DSL rates in my area, given identical UL/DL speeds.
• I don't have cable TV (by choice), so having cable modem service alone would be higher with Comcast, the Cable provider in my area.
• Eathlink service (in my area, at least) is "powered by Comcast". If there are broadband-related issues, Earthlink will work with Comcast's people to work out any problems.

Generally, I'm pleased with Earthlink.

Re:Attempt?

[Anonymous Coward]

This is still a bad concept in general. I really think that the revile echoed in the blog post 3 wks ago for those who suspected that may have been a trial is accurate. Who is comcast to tell my DNS Query that A = B != C when A = B = C? It defeats the purpose of net neutrality and just because you are capable of changing your default dns servers (not trying to troll here, just pointing out) it has to be kept in mind that the vast majority of 'end users' on internet connections could care less what DNS is until their browser tells them that gmail.com, facebook.com, myspace.com, etc.. 'Could not be found.'. Even then, the first thing that they will assume is the internet connection is dead. Granted, it's highly unlikely that the vast majority of users relying on those services will even notice, as if you blocked one of these services the users would run away so fast it would be amazing. Think about it, Comcast owns Fancast.com, which already linked in tons of hulu content. What if they suddenly redirected hulu.com -> fancast.com? I'd immediately have to go use OpenDNS, because the fancast website kinda sucks in comparison, imo. But preferences aside, the ability to assert that kind of dominance over content SHOULD violate some law, opt-out or not (p.s. ComcastBonnie if you read this and want to remind us it's opt-out again, that's great. The end users have already said they received no notification prior to reading the press release, and it should have been opt-in if you are going to keep everyone in the dark until you're already doing it, that was a very poor business decision that will leave numerous end users pissed off at you)

Opt Out page is Slashdotted

[Itninja]

Or is it Comcasted?

Re:Opt Out page is Slashdotted

[Macrat]

Or is it Comcasted?

Comcastic!

Re:Opt Out page is Slashdotted

[NeverVotedBush]

I keep hoping someone would take their new commercial with the woman walking through the virtual world kind of chanting and substitute a really raunchy parody chant... g . o . a . t . s . e ... r . o . f . l - ing...

Re:Opt Out page is Slashdotted

[Seumas]

The best way to opt-out is to just use OpenDNS in the first place (as long as you don't do anything that requires a proper DNS response when a location doesn't exist). Functionally the same as Comcast redirecting you, I suppose, but at least they don't get to profit off of it.

Best DNS alternative w/o redirection?

[FreakinSyco]

I've given up on my ISPs (SuddenLink) DNS, it redirects. I've given up on OpenDNS, it redirects. I've given up on DNS Advantage, as they redirect.

All I want is clean unfiltered DNS.

Re:Best DNS alternative w/o redirection?

[Anonymous Coward]

4.2.2.1

Re:Best DNS alternative w/o redirection?

[Anonymous Coward]

Run your own.

Re:Best DNS alternative w/o redirection?

[sakti]

I use Level3's anycast dns resolvers. They are fast and work great. Pair them with a local dns cache and you'll be golden.

4.2.2.1, 4.2.2.2, 4.2.2.3, 4.2.2.4, 4.2.2.5, 4.2.2.6

In case you don't know about anycast.

http://en.wikipedia.org/wiki/Anycast

Re:Best DNS alternative w/o redirection?

[Anonymous Coward]

install BIND and use that

Re:Best DNS alternative w/o redirection?

[Anonymous Coward]

All I want is clean unfiltered DNS.

There is no such thing. All DNS is subjective. There is no single for-sure authority; there is simply popularity. Most people say their own ISP is the final authority, and most ISPs (Comcast is being an exception here) defer to ICANN. Comcast is saying ICANN is right about what exists, and wrong about what doesn't.

DNS is all opinion and trust. In fact, it's no different than search engines. Google maps a string to one DNS name (and then somebody maps that name to an address), Yahoo maps a string to another DNS name.

So be precise: You don't want unfiltered DNS; you want ICANN DNS. (At least until the next news story of ICANN screwing things up yet again -- but while it'll make you resent ICANN you won't want to leave them, because nobody chooses ICANN for being the best; they choose ICANN because most other people have chosen ICANN.)

Re:Best DNS alternative w/o redirection?

[c0y]

Open DNS recursion is it's own form of evil. I'm waiting for the day that Level3 locks those down to their own networks, and hundreds of our customers call us to complain "the Internet is broken" (it seems almost everyone knows those IPs and many choose to use them, despite the fact that our own DNS service is anycast and will always remain Redirect-free because we don't treat it as a potential revenue source, but a vital part of Internet infrastructure that ought to be inviolate).

Google "DNS recursive amplification" to see what I mean about the evils of open resolvers. Hell, even closing down recursion doesn't stop the madness since root hint amplification is being abused too.

We drop all IP traffic directed to our anycast IPs at our borders. You can't even ping them. query-source is not a listen-on address so it is impossible to get any type of response from our named. I predict most other ISPs being forced to do something similar. The poisoning threats are also ever on the horizon and this is another prudent safeguard.

Re:Best DNS alternative w/o redirection?

[oasisbob]

Level3 does have an awesome DNS cloud (I use them for diagnostics all the time), but using them longterm isn't the best idea.
According to (at least someone who claims to be) Paul Vixie, Level3 said in 2008 that they plan to discontinue the service to non-customers:

Note: they also said they would eventually restrict 4.2.2.1 and 4.2.2.2 to customer access only, so if you're not a Level(3) customer, you probably need to find another solution. Almost every ISP has recursive name servers, and if yours is honestâ"sends you an error rather than advertising if you type in a nonexistent domain nameâ"you should be using it. If your ISP is dishonest, then you should consider opendns or neustar's dnsadvantage, or do what I do, run your own RDNS. I use BIND, but I've also heard good things about PowerDNS and Unbound. There are also many non-free RDNS servers.

Re:Best DNS alternative w/o redirection?

[Anonymous Coward]

Been using 4.2.2.4 /2 as my dns servers for years.. And i'm a crapcast customer.

It fails alot less (never) than comcasts dns servers fail (often).

I so wish i could get rid of comcast. They are STILL doing the spoof reset your connections trick to stop p2p. Remember the one they claimed they stopped doing? Yeah... they didnt. And it also works on multiplayer gaming. joy.

Reset connections. 447. And i've only been online for an hour so far trying to play a game. At least the game client is good about resuming it when comcast spoofs a close to both ends.

It also cuts off every night during the emergency broadcast test. the WEEKLY test. that they do every night. the test that is so fuzzy and distorted that if i ever needed to get real info from the EBS... i'd be crap outta luck. Sometimes they even forget to turn the test off for several hours..

I so hate comcast. Really. But other options? HA! hahahaha. not here. :\

Re:Best DNS alternative w/o redirection?

[SL Baur]

I use Level3's anycast dns resolvers. They are fast and work great.

Hmmm. Those appear to be IP numbers I get via DHCP.

They are not trouble-free. I frequently see issues resolving certain top-level domains. .jp is flaky as is .info.

At least they don't redirect.

Re:Best DNS alternative w/o redirection?

[Nethead]

Verizon use to hand out the 4.2.2.n set on DSL here in NW Washington State a few years ago. I've used them since thinking they were VZN's. Nice, easy to remember addy and type that I also use to ping when testing for 'net connection. If, as stated above, Paul says they are going to lock them down then I'll have to get off my ass and get named running somewhere in the house.

I use to always like to run my own DNS but after a decade I just went with BlueRazor (godaddy) since I'm paying them for register service anyway and the offer it with the package. They have NOCternals that take care of problems while I sleep.

Re:Best DNS alternative w/o redirection?

[Anonymous Coward]

These are the same numbers I get on my router from Verizon DSL. I didn't know they belonged to someone else!

I just signed up the competition...

[GPLDAN]

It was *MUCH* easier for me to sign up for basic TV + internet with Comcast than what I ended up doing. I wanted to keep everything at the magic $100/mo. number, so I went with AT&T - DirecTV partnership, where they give you DSL and a dish and DVR, and put it all on one bill. My DSL is 3Mb down/768kb up, where a Speakeasy test at my neighbor showed almost 12Mb down and nearly a full meg up. When he asked "why would you choose that?" - my answer was simple: Comcast.

AT&T doesn't touch my bandwidth. They don't cap it, they don't filter it - they aren't keeping a database of my URL lookups. That's worth a great deal to me - and Comcast will never get my business. I urge everyone else to do the same, even if it is some other DSL provider or dish provider.

Re:I just signed up the competition...

[plaiddragon]

AT&T ... they aren't keeping a database of my URL lookups7.

Until the NSA asks them to. Let's not pretend that AT&T isn't evil.

Re:I just signed up the competition...

[tekproxy2]

AT&T Caps my bandwidth. They charged me an extra 20 dollars a few months ago for going over the limit. I buy their "ultra mega super elite" DSL service and upload an average of 40kb a second every second of every month. They sent me an e-mail notifying me about this wonderful little change to my AT&T e-mail address which no one fucking uses. I first saw the change on the bill. Thanks AT&T.

Re:I just signed up the competition...

[NeverVotedBush]

I agree completely on not going with Comcast. I go with Qwest for my DSL.

But you do know about the special rooms on the AT&T trunk lines that monitor all the traffic for the NSA, right?

Not that me using Qwest stops my traffic from being monitored too, but at least I am not directly supporting AT&T (or Verizon) and their habit of handing over whatever information is asked without requiring a search warrant to back it up.

Qwest refused to hand over data without a search warrant.

Re:I just signed up the competition...

[Anonymous Coward]

AT&T is 'trialing' capping in some areas. So you may still have a cap.

http://stopthecap.com/category/providers/att-dsl-fios/
http://stopthecap.com/2009/06/25/beaumont-area-att-customer-gets-himself-exempted-from-internet-overcharging-can-you/

I urge others to tell everyone that a duopoly in many areas is not acceptable. The providers of the service need to be separated from the providers of the cable.

Re:I just signed up the competition...

[ElSupreme]

I am in the same boat. But I opted for an antenna. But I don't have to deal with my internet not being there. I don't have to every reset my modem. And most importantly I don't have the pelasure of dealing with Comcastic customer serivce, or their prompt contractor installers.

Actully about 5 years ago I made the decision never to give Comcast another dime, and so far it has paid off. I chose an apartment complex based largely on their use of Charter cable. And decided against getting cable in my current apartment. My next apartment is going to be Charter. Because of their horrible customer service and spotty at best internet uptime.

And don't get me wrong ATT is not great, but they are the better of the duopoly controlling all of my internets.

Re:I just signed up the competition...

[HeronBlademaster]

It was my intention to avoid Comcast when I moved to Washington, but it ended up being a choice between "Comcast in an affordable three bedroom apartment" or "Verizon FiOS in a neighborhood I can't afford". Seeing as how I can't afford something I can't afford, I chose the three bedroom apartment.

Technically I had another choice (Ygnition) but they provide a shared T1 and cap the shared line at 1.1 megabits per second... which doesn't matter much, since a T1's max speed is 1.544 Mbps. Oh, and it's more expensive than Comcast. I suppose I could have gone with dialup, but my anti-Comcast resolve isn't quite that strong. I want Verizon to bring FiOS to my area, but the chances of that happening anytime in the near future are slim.

Oh well. Comcast gave me their minimum cable TV service for free when I signed up for internet, which only gets local channels plus the shopping stations. Plugged in my new HDTV last week, and found that I get all of their normal base package channels. Yay for free TV! Maybe I shouldn't post this online...

Re:I just signed up the competition...

[op12]

AT&T doesn't touch my bandwidth. They don't cap it, they don't filter it - they aren't keeping a database of my URL lookups.

While I doubt that's true even today, it's only a matter of time before they implement bandwidth caps. I don't think any major ISP is not at least trying them out. AT&T started trials last November. http://gizmodo.com/5075831/att-monthly-bandwidth-caps-are-here

A LOT of ISPs already do this...

[nweaver]

I don't want to name names, but Netalyzr showed that several major ISPs already do this, and allows you to check for yourself what the behavior is on your network.

Comcast is following the lead of other major ISPs which have been doing this for some time now.

Re:A LOT of ISPs already do this...

[rliden]

-- Warning Slightly Off Topic --

Thanks for posting this tool. I've been experiencing unusually high packet loss for the last day and a half. This tool is really helpful for providing some detailed system information. I live in Oregon, in an area serviced by CenturyTel, not Comcast, and have wondered if their change could affect others network traffic in the region.

Re:A LOT of ISPs already do this...

[Anonymous Coward]

...including mine (Verizon FIOS) apparently. fortunately, if it doesn't show up in my smart bar, I just google for everything now.

Re:A LOT of ISPs already do this...

[nweaver]

Comcast's change should have NO effect on any other ISP, and additionally, DNS issues should not cause packet loss.

No

[Anonymous Coward]

OpenDNS does the crap.

Rogers has been doing this for ages

[Anonymous Coward]

Rogers has been doing this for ages here in Canada, and they don't offer opt-outs either. And, it's tweaked to fail a lot, it will sometimes redirect google.com to their search engine/ad displaying page. Yay opendns!

Re:So should...

[blueg3]

Except for the bit where Comcast users not using Comcast DNS servers are unaffected, as per TFS.

Unless you're complaining that they could, in theory, redirect port 53. Frankly, anyone remotely familiar with how the Internet works should know that your ISP *could* completely and arbitrarily control any nonauthenticated protocol, including DNS.

The future.. or THE FUTURE?

[synthesizerpatel]

It's COM^H^H^HCRAPTASTIC!

Problems with this

[DigitAl56K]

I speak from the perspective of being a RoadRunner user rather than a Comcast user, but RR implements a similar service. They have a link in the lower right of their results page where you can click to set your preferences and disable the "feature". Except just the other week that preference broke for me, and I was stuck with DNS hijacking. I phoned their customer service line, the person on the other end of the line had absolutely no idea what I was talking about.

DNS hijacking is a bit like Phorm without profiling really. Well, assuming there is no profiling. If there was profiling they'd make more money from the ads they'll inevitably insert there to "support" the service (Edit: oh look, they already have!). Personally I put this issue, along with Phorm in a whole category of problems related to the fact that we still don't secure and authenticate most of our activities on the internet (http, dns, yadayada). ISPs can do what they like and it's hard to stop them. Third-party DNS services seem to be the way to go recently. Of course without security/authentication your ISP can put a stop to that quite easily too.

This is all before you get in to the technical details of clients that may implement specific behavior for when bad DNS queries are expected to fail but don't.

Re:Problems with this

[Anonymous Coward]

I don't know if it's still true, but when I had Time Warner (RR) the opt-out page only worked in IE. =(

Re:So should...

[sopssa]

OpenDNS does exactly the same. (unless you register account and change it, but thats the case with this comcast thingie aswell)

the ONLY thing robbIE siad he would never do

[Anonymous Coward]

censorship is thriving here on /.. just so va larry/robbIE (mega suckups that they've become) can try to stay/become as rich as nazis? delete that you pitiful LIEforms.

Re:So should...

[The End Of Days]

You can opt out, you know. It says so right in the summary.

Also please don't use "evil" to describe things that are merely inconvenient. It greatly diminishes the horror and suffering people have gone through at the hands of real, actual evil.

Roll your own, it's easy.

[Anonymous Coward]

Instead of migrating from one punk who pulls this stunt to the next, quit using someone else's recursive resolver and run your own: Unbound - a validating, recursive, and caching DNS resolver. Available for Unix and Windows.

Re:Roll your own, it's easy.

[argent]

That's going to be really effective when your port 53 requests are intercepted by their transparent firewall and rerouted to their corrupt roots.

Keep trying till you succeed

[Lead Butthead]

When in doubt, keep trying. When rejected, keep trying. Enough people do this, it becomes the norm. Sad, but true.

Re:Keep trying till you succeed

[raddan]

Sounds like the same strategy we'll have to use to get to their slashdotted DNS opt-out page. I kinda wonder if they did that on purpose.

Re:Keep trying till you succeed

[NeutronCowboy]

Remember: only quitters quit. Winners never quit. And not winning would just be anti-American. So in fact, all these companies are just trying to be as american as apple pie!

Or something. Maybe I'm just getting too cynical for this stuff. But for some reason, I can't fathom that the original Internet (intelligence at the nodes, dumb pipes in between) will survive all the concerted attempts at reducing it to the equivalent of TV.

Lots have failed, but some have succeeded

[Sheafification]

I noticed the summary mentioned several attempts that have failed, but makes no mention of other ISPs that are still doing it. Time Warner Cable is one that has been doing this for a while now (maybe a year?). Anyone know of others?

Re:Lots have failed, but some have succeeded

[i.r.id10t]

I think Windstream does since I've noticed it at friends houses. But at home I run a caching-only DNS server, so I never notice it...

Re:Lots have failed, but some have succeeded

[wjousts]

I was going to same the same thing. I'm pretty sure my Road Runner from TWC does this already. Of course, with bookmarks, the search box and address completion, I rarely type the wrong URL anymore.

Re:Lots have failed, but some have succeeded

[mystik]

Cox does it too, iirc. I've seen it @ places where I've help setup computers. I had been running my own dnscacher that directly hit the root servers, but when I learned about Cox doing it, I discovered they have a pair of DNS servers that *don't* exhibit this behavior and changed my resolver to hit those (to be net friendly). I'd switch it back to the roots in a heartbeat if they started being stupid about it again.

Re:Lots have failed, but some have succeeded

[Anonymous Coward]

Suddenlink Communication in TX does. They bought the area from Cox Communications, which did it as well....

The local MOMnPOP ISP I worked for didn't do it, but it seems like any ISP with more than a few counties of coverage sure as hell does.

Re:Lots have failed, but some have succeeded

[Lothsahn]

Charter does this in my area (Michigan). I've been instructed by their tech support department to reference Level3's DNS servers. 4.2.2.1 and 4.2.2.2, I think it is...

Re:Lots have failed, but some have succeeded

[edalytical]

Qwest does it. They allow a opt-out, but still most people don't know that it's happening, let alone why it is bad/wrong.

Re:Lots have failed, but some have succeeded

[darkuncle]

Verizon does it (new FiOS customer; love my FiOS, but run my own DNS for this reason primarily (and because I want split-horizon). If they start intercepting port 53 outbound, we're all SOL until DNSSEC becomes ubiquitous.

Re:Lots have failed, but some have succeeded

[yermej]

Charter does it in Missouri too. You can "opt-out", but in that case it redirects you to a Charter server that serves up a copy of IE's DNS error page -- no matter which browser you're using. It even references the local images that IE would use so the images on the error page are broken when using Firefox.

Re:So should...

[Anonymous Coward]

OpenDNS does the exact same thing. To avoid DNS highjacking if you use OpenDNS, you have to have an account with them, change your preferences and always be identifiable to OpenDNS so that it can apply your preferences. It's easier to opt out at Comcast than to opt out at OpenDNS. Besides, OpenDNS also redirects www.google.com to OpenDNS servers, not just nonexistent domains.

Re:So should...

[Ian Alexander]

According to the fine article there's an opt-out button on the page you get redirected to so I'm not certain that would be necessary:

We also understand that sometimes customers want to surf their own way, without the assistance of services like Domain Helper, so we offer an easy way to opt-out right on the Domain Helper search page.

Re:So should...

[NeverVotedBush]

I agree it is evil, but until they do (if they ever do) redirect port 53, people can (and should IMO) use OpenDNS.

I really like OpenDNS. There is more to it than just a clean DNS server - though if you check their FAQ, they will also serve links with dead-end web address error messages. You can outright block various kinds of websites (useful if you have kids in the house), and they are actively protecting against DNS cache poisoning, blocking malware sites, etc.

Comcast can do their own ad serving through their own DNS servers and that probably won't raise too many eyebrows except from people like those that frequent /. Most people don't even know what DNS is or why it could be important to them. But if Comcast starts redirecting ports, it will grab a much wider audience because lots of tech people will go postal over the insult and that would be bad press for Comcast.

I doubt they will ever redirect 53. And if they do, reaction will be probably be swift.

Road Runner did it too

[Anonymous Coward]

For a long time, I was having the crap annoyed out of me by it. It didn't even offer suggestions, really, just ads. It broke some of my scripts, too, since it caused a 200 response instead of returning a resolution error like it was supposed to. Fortunately, there was an opt-out link, but it was hard to find. I did opt out though, and now I'm not sure if they're still doing it.

They shouldn't control it.

[Well-Fed Troll]

Why exactly does the ISP control DNS?
Given the shenanigans the ISPs and governmental authorities have been up to the last few years, I say we need to rethink TCP. You see, we've been assuming all along that ISPs are not malicious. We need to start assuming they are malicious. The new TCP protocol should only assume that all socket level data is sensitive and therefore must be encrypted as to both its contents AND its destination. This implies traffic shaping, onion routing and a public key based DNS

Re:They shouldn't control it.

[DragonWriter]

Why exactly does the ISP control DNS?

Because ISPs control every packet going over their networks, and while they enjoy most of the liability protections that go to common carrier is other fields, they experience very little of the kind of behavioral regulations that go with that status.

Which is a great deal, if you are a major ISP.

Maybe..........

[drummerboybac]

They can redirect me to a better cable company where I can get more HD channels, and where I don't have to go through (literally) 8 DVR's to get one that doesn't die.

Seriously, I went through a period where my DVR would crash and go into a reboot loop every 3 weeks and someone would have to come and replace it. that went on for almost 3 months

*sigh*

Sadly I'm stuck since I am surrounded by 5 story trees (no dish) and fios will not offer anything on my street ( technically a private road)

Re:Maybe..........

[SCHecklerX]

Bummer on the trees. Comcast may have kept me as a cable tv subscriber if only they could have given me just one working DVR in the 5 I went through. Fuck comcast. I'm now a happy directv subscriber, and if the opportunity ever presents itself, my internet access will be moving ASAP.

Re:Maybe..........

[nedlohs]

There are 8 weeks in a month where you are?

Bad assumption being made

[FranTaylor]

This is all done under the assumption that the DNS query is for an HTTP request.

What happens when other services run afoul of this setup?

For example: Is my POP client going to hand my login credentials to a Comcast server, if my email service's DNS does not resolve for some reason?

Re:Bad assumption being made

[mdm-adph]

Forgive me for my lack of knowledge in this area, but isn't there some sort of encryption involved with that? Wouldn't you verify that the server you've reached is actually the server you wanted before you hand over credientials?

Re:Bad assumption being made

[blueg3]

That depends. If you have server authentication, it won't. More importantly, if the Comcast server doesn't listen on any port but 80, it certainly won't.

If you were relying on correct DNS responses to provide security (such as preventing your login credentials from being given away), you were doing it wrong in the first place.

Re:Bad assumption being made

[Tony Hoyle]

POP isn't encrypted. There's pop3s but I've never seen an ISP implement it - ISPs know they their punters don't know about encryption so never bother with it. The passwords are even sent plaintext, most of the time.

Re:Bad assumption being made

[FranTaylor]

I'm not talking about "me" in particular, who of course know about this, but rather the unwashed masses.

Re:Bad assumption being made

[blueg3]

I think the point really is, how likely is it that the site Comcast redirects you to will do anything other than serve Web pages related to DNS redirection?

Re:Bad assumption being made

[FranTaylor]

I'm sure Comcast has it within their power to put perfectly valid, signed server certificates on their servers.

Re:Bad assumption being made

[mdm-adph]

But wouldn't you at least check if the server you got was the one you wanted before you handed over credentials?

Re:Bad assumption being made

[blueg3]

I think Verisign would disagree with you there.

Example: your POP client is configured to contact mail.mycompany.com. For some reason, a DNS lookup for mail.mycompany.com results in an NXDOMAIN and Comcast redirects you to 1.2.3.4 (their IP address for redirection). Are you seriously suggesting that 1.2.3.4 (a) is listening for POP connections (b) has and presents to you a valid certificate for mail.mycompany.com? You realize these are the certificates you pay people like Verisign to sign, yes? Falsifying them is difficult (which is a gross understatement) and comes with serious consequences.

Considering Comcast isn't even a Certificate Authority, it would be prohibitively expensive for them to acquire a valid, signed certificate for every non-existing domain -- if a CA was dumb enough to actually provide them with such.

Or is your client going to contact mail.mycompany.com and, handed a cert for comcast.net, decide that that's close enough?

Re:Bad assumption being made

[DragonWriter]

Is my POP client going to hand my login credentials to a Comcast server, if my email service's DNS does not resolve for some reason?

In theory, its possible, but it would require more than just the DNS redirection. It would also require the servers to which you are redirected to be running POP servers (or something that acted like them initially) on the usual POP port. Since Comcasts whole plan with this seems to be a sophisticated form of typosquatting to redirect web browsers to add pages, they probably aren't doing that (though they could, then accept any credentials you offered, and just dump spam to you over POP when you tried to collect email. I doubt they would, but it would be pretty much in line with what they are doing to HTTP.)

Re:Bad assumption being made

[fbartho]

How can you know? They're lying to you about the domain, how are you supposed to double-check?

Re:Bad assumption being made

[Anonymous Coward]

Guess what happens when you have auto-login cookies set for your webmail provider and due to a configuration bug their servers return NXDOMAIN, which Comcast's recursive resolver redirects to a Comcast webserver...

Re:Bad assumption being made

[tinkerghost]

But wouldn't you at least check if the server you got was the one you wanted before you handed over credentials?

The PERL & PHP POP3 packages don't. I don't believe the Java or Python packages do either. In fact, I don't recall any section of the POP3 server protocol (RFC 1939) to validate the server itself. By convention, the server name is included in the welcome message, but it's not required. The PID, timestamp, & qualified servername are included if the server supports APOP, but that is again optional, and I do not believe it's used by many ISPs.

That's the biggest problem with the internet - the major protocols do not verify identity. That means that you have to trust that the person at the other end of the connection is who they say they are, and that the DNS system has routed you to the correct end point. How many people do you know that have personal certificates validated by a third party. My count is 4, and that includes 2 people in the DoD, a former network admin for a Fortune 50 company, and a professor of forensic science that consults with the FBI. Other than that, the only personal certificates I know people have are self signed by the company requesting them. Verizon for example self signs the certificates that they send out for accessing their internal ordering system.

I have 2 websites, neither of them have certificates, and I'm not planning on getting any. Neither of my sites are set up to respond to https and I do not believe that http requests the certificates. That means anyone who can poison the DNS cache can forge my sites. But let's face it, if they're poisoning the DNS cache, I'm screwed already anyway.

Re:Bad assumption being made

[Nesman64]

Nope. Not only does the client rely on the hostname, but by sending the traffic unencryped, anyone between you and the server can read your password. Also, anyone on your network can read it. Using a public wifi? Don't POP.

Re:Bad assumption being made

[dissy]

For example: Is my POP client going to hand my login credentials to a Comcast server, if my email service's DNS does not resolve for some reason?

...

The passwords are even sent plaintext, most of the time.

Then your answer is yes, either way (with DNS hijacking, or how things are right now this very second) you have handed your login credentials over to your ISP.

They can grab your traffic at the wire level and redirect a copy to another server long before they would need to redirect your POP connection using a DNS spoof to their own server.

Re:Bad assumption being made

[Anonymous Coward]

This is all done under the assumption that the DNS query is for an HTTP request.

What happens when other services run afoul of this setup?

The best practises document covers this (section 5.1.3) but I suspect it will get ignored most of the time.

Cablevision

[C_Kode]

Cablevision already does this in the Northeast US. :(

Re:Cablevision

[Anonymous Coward]

Even worse, opting-out of Optimum Online's "service" doesn't work at all. I feel like strangling someobody over there every time I come across their "helpful" hijacking of my browsing.

Re:So should...

[Anonymous Coward]

Real evil is like real beauty. Both are nothing more than opinion. Stop trying to make your emotions seem important.

Re:So should...

[Sir_Lewk]

No.

Knock this shit off and mods, wise the fuck up. Just because it has "open" in the name doesn't make it suddenly good and benevolent, They do the exact same fucking thing.

Anyone who's been on slashdot for more than a week or two probably has seen dozens of comments suggesting OpenDNS in cases like this, always modded up. Every single time people post corrections pointing out that they do the same thing. Does anyone ever listen?

Wise the fuck up

Re:So should...

[seizurebattlerobot]

Why do these OpenDNS posts keep getting modded up? OpenDNS utilizes the very practices this article bemoans! If you query a domain that does not exist, your browser is redirected to OpenDNS's ad-laden spam site.

Despite their claims to the contrary, OpenDNS's servers are likely farther away from you than your local ISP's. They also keep permanent logs of all queries, which could be subpoenaed by a government entity. Their joke of a privacy policy allows them to sell your logs to "Affiliated Businesses", which pretty much means anybody. Not that it really matters - they could amend their privacy policy tomorrow morning and be selling your info by the afternoon.

I think many people read the "Open" part of the OpenDNS name and turn their brains off.

retaliation?

[SuperBanana]

How exactly does a customer "retaliate", other than canceling their service, which is grossly impractical, given that, for example, in Boston, one only has 1-2 choices in cost-effective, high-speed internet access? Verizon services almost all suburban areas in MA with FiOS, but not anywhere in Boston, Cambridge, etc....so your choices are shitty DSL for $$$, or Comcast.

Re:retaliation?

[geekoid]

Write then an angry letter.
be sure it's polite.
Contact your local politician.

And so on.
There are ways to change companies behavior besides canceling service. In fact with large companies letter will be more effective then canceling service. Until a certain limit is hit.

Re:retaliation?

[HeronBlademaster]

You call them and threaten to cancel your service unless they stop doing it. Oh, and you have to follow through.

That's why it doesn't really work. Most people won't follow through, even if they bother with the threat.

Verisign DNS hijacking

[RazzleDazzle]

These never get old

Re:The Sky isn't falling.

[UncleTogie]

Getting a valid IP on an invalid name while trying to set up an FTP, SMTP, POP, etc connection (to name a few) could break the app (which assumes the internet standards are obeyed).

Never assume; when you do you make an ass of Uma Thurman.

Opt Out if you're not cool with this

[ComcastBonnie]

Just go to the site below and opt-out :) https://dns-opt-out.comcast.net/

There is a bright spot in this....

[jimpop]

DNS redirection allows an ISP to quickly block infected PCs from participating in distributed attacks that rely on DNS.

Re:There is a bright spot in this....

[Anonymous Coward]

That doesn't make sense if the bots have the targets' IP addresses cached already. And what makes you assume that the bot masters actually order bots to attack hostnames instead of IP addresses to begin with? Your logic is flawed.

Re:There is a bright spot in this....

[Tony Hoyle]

How, exactly? DNS happens once. If the PC queries for a valid address it will get it, whether it's in a botnet or not.

The ISP can block attacks by measuring traffic across their routers.. DNS is a stupid place to do it.

Re:There is a bright spot in this....

[jimpop]

"DNS happens once."

Not entirely true. DNS queries have a TTL. See: http://en.wikipedia.org/wiki/Fast_flux

Re:There is a bright spot in this....

[Tony Hoyle]

That's normally between 24 hours and 7 days, so it's irrelevant to the discussion.

The article you mention (which btw. seems to be a wikipedia invention) would be done with custom DNS anyway, otherwise it's easily blocked by the ISP setting its cache to ignore a TTL less than a couple of hours (as most do.. hell, my even my home DNS does that).

Re:There is a bright spot in this....

[jimpop]

That's normally between 24 hours and 7 days, so it's irrelevant to the discussion.

TTL (as you also pointed out) can be modified down the line by the ISP (or even yourself as you indicated). What ever the TTL, DNS is very relevant as it is central to what 99% of Internet users do. S/He who controls DNS has much unseen power.
Fast Flux (on Wikipedia or not) is a legitimate problem. Google is your friend if you truly want to learn more.

Re:There is a bright spot in this....

[idontgno]

That's normally between 24 hours and 7 days

Just because something is customary doesn't mean it's mandatory. RFC1035 explicitly states TTL should be set to 0 (zero) if the "[Resource Record] can only be used for the transaction in progress, and should not be cached" or "for extremely volatile data."

The article you mention (which btw. seems to be a wikipedia invention)

Damn those Wikipedians! They've poisoned SecurityFocus, Whatis.com, The EU SPAM Trackers group, and even Google!

would be done with custom DNS anyway, otherwise it's easily blocked by the ISP setting its cache to ignore a TTL less than a couple of hours (as most do.. hell, my even my home DNS does that).

It would be done by setting your DNS record (yes, a DNS RR you are responsible for) to have a short TTL. Not a custom DNS server, just administrative rights to the DNS record associated with one or more resources. And if, by setting the TTL to a low value, I tell you that my DNS record is going to be quite volatile, you can disagree with me all you want (by "ignor[ing] a TTL less than a couple of hours"), but don't be surprised when your cache goes stale.

Gosh, I wish I could live in the world you live in, with deathless and ultrastable interfaces and static network architectures. You could probably get by with just a really big "hosts" file. But out in the real world, sometimes you need short DNS TTLs for stuff like warm-failover high-availability architectures.

I tried to circumvent this with OpenDNS...

[Hurricane78]

But then I noticed that OpenDNS also does DNS redirection!
The scary thing was, that of course this even works when I mistype Intranet addresses. (Should have been obvious to me, but I did not think about having switched to OpenDNS when this happened, and got very scared about the possibility of a MITM attack.)

Re:I tried to circumvent this with OpenDNS...

[Anonymous Coward]

That's why I use the NoRedirect extension these days. Don't have to bother with the draconian (and often non-existent) opt-out policies, no matter whose network I'm using.

Headline is wrong

[Thaelon]

The headline should read:

"Comcast Colludes With Yahoo! to Redirect Miss-typed URL Traffic for their own Profit"

it can fail badly

[RichMan]

My ISP did it for a while. The problem was that it was badly implemented and increased to load on the upstream DNS services.

So if the middle layer DNS cache was empty and I asked for
    mybank.com the bottom level DNS timed out and it failed over to the advertising page.

---
Think of searching on coke.com or any real address then the system failing and redirecting you to pepsi.com.

Think of the lawsuits. Think of the denial of service attacks possible
      a) register not_mybank.com, have spoof of mybank.com page ready to launch
      b) pay to have a fail on mybank.com route to not_mybank.com
      c) denial of service attack to root servers for mybank.com, flip in your spoof page
      d) have the ISP's magically send people to your spoof site from their saved URL's and collect passwords

Yeah this is a good idea.

Re:it can fail badly

[Anonymous Coward]

The security angle you touched on here is the key to killing this. Someone needs to make it understood that all http security pretty much relies on reliable, functional DNS. Having a site get redirected to an unrelated host just because the original is having DNS or routing issues is bad, bad, bad, because that unrelated host can take cookies for said dead site, or stored passwords. And no, "the unrelated host is a benign comcast page, don't worry" isn't a good enough excuse. Hijacking DNS is always bad.

Re:it can fail badly

[Phroggy]

Fortunately, SSL thwarts this sort of thing. Newer browsers show SSL EV certificate information more prominently in the address bar as well as highlighting the domain name portion of the URL; users who bother to look at both of these will be secure. Users who don't are screwed, though, until DNSSEC becomes the norm (maybe in a decade or so?).

Re:So should...

[Anonymous Coward]

If you think my emotions were involved in that comment, you probably aren't very good at reading people.

Re:So should...

[Hurricane78]

Are you kidding, or do you work for OpenDNS?

Because I switched to OpenDNS because of people (you?) mentioning it here on Slashdot.

And then I noticed, that OpenDNS also does DNS redirection!

ISPs don't control DNS.

[John Hasler]

> Why exactly does the ISP control DNS?

They don't.

Re:ISPs don't control DNS.

[NeverVotedBush]

But they do take the opportunity to use their own DNS servers if you are an average user and leave DHCP set up (pretty much the default).

They don't control them per se, but they will happily provide you the address of their servers if you need help setting up, and set up their DHCP servers to automatically point you there.

I'm done. I'll be switching as soon as possible.

[swillden]

It's not that this is a really big deal for me. It's just the straw that broke the camel's back. I've had all sorts of trouble with Comcast of late, and this just pushed me over the edge. I've been very, very close ever since they started blocking outbound SMTP connections (yeah, I can and do use the SMTP submission port for sending e-mail, but how am I supposed to monitor my remote SMTP servers from home?).

Re:So should...

[Anonymous Coward]

OpenDNS is doing the same damn shit. A DNS server should never return a result for an address that doesn't exist.

Not the same at all.

[John Hasler]

> Some may remember when VeriSign tried this back in 2003, where it also failed.

Not the same at all. VeriSign tried to do it with the TLD servers, which nobody can avoid. These guys are just doing it with their own servers, which you can bypass unless they block you. Even if they do you can, at least in theory, switch ISPs. They aren't likely to bother with blocking, though, because the number of people who will bypass is tiny.

Mark that user...

[donut1005]

So if I call in to opt out, does that put me on their traffic watch list?

I hate their tech support

[Anonymous Coward]

https://dns-opt-out.comcast.net/

That is where you go to opt out. I called tech support and no one even new what I was talking about until I directed them to their own announcement.

What about non-HTTP?

[slushdork]

I'm a Comcast "customer" in an affected "market" (Colorado). How will this affect DNS resolution requests for non-HTTP purposes? There is no way for the Comcast DNS servers to know what a DNS name resolution request is for: it could be for HTTP, or it could be for SSH, FTP, etc. So if I mis-type an FQDN hostname in an SSH command, will the DNS resolution request now suceed? Previously SSH would fail with a "cannot resolve hostname" error or something similar. Will it now try to connect with SSH to the Comcast "domain helper" servers? What about its effects on local DNS caching servers (e.g. dnsmasq)?

Also, this statement from Comcast's blog is blatantly false:

Despite the fact that web addresses are easier to remember than their IP address counterparts, sometimes you mistype an address. Let's say you type in http://www.comtcas.com/ (instead of http://www.comcast.com./ Normally you then sit and wait for the Web browser to time out, then you receive an error message that the site does not exist, and then you have to retype the correct address.

Normally you would *never* "sit and wait for the Web browser to time out" (well, these *are* Comcast's DNS servers after all, so in this specific case it might be true). Normally, your browser would get a DNS resolution failure and show you a built-in error page instantaneously. Now, on the other hand, you have to wait until your browser goes off and loads a page of Comcast ads.

Domain Helper my a$$!

Re:What about non-HTTP?

[oracleguy01]

Yeah, now what will happen is you'll have to wait for it to come back and say "Connection Refused". Because the IP will resolve to their web server if the domain doesn't exist. They just assume you are only using DNS for web stuff I guess.

Re:What about non-HTTP?

[emlyncorrin]

What about its effects on local DNS caching servers (e.g. dnsmasq)?

If you run dnsmasq, and you know the ip addresses of the domain helpers, you can work around this with the bogus-nxdomain config option.

Re:What about non-HTTP?

[blueg3]

So if I mis-type an FQDN hostname in an SSH command, will the DNS resolution request now suceed? Previously SSH would fail with a "cannot resolve hostname" error or something similar. Will it now try to connect with SSH to the Comcast "domain helper" servers? What about its effects on local DNS caching servers (e.g. dnsmasq)?

Yes, yes, and none. (A local DNS server doesn't contact your ISP's recursive resolver. They're not doing hijacking of DNS packets not destined for them. So, what their resolver would return is irrelevant for your local server.)

Re:What about non-HTTP?

[Phroggy]

Pay close attention to the security warning your SSH client gives you the first time you try to connect. It's usually safe to assume that your session isn't being hijacked the first time you connect, but if you ever see that warning again, double-check the hostname you entered, and if you haven't obviously done something silly, it's time to make a phone call.

Oblig.

[blackfrancis75]

I've been a Comcast customer for HERBAL VIAGRA several years and have never had an issue with unsolicited REAL WEIGHT LOSS advertising of any kind.

Re:So should...

[Seakip18]

Right kind of moderation going on here. I posted a suggestion from someone a while back and get lots of good(albeit slightly over-critical) feedback to correct me and warn other users. Thanks ./ community.

While I wouldn't be opposed to a +1 insightful, a +4 informative on my post is wholly undeserved.

Because...

[mario_grgic]

with open DNS you get the same thing, unless you open an account with them, in which case you also share your browsing preferences with them.

Another, important reason is that at least in my case the open DNS query response times are 3 times slower than with my ISP.

And my ISP (Rogers) does have an alternate DNS server (for those who care enough to change it) that does not poison DNS results.

There is a significant difference:

[Draconix]

OpenDNS is "free-as-in-ad-driven". You don't have to pay for it, but they need to make their money somehow, so they have their own special page when you type an invalid domain in the location bar, with text ads on. Comcast, on the other hand, which the end user is already paying for, is trying to inflict the greedy bastard business model they use for TV (hooray for paying for content that's 1/3 ads!) on their ISP customers.

Re:There is a significant difference:

[sopssa]

However, the grand parent post was about avoiding it all together. How does it help moving from existing servers to new ones that do the same?

Re:There is a significant difference:

[vslashg]

OpenDNS is "free-as-in-ad-driven". You don't have to pay for it, but they need to make their money somehow, so they have their own special page when you type an invalid domain in the location bar, with text ads on. Comcast, on the other hand, which the end user is already paying for, is trying to inflict the greedy bastard business model they use for TV (hooray for paying for content that's 1/3 ads!) on their ISP customers.

This distinction is true, but irrelevant in the context of this discussion. If someone is unhappy with a DNS server because it redirects invalid lookups, then it's actively unhelpful to suggest they use a different DNS server that does the same thing.

Re:There is a significant difference:

[Seakip18]

To be honest, Comcast has this nasty habit of changing DNS servers in my area. Every so often I'm unable to make outgoing request while incoming requests to my domain(provided by DynDns) come through just fine. Dependability would be nice but not at the cost of having to see ads, even if I can disable it.

Re:There is a significant difference:

[geekoid]

If the generate good revenue, they can lower there monthly costs to impact competition.

Re:There is a significant difference:

[Anonymous Coward]

However, the grand parent post was about avoiding it all together. How does it help moving from existing servers to new ones that do the same?

It takes ad money away from the company ass-fucking you in the ass. Other affects are immaterial IMO. I would run my own DNS if it was that much of a concern.

Re:The Sky isn't faling. -- Actually yes

[jackb_guppy]

This screws with "what is valid URL". Basically, now all URL are valid. So for example you want "coke.com" anyway you mistype that request: cole.com, Coce.com, koke.com, cooke.com and ... will be a valid URL, even if it does not exist.

Another way of looking at this is cybersquatting. They are taking the whole URL domain. So if you have a new URL, guess where it will not show up for a long while.

And third you can think of it as "DNS poisoning", since if you are running your own DNS, comcast will be suppling you fake information, with its own time out.

Re:So should...

[Seakip18]

Don't worry. They've modded me into oblivion it looks like. I wish it would have remained at 1 so it'd warn other folks.

As you and many others have pointed out, they're just cashing in on the "open" washing while "offering services" to "guide" a user straight into an ad-ridden ass pounding. Thanks again for setting me right.

Help friends opt out

[linebackn]

Seems like a simple enough solution, geeks like us should help friends, neighbors, relatives, and anyone else we encounter to opt-out of this nonsense. If enough people opt-out of this then DNS redirection could theoretically become unprofitable enough that they would ditch it!

Grass-roots spreading the word has worked well for Firefox, so why not this?

Re:So should...

[croddy]

The corruption of a civilization's primary means for communicating and archiving knowledge is among the gravest of evils.

there goes split tunneling VPN

[Satanboy]

This will be a major blow to companies that use split tunneling for VPN.

I wonder what will happen if thousands of customers have to cancel their service as this 'enhanced dns' becomes a detriment to them.

Re:there goes split tunneling VPN

[blueg3]

For security's sake, people using VPN split tunneling need to contact the DNS server for the VPN network first, then fall back to the public DNS server; not the other way around. (Better, use the VPN DNS server exclusively.)

Re:there goes split tunneling VPN

[jroysdon]

The problem with this is many folks have soho l2l vpn connections, so their PCs don't have to run clients. If you use the VPN-only DNS, then if the VPN is down or has problems, the "internet" is broken.

Re:there goes split tunneling VPN

[blueg3]

That doesn't seem related to this. An external DNS had better be incapable of resolving VPN-internal DNS names. So your three choices are internal DNS only, external then internal, and internal then external. Redirection breaks only "external then internal", which is the one out of the three you ought not be doing. (If you can do external and fall back to internal, you ought to be able to do the same in reverse.)

Re:So should...

[ahecht]

OpenDNS is just as bad -- they do the same thing. The real solution is to change your DNS servers to use the L3 DNS servers at 4.2.2.1, 4.2.2.3, 4.2.2.4, 4.2.2.5, or 4.2.2.6, which are often faster than Comcast's anyway.

Re:So should...

[FutureDomain]

I use AT&T, and they seem to block port 53 except for their own DNS servers.
Thankfully, they don't have some crappy Yahoo (seriously, why Yahoo?) search page like Comcast is doing.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Very annoying, requires email...

[SuperKendall]

How many people actually use the Comcast email? Yet they require that to get on the list... I have no idea what my comcast email even is.

Re:Very annoying, requires email...

[Anonymous Coward]

I just used my gmail account and it worked

Re:Very annoying, requires email...

[HeronBlademaster]

Yeah, I never check mine; for all I know they could have sent me a notice about it. Not that I think they care about their customers enough to let us know. I think they send bill-related e-mails to that address.

Oh, look, I have three e-mails in that account: "Your bill is ready", "Come look at our new site", and "Tips on safer surfing". At least you can set it to forward to another address.

I'm not sure what the big deal is

[sohmc]

Besides the fact that this is another form of revenue for comcast, et al, what does this hurt? I use Verizon FiOS which has the same system in place but I've never seen it when I use firefox. You can set up FF to search google FIRST before forwarding you to comcast's DNS failure page. I agree that DSN should only be a service, not a full-blown application. But everyone is trying to make more money. As an aside the hell does comcast, verizon, etc need to make more money?! We pay them for service. We shouldn't be subjected to ads on top of that. Adblocker for the win!

Re:I'm not sure what the big deal is

[kms_one]

Mature websites have their own setups to handle 404 errors and it really should be THEM deciding where your redirects go. Anyone who runs a website can sue Comcast for this and I think they should!

Re:I'm not sure what the big deal is

[Todd Knarr]

And what happens to SSH, VPNs, e-mail and anything that's not a Web server when Comcast sends them to Comcast's hosts instead of reporting NXDOMAIN? Simply put, the majority of the Internet relies on being told a host doesn't exist when that host doesn't exist. Comcast is breaking this.

Just use NoRedirect

[Anonymous Coward]

I use my laptop in different networks (visiting friends, relatives, etc.), and opt-out is often not easy or not even possible (depending on which ISP it is). So now I just use NoRedirect and never have to worry about this stuff again.

DNS servers ignored

[Anonymous Coward]

At most ISPs, DNS servers were ignored 10 years at a time. Over that time, they became crufty and slow. The people who set them up in the mid 1990s retired or left.

Then last year, someone found a bug in DNS, not that there weren't bugs before, but a bug that got all of geekdom panties into a collective "wad." Nerds wrote tools and web sites to "check your DNS" to see if it was corrected or not. ISPs had to actually spend money and time on their DNS servers. This made them unhappy and the business people inside the ISP even more unhappy. See they'd already been successful at turning off FTP, gopher, and Usenet servers - nobody really complained.

They need a way to have DNS actually make money. A little change to DNS shouldn't bother anyone, right? Business people deciding to change anything about a 25+ yr old network protocol that is central to the internet is a bad idea.

If ISPs are looking for a real value-add service, why not sell 2-tiers of internet access with "unlimited" being the cheaper, default and "Family Friendly" being the more expensive, no porn, no spyware, no spam, no teenager hacker, no violence version of access? Most parents aren't capable of securing their systems against both outside and teenager inside attacks. This would be a truly appreciated solution in many homes, I'm certain.

Re:So should...

[vertigoCiel]

The opt-out page is apparently slashdotted. Convenient....

Re:I'm done. I'll be switching as soon as possible

[griffjon]

Me too.

Oh wait, Comcast doesn't have any competition for high-speed where I live.

Go go gadget free market!

Re:So should...

[OrigamiMarie]

Quite possibly Sir_Lewk will provide a lot of that warning though, since he's been modded 5.

Timewarner for some time

[link-error]

has been doing this. I switched to openDNS which also does this, but there are other advantages, so I'm ok with that.

Re:So should...

[Tony Hoyle]

When opendns started it was precisely that - an open DNS system which even had its own set of free TLDs to play with.

Then they smelled money. And the rest is history.

Use the anycast DNS at 4.2.2.1, 4.2.2.2, etc. Run by Level3 who have plenty of money anyway and don't need to nickel and dime DNS for it.

Re:So should...

[Seakip18]

Depending on how your view is setup. For me, if the OP is 0 or -1, the entire thread doesn't appear unless I click on the below threshold...

It's fun to occasionally set the threshold to -1 and see an entire flamewar taking place.

OpenDNS is opt-in

[Anonymous Coward]

Why do these OpenDNS posts keep getting modded up? OpenDNS utilizes the very practices this article bemoans! If you query a domain that does not exist, your browser is redirected to OpenDNS's ad-laden spam site.

OpenDNS is opt-in, so you're making an informed decision if you configure your systems to use it. Comcast (and others) is doing things in the background without many people being aware of the change.

It may not matter to a lot of people ("Joe Sixpack"), but it can break/upset a lot of software that assumes 'proper' responses to DNS queries. As another comment mentioned, this is a form a typosquatting, and could even open up Comcast to trademark infringement suits.

Re:OpenDNS is opt-in

[CannonballHead]

Comcast is opt in. It just happens that they have a lot of current customers. But nobody forced you to call Comcast and pay them for their service.

Funny comcast site

[santax]

I have made an comment referring to the verizon times... And i explained that this was a pay per click revenue. It didn't get posted. So i voted a one star on the article... Couldn't see it back in the stats... I noticed after my vote it went from 5 to 3 stars, but on the frontpage it is still 4 stars. When I tried to made another comment I noticed I got an ip ban... Weird. My comment was fair and not a flame... yet now I am banned. Why not just disable comments? All of this combinded is raising the questiong, which former CEO of verisign is now a member of Comcast?

Maybe they'll allow an opt-out like Charter does

[Whuffo]

Charter allows you to opt out from getting their custom search page instead of an NXERROR. So when you opt out, you don't get the search page anymore. You get a fake IE DNS error page instead - that's served from a Charter server. Useless.

Re:So should...

[dimeglio]

seriously, why Yahoo?

Probably because Yahoo shares a higher percentage of their revenue with them.

SICK of COMCAST

[wtbname]

I am sick to death of Comcast. Everything about them is terrible, and I have no choice in service.

HD DVR:
- Service is occasionally blocky and disruptive to viewing.
- The recording software is garbage.
- On-Demand breaks nightly. Yes, I have to call every day for them to "turn it back on". They can't seem to find the problem. I'm positive the problem isn't with them cashing my fucking checks.

Internet:
- It's Fast.
- It resets 2-4 times per night.
- Used 3 different modems and 3 different routers, same behavior.

Given a choice, I would have dropped them two years ago.

Re:SICK of COMCAST

[guyminuslife]

I think anyone who has a choice has switched away from Comcast by now. Which means they can essentially do whatever the hell they want with their captive consumers.

Re:SICK of COMCAST

[dickens]

The TV service sucks. The price creeps up and up and up and up with nothing added and it takes 3-5 seconds to change from one channel to the next. The Music choice channels sometimes don't work for days because of obvious bandwidth starvation.

But the Internet never "resets" as far as I can tell. The burst speed is something silly.. I just got 30.72 Mbps in a test. Solid sustained download speeds of 8 Mbps and 1.5 M up. I don't think it's been down since the ice storm in December. And neither has my Pentium 120 router.

This DNS thing can't be good, though. I wonder what would happen if I crank up a djb/dnscache and my network starts emitting only non-recursive queries to specific servers. Hmm.. this won't take long to test.

Re:SICK of COMCAST

[MLease]

Yeah. I've been checking Verizon FIOS availability in my neighborhood on nearly a daily basis. I saw their trucks doing what appears to be extensive work around here a few weeks ago, so I'm hoping that means they are bringing FIOS here.

I don't even care whether they're better than Comcrap right now. I just want to be able to cancel my service and let them know they have competition.

-Mike

What would this look like?

[pentalive]

I use openDNS; "www.google.com" and "google.com" seem to bring up the same page (in firefox)

What should I see - OpenDNS's search page right?

Re:What would this look like?

[Anonymous Coward]

The web page looks the same. You have to look at the DNS results (or the TCP connections) to see what's going on. If you're using Windows, open a command prompt and compare the outputs of
nslookup www.google.com 4.2.2.1
and
nslookup www.google.com resolver1.opendns.com

The first parameter is the query, the second is the server. 4.2.2.2 is the anycast address of one of Level3's DNS resolvers, which implement DNS correctly. The result of the second command is a CNAME under the opendns.com domain and an IP address which belongs to OpenDNS LLC (you can verify this by asking whois.arin.net for information about the address with a whois client).

Re:What would this look like?

[Pathwalker]

If you don't believe it, try the commands for yourself:
-=-=-=-=-
overmind% nslookup
Default Server: localhost
Address: 127.0.0.1
> set querytype=a
> www.google.com
Server: localhost
Address: 127.0.0.1
Non-authoritative answer:
Name: www.l.google.com
Addresses: 74.125.53.147, 74.125.53.104, 74.125.53.99, 74.125.53.103
Aliases: www.google.com
> server 208.67.220.220
Default Server: resolver2.opendns.com
Address: 208.67.220.220
> www.google.com
Server: resolver2.opendns.com
Address: 208.67.220.220
Non-authoritative answer:
Name: google.navigation.opendns.com
Addresses: 208.69.36.230, 208.69.36.231
Aliases: www.google.com
-=-=-=-
Talking to my local DNS server, www.google.com resolved to IP addresses in the 74.125.0.0/16 netblock, which is assigned to Google.
Talking to resolver2.opendns.com, www.google.com resolved to 208.69.36.230 and 208.69.36.231, which have no reverse information, but are in the 208.69.32.0/21 netblock which is assigned to OpenDNS.

A DNS that is always there.

[Anonymous Coward]

OpenDNS is up all the time unlike the DNS servers provided by Time Warner's RoadRunner.

Don't abuse 4.2.2.1

[Dogun]

It's not nice.

nonauthenticated...

[pentalive]

Wasn't there a proposal in the works for a fully cryptographically signed DNS system?

Re:nonauthenticated...

[blueg3]

There's more than one: DNSSEC and DNSCurve. DNSSEC is further along, which isn't saying much.

If I understand correctly, using DNSSEC prevents any kind of NXDOMAIN redirection. (It also prevents other kinds of falsified answers.)

Re:So should...

[Anonymous Coward]

Not only that, but OpenDNS will even hijack Firefox's Google keyword searches! I don't trust that company one bit. I use my laptop in a lot of different places (friends, relatives), so I've given up on the whole DNS whack-a-mole and have begun using NoRedirect instead.

Re:The Sky isn't faling. -- Actually yes

[blueg3]

No, it screws with "what is a valid domain name" by making all domain names valid. Domain names are not the same as URLs.

Since this is implemented within Comcast's recursive resolvers, new domains can be recognized immediately. These recursive resolvers are the ones caching DNS lookup responses. They can (and should) choose not to cache NXDOMAIN responses (which are the ones they provide redirection for).

Third, if you are running your own DNS, you aren't communicating with Comcast's recursive resolvers, and so they won't supply you with any information, fake or otherwise.

They don't control it

[Cajun Hell]

Why exactly does the ISP control DNS?

They don't. But most ISPs offer it as a service, and most DHCP clients automatically accept the offer. If you're not a computer dork, it appears that they're in control, whereas in practice, you actually did opt in.

The reason they offer this service (whether it's done well, according to the specs, or done brokenly, as Comcast is doing here), is that it's more efficient.

When they do it correctly, you come out ahead by letting your ISP do this for you (instead of running Bind yourself). Translating a name into an address requires multiple queries to multiple authorities. Because your ISP's links are faster than yours, they can look stuff up faster. And if more than one user is sharing the service, then some of the queries can be skipped and served by a prior user's cached results instead.

It's actually a good thing .. technically. The catch is that you're trusting them with something, and some of them are starting to act untrustworthy.

It's just like caching web proxies, NNTP servers, etc. Great tech, if you're doing business with someone who feels they have a reputation to lose. Not so great if you're doing business with an entity that people choose by default (or have chosen for them by their local government), e.g. "I'll just get internet through the local cable TV company."

dont bother replying on comcastvoices

[digitalsushi]

I HATE it when you type a lengthy reply into a web forum, only to have "awaiting moderation". I'm sure they will spend 8 seconds glancing at my 10 minute's worth of work, before chucking it into the digital trash bin. Yay, oppression. I realize I don't have any right to free speech in their house, but it's still RUDE.

There is an easy way to deal with this

[geekoid]

set up your phone to forward any incoming calls from comcast to a 1-900 number you own.
Charge 100 buck, plus 5 bucks a minute.

Re:So should...

[pete-classic]

Frankly, anyone remotely familiar with how the Internet works should know that your ISP *could* completely and arbitrarily control any nonauthenticated protocol, including DNS.

This is a great point, and really gets to the heart of the matter. There is a certain way that DNS is supposed to work. And there's a certain amount of trust vested in an ISP by their customers. This "service" violates that trust.

-Peter

I would find this acceptable if ...

[Skapare]

... in addition to their modem MAC based opt-out mechanism, they:

1. Provide alternative DNS cache servers that users can manually configure to bypass the redirection DNS cache servers. Support for this service can be limited to only informing the customer of the IP addresses of these DNS cache servers, such as on the tech support web page that tells customers how to opt-out. They do NOT have to support users on how to deploy this type of change.
2. Do NOT interfere with DNS queries sent to other DNS servers, whether with or without the recurse flag in the request. This is so that a user can run their own DNS cache server either on an internal network, or access a DNS cache server elsewhere on the internet (their own remote server, or a DNS caching/resolving service), without the need to set up a secure tunnel.
3. Do NOT interfere with any form of secure tunnel or other VLAN.
4. Do NOT intercept any UDP traffic, or TCP connections, or SCTP sessions, unless those are directed specifically to the provider's servers or services. For example the provider may offer HTTP caching services, media stream multipliers, IRC servers, etc., but must not affect users that want to bypass those services. ONE EXCEPTION: connections made to port 25 outside the provider's network SHOULD be intercepted unless the customer makes a "knowledgeable opt-out request" (for example, mentions "SMTP").
5. Do NOT do any other evil activity I don't have time to think about right now.

Anyone that knows what they are doing, or finds out via information from some source (the provider not being obligated to supply this information), should be able to use the internet exactly as it was originally intended.

Re:So should...

[TinBromide]

well, that's what happens when you try to host anything on a comcast connection, it chokes.

Verizon has been doing this as well

[toporok]

They call it "search assistant". Basically if you try to search from address bar or mistype an address it hijacks your search from search provider you selected in your browser and redirects it to its own search page. "Opting out" does not really work all that well because it get's you to a page that says "oops we can't find what you were looking for" and then gives you a link that takes you to your preferred search provider. Very annoying to say the least. :-(

DNS Engineer in Chat right now

[ComcastBonnie]

http://bit.ly/12S4a8 Feel free to join and ask questions!

Re:DNS Engineer in Chat right now

[jx100]

I was in this chat, and here's a partial summary of what was discussed:

The current behavior is this:
The redirected urls are of the form www.*.com/net/org

They have partnered with Yahoo to give the results, and are using this as an excuse for the ads.

They do not deny this is a revenue source, and claim it's for "adding speed", etc.

They claim they will not block port 53.

Let's not confuse reality with potential

[SuperKendall]

Until the NSA asks them to. Let's not pretend that AT&T isn't evil.

Well let's not pretend you know what the hell you are talking about.

The link you sent is for phone communications. Furthermore it was to phones outside the U.S...

That has nothing to do with network traffic, and furthermore you are dreaming if you think the same requirements to give data that AT&T followed are not the same for any other company large enough to be called an ISP.

The word "evil" is all too easily banded around today, so let's apply it to you as well and claim you are "evil" for misreporting facts.

Disclaimer: I don't work for AT&T, I just can't stand clueless paranoid nitwits.

Re:So should...

[deraj123]

As is often the case here, ISPs must have different configurations in different areas. I currently use uverse, and only recently switched from at&t's dsl service. I have not had any trouble using open dns with either service.

Re:So should...

[grcumb]

According to the fine article there's an opt-out button on the page you get redirected to so I'm not certain that would be necessary:

We also understand that sometimes customers want to surf their own way, without the assistance of services like Domain Helper, so we offer an easy way to opt-out right on the Domain Helper search page.

Not enough. Not nearly.

Allowing people to opt out of something that subverts the very principle of an end-to-end network is not what I would call reasonable. DNS redirection is just wrong. It's not 'okay as long as we give you a choice'; it's just wrong in the 'It breaks the Internet' sense of the word.

Re:Maybe they'll allow an opt-out like Charter doe

[Skapare]

It appears that what Comcast may be doing is running TWO sets of DNS caching/resolving servers. One set operates as usual without any redirection. The other set has the redirection implementation deployed and enabled. The DHCP information supplied to customers based on their cable modem MAC address will provide the IP addresses of the redirecting servers, unless the customer opts out in which case the IP addresses of the non-redirecting servers will be provided. The fact that their opt-out is MAC based strongly suggests that this is the mechanism (despite the spin they put on it about how users activities such as upgrading software could mess up other opt-out methods). As long as they don't mess with DNS query datagrams or any other traffic sent elsewhere, this should be OK. The average customer really won't care, or will actually like the way that operates.

opt-out site is down for me...

[daVinci1980]

But at least it's not redirecting me to a page offering me other helpful links.

Maybe I'm not in one of the test areas. (Austin).

Re:opt-out site is down for me...

[HeronBlademaster]

The domain resolves, but the server doesn't respond. There's a difference.

RFCs

[KingAlanI]

some of the RFCs are obviously sarcastic (like IP over Avian Carriers), so I wouldn't have been entirely surprised if that one was in there

Re:RFCs

[techno-vampire]

It's probably not a good idea to take any RFC seriously if its release date is April 1.

Re:Whatever.

[HeronBlademaster]

As others have mentioned, OpenDNS does the same redirection trick too.

Another shitty Comcast "service"

[Anonymous Coward]

Great!! Another shitty "service" for us Comcast users. Thankfully it's not here yet. Seem that the dicks at Comcast thinks it's funny to screw around with our service. I pay for the damn thing so I should be able to get what I want from it. Only other option I have here is DSL and that's a no go too.

You Are Correct, Sir!

[tunapez]

Unless we're being pedantic, then you are mistaken, they've been doing it for a couple of years now.

The opt-out DNS settings are available, if you you can find them on that horribly counter-intuitive site.
Here's they are:
        * 68.105.28.13
        * 68.105.29.13

Don't believe this internet forum troll? No worries, I wouldn't either. Google them and see!

EarthLink!

[antdude]

EarthLink does it too, but it has DNS' that you can opt out IIRC.

comcast and netflix

[goombah99]

I am pertpetually frustrated by my comcast connect, particularly in regards to netflix. I't very hard for me to sort out if the problem is a comcast issue, a netflix issue or and DNS issue.

basically what happens is I find my 12Mb/sec comcast link drops to 600Kb/sec in the evenings around 7 -10pm, just when I want to watch a movie. Now on some nights I am lucky and I see by speed tests I'm getting 2 or 3Mb/sec. Often the ping latencies however are 400 to 500 msec.

still that flux rate is overkill to watch a netflix movie. Yet I can't do it without constant rebuffering and quailty/resolution downgrades from netlfix as the movie proceeds.

i've tried using open DNS but that does not seem to help either

I've noticed that when I traceroute the netflix server I'll see about 9 jumps, in all sorts of strange geographic headings inside comcast, and then about 5 inside limewire before I reach a place where traceroute stops jumping. (I assume it's blocked). when the connection is especially bad I often see the trace route timeout inside the comcast side of the network.

So how should I be faulting here? I can think of two things. One is that basically the whole internet is slow between 7 and 10 pm and I'm never going to be able to watch netflix. or that netflix sucks between 7 and 10. or that I'm dealing with a last mile issue in comcast on the shared cable line. maybe between 7 and 10 pm all my neighbors are doing the same things and comcast has oversubscribed the cable.

what can I do to try to sort these factors out?

Re:comcast and netflix

[techno-vampire]

i've tried using open DNS but that does not seem to help either

Well, of course not. Who you get your DNS from has nothing to do with how your packets are routed. The interesting question (to me, at least) is why you thought using open DNS would reduce your ping times?

Re:comcast and netflix

[Antique Geekmeister]

You are blatnatly mistaken, sir.

Because your DNS tells you what the real IP address is, and in many locations, that is not what this "redirect" DNS service will lead you to. That may be a much nearer, but more bandwidth expensive location than Comcast wants you to use, or may not go through their monitoring and proxies and load balancers and most importantly, their _streaming video choking_ services. Comcast has established their willingness to interfere with bandwidth intensive services such as Bittorrent via SYN packats and other abuses: there's no reason to expect that they will provide this service for their customer's advantage, but rather for their own to guide traffic to their desired services.

Re:comcast and netflix

[Casualposter]

We had comcast and the connection speed and reliability was a real problem especially during that 7 - 10 PM range when many people are accessing the internet. We switched to DSL, which has it's own set of quirks, but the speed and reliability are much more stable than comcast was. I expect that the various cable companies will be awful until they roll out a "much better" service at a premium rate - something that takes the core of the internet and tries to turn it into AOL with TV channels and an expensive version of Skype. SO you could have the internet with a totally shitty experience or the premium TV-Phone-"Internet" service that costs a bit more but generates a ton more revenue for the cable ISP. You'll get your streaming movie, music on demand, World of Warcraft, and maybe even Xbox live, along with phone and lots of TV shows. But the access to the internet will be strictly controlled by the ISP - much like the early days of the internet back when it was all Compuserve and AOL or Usenet. Sure you'll still be able to get to all of the regular internet, but the experience will be more and more painful until most people give up and go with the "Internet-3" controlled by Comcast, Charter, etc. Don't give me that "the internet routes around blockages" crap, the internet can't route around the ISP as customers of various ISP's in arguments with other ISP's have discovered.

Re:comcast and netflix

[skarphace]

You are way over thinking this. It's not DNS. DNS is done after the connection is made, it won't slow down transfer speeds. Probably not netflix, they should be setup for late-day load spikes.

I think you can be safely sure that you are running into the inherent fault of cable technology. Between 7PM and 10PM are high usage times when everyone and their mother is using the internet. And because cable is shared, things slow down.

So, fault Comcast for not provisioning enough bandwidth for your neighborhood.

Re:So should...

[mibus]

Sure, except using OpenDNS is opt-in in the first place.

Re:I'm done. I'll be switching as soon as possible

[Anonymous Coward]

>Go go gadget government-sanctioned monopolies!

There, fixed that for you.

Verizon also

[Anonymous Coward]

Verizon hijacks DNS as well, giving Yahoo search results. Example: http://dnsassist.verizon.net/verizonassist/dnsassist/main/?domain=rfc-violaters

Re:So should...

[Darknight]

Yes, I see the wisdom of your post since you need to use the word "fuck" multiple times per sentence. You must be 100% correct, then. I salute your logic, sir.

Re:So should...

[Niten]

Despite their claims to the contrary, OpenDNS's servers are likely farther away from you than your local ISP's.

Absolutely right. Out of curiosity, I recently tested DNS performance as experienced from my home network, using Steve Gibson's excellent DNS benchmark tool. The test was between:

• My LAN's OpenBSD gateway & DNS server (10.19.0.1)
• My ISP's (BellSouth's) DNS servers (205.152.*)
• OpenDNS (208.67.*)
• Level 3's anycast servers (4.2.2.*)

OpenDNS was the clear loser in this test. (Sorry for the lack of numeric labels on this screenshot, but the graph is to scale.) Querying the local DNS server was of course faster than anything that had to go across the DSL modem, but OpenDNS was also significantly slower than the other remote servers tested.

built to fail?

[Anonymous Coward]

has anyone considered that this is supposed to fail?
Theses days failure is the new success. This will undoubtedly result in huge id theft scams, there will be a fake outrage about how the internet needs to be more secure and they will get a few billion from the federal government to design a 'secure' network, that is, one without any anonymity, and that builds a nice fat file on each of us everywhere we use it.

If it was the phone company

[Anonymous Coward]

"Time to call mom. Wow, I haven't called her in a long time."

[Dials number, but incorrectly]

[Phone connects]

"Beep, beep, beep. We're sorry, but the number you have dialed is ...."

"Intergalactic proton powered electrical tentacle advertising droids. INTERGALACTIC PROTON POWERED ELECTRICAL TENTACLE ADVERTISING DROIDS! Hi I'm Darth Harrington of Darth Harrington's intergalactic proton powered electrical tentacle advertising droids emporium and moon base! And due to a garbled sub-space transmission we are currently overstocked on all intergalactic proton powered electrical advertising droids! And I'm here to pass the savings on to yooouuuuu!"

"...not in service. Please hang up and dial again. This is a recording."

The real rason why Comcast is doing this.

[bmecoli]

I had a friend once that didn't pay her Comcast bill. When this happens, all DNS requests get redirected to Comcast's "Oh hi! Please activate your modem" page. After thinking about this for a bit, I had the ingenious idea of using OpenDNS to bypass Comcast's DNS server. I set up her PC to use OpenDNS, and lo' and behold it worked. She was able to use the internet as if she paid her bills and everything. See, Comcast is doing this because they don't want anyone to cheat them out of their service. I'm pretty sure that this could work with any Comcast approved modem as well.

Re:So should...

[Nesman64]

If "opt out" is cookie based, then it's useless. Can anyone confirm?

this is why comcast sucks balls

[DragonTHC]

my service had a huge interruption for about 3 days. I had to switch to a third-party DNS server to be able to even use my service.

Any word from comcast about this? nope.

Re:I'm done. I'll be switching as soon as possible

[swillden]

I'm semi-lucky in that I do have one other option: Qwest DSL. It's not a great option either, but it's better.

Could be, could be... but!

[Anonymous Coward]

"Also, this discredits Comcast's massive twitter efforts as ComcastBonnie so kindly made a slashdot account after seeing the twitter output from the article, and told us that the engineers promised no form of DNS hijacking was underway. Underway or not, it was certainly being planned, and coverups should not be appreciated." - by Anonymous Coward on Thursday July 09, @03:46PM (#28641183)

From having worked @ a major cable internet provider for a GOOD BIT a few years back, I can tell you they have their "own special team" for responding to reports like this one, where said companies are mentioned & especially on the "more travelled/trafficked websites" such as this one... so, don't be TOO surprised @ some of the responses here is all, & the FIRST THING I THOUGHT WAS:

"I wonder how many of these people are 'marketing plants' or their network engineer henchmen?"

& also

"How many of these repsonses are those losing monies from adbanner revenues??"

SO, I.E.-> Yes, you are hinting @ this it seems, so yes, they may be "plants" (i.e.-> marketing people for them, or, their own top engineers brought in to put out enough "techno-babble" (whether it is, or not) to alleviate any damage this might cause them, "p.r."-wise...) OR, those adversely affected by losing revenues gained by adbanner views or search results... etc. et al.

I don't see adbanners here (HOSTS files are wonderful for this, blocking them, & also speeding up your surfing in doing that OR hardcoding your favorites into it, with their URL-to-IP Address resolved correctly in them (which is great & helps speed too, that is, until a site changes HOSTING PROVIDERS, but, that's rare & most let you know this is taking place so you can counter for it in a HOSTS file))

Now - I am probably "preaching to the choir" here on that note to you though, so, if I am? Please, accept my apologies - we all live life & all that, & pickup on the b.s. out there going on!

(& from said ISP/BSP I worked for? Well, the other staff/workers are told, during training, to stay out of stories on places such as, say, dslreports.com, if it involves said cable or dsl internet provider)

Yes, it seemed pretty "dirty" to do, imo @ least, but it is, how it is. Like any business? They live & die largely by their reputation, as well as the quality of service they provide. I thought it was silly to give an order of that nature, because people should be free to speak their minds anyplace they choose, without threat of penalty from "the big boss", & it is "gotten around", easily enough, should an IT tech worker there wish to do so, even when they get free cable or dsl from their company (which most do this for their staff), but... this is "KoRpOrAtE AmErIkA" today, so we can expect such measures.

Sure, they could say "well you don't KNOW enough to respond there" & that only says they feel they hire incompetent staff, which doesn't look good doing THAT... or, that they may take the HONEST tack & say, "We send our very best technical personnel to offset the trolling happening to us" etc. et al (which would be a better way to respond, as to WHY they do these things, imo @ least).

Don't get me wrong:

The company I refer to here, which I won't name? Hey, they are, imo @ least, a great company though... so, other than that which I mention above, which I really didn't take THAT seriously or get angry over anyways because I really did think it was a top-notch outfit/operation which did provide their customers the fastest internet possible for cablemodem internet usage when I worked for they & they had 2 million customers & a TINY geographic area (but, it was a HUGE major metropolitan area they had, a major city (the most major of all iirc, population wise, in the USA or close to it in fact!)

----

"it wouldn't be the first time we trolled a legitimate story because its legitimacy was hard to validate at the time.

Re:Could be, could be... but!

[Anonymous Coward]

You seem to make an excellent point, but I have no clue what you're saying. Could you try it again without rambling, nested parenthesis, abbreviations, and run-on sentences?

Comcast DNS servers are already moot

[Anonymous Coward]

Years ago, Comcast's DNS servers were so fouled up that even surfing to Comcast.net would sometimes time-out. Many of us learned that the key to restoring health to our broadband performance was to specify non-Comcast DNS servers. So this new issue of DNS-hijacking is already moot.

Royalties?

[Captain Cabron]

Hey I've got a question for you Comcast
If people mistype my web address (ww.example.com), and Comcast shows them an ad, Comcast sends me part of the proceeds, right?
because Comcast is making money off of my brand name...

Comcast

[Anonymous Coward]

Comcast IS Malware!

at least they mentioned

[nimbius]

something about doing it. my cable co (insight) decided to do it silently and redirect my faulted queries to advertisements. simple solution: run my own fscking DNS server.

Re:So should...

[Anonymous Coward]

How does "an opt-out button on [some] page you [got] redirected to" help if I typo an e-mail address or NTP server name in some configuration file? Not everything on the Internet is a web browser.

Re:So should...

[SanityInAnarchy]

We also know that it's by MAC, which is a step forward from services which try to "opt-out" via cookie.

But I agree with grcumb -- not even close to enough. This kind of bullshit needs to be opt-in, if it's done at all.

Non-HTTP Error?

[Anonymous Coward]

A lot of the criticism about this system relates to how they would not get the appropriate hostname resolution failure.

Could the server that runs these "Domain Helper" webservices detect that a connection is not attempting to get http data and send a resolution failure? How many applications would actually not be able to understand that failure arriving after a successful DNS resolution?

Re:Non-HTTP Error?

[argent]

Could the server that runs these "Domain Helper" webservices detect that a connection is not attempting to get http data and send a resolution failure?

Since the actual connection never goes anywhere near the DNS server, no.

Re:So should...

[Ian Alexander]

What's the big problem?

Re:So should...

[Sir_Lewk]

Actually I only used the word "fuck" three seperate times, in three seperate sentences.

If you are offended by someone on the internet using a little light profanity then I kindly suggest that you fuck off.

DNS servers

[asdfndsagse]

level3 runs 4.2.2.3 4.2.2.4 4.2.2.5

No funny stuff.

Relegate your ISP to dumb carrier status

[gpuk]

AFAIK, my ISP (France Telecom) have no plans to implement DNS redirection but they already quite happily throttle and profile my traffic and I wouldn't be surprised if they decided to go the DNS redirection route sometime in the future.

So last month I took the decision to simply stop trusting my ISP. I now rent a virtual linux box for £15/month (I used bytemark but there are many others) and have installed OpenVPN on it. The virtual box acts as my network's gateway through which all non-LAN traffic now flows. My ISP has been relegated to essentially a dumb carrier whose only function is to provide a DSL link that allows me to create an encrypted tunnel to the linux box. Stick djb's dnscache (or any other resolver) on as well and you're done.

Added bonus? I can now watch all the BBC iplayer content (I am a UK national recently moved to France and have paid my TV license in the past so I figure, why not?)

Dont Other peope do this already ?

[Anonymous Coward]

Charter already dose this. I just use greese moneky to forward the url to a nice error page.

Everything Comcast does has underlining motives

[angelbunny]

This new 'service' Comcast is testing helps comcast identify its customers better which helps with the 250GB cap. The new DNS setup locks out hacked modems (unregistered modems) without spoofing as a legit modem. It also limits the speed cap from the cmts (node) end as well as the cable modem so no more uncapped 30megabit/s down and 10megabit/s up on a single modem without cloning a developer na modem.

The real conversation should not be about openDNS but how comcast is going out of its way to make sure it can identify which users are breaking the 250GB cap which ultimately forces many of the not so legit comcast users who like their anonymity to spoof as someone else on the same network and therefor ultimately putting blame on the wrong person when comcast issues an abuse suspend. It is ironic really.

It may sound like a completely separate subject but by comcast playing with its dns forwarding has much bigger back end changes that seem not related but in fact are.

Spread that info! Yes +5 INFORMATIVE!

[Anonymous Coward]

To "opt-out" all you have to do is change the last octet of the DNS servers they supply to you to 14. So if Verizon default DNS server is 123.123.123.12 change it to 123.123.123.14.

Verizon claims they aren't misleading their customers, but all the pages that tell you about the .14 trick have been broken for at least six months. They built those pages so they could pretend to be different, then purposely broke them as soon as they'd gotten Slashdot (and other tech sites) to agree that Verizon's redirection was pseudo-optional.

Work Completed: Comcast Domain Helper Opt-Out Succ

[Rick Richardson]

We have completed the work to opt you out of the Comcast Domain Helper service.

This change will take effect automatically when your cable modem renews its DHCP lease (generally within 5 days or less). However, you can easily make this take effect immediately via one of the following two methods:

      1. If your computer is directly connected to your cable modem, you will need to reboot your computer.
      2. If you have a router directly connected to your cable modem, you will need to (a) reboot your router and then (b) reboot your computer.

Thank you,
Comcast