Comcast DNS Redirection Launched In Trial Markets

malware by sopssa · 2009-07-09 06:40 · Score: 5, Insightful

Another great press release about how it will be helpful and a "service" for users, while the main purpose is just to gather extra advertisement revenue (while breaking internet standards). I mean, this is what malware do. Oh well, atleast these non-us ISP's dont do such dirty acts to their customers here. Time to voice your opinion maybe?

Re:malware by Shakrai · 2009-07-09 06:51 · Score: 4, Funny

while breaking internet standards
What are those? The last RFC that I read was titled "How to make the largest pile of cash while providing the least amount of service". I think it's RFC666 and is the one that most modern day ISPs seem to operate under.....

--
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
Re:malware by xvx · 2009-07-09 06:54 · Score: 3, Interesting

Comcast is great. So I pay them for an internet connection, the price won't go down, and they get extra advertising revenue from there users. How long will it be until they start injecting ads into websites?
Re:malware by jank1887 · 2009-07-09 07:09 · Score: 4, Insightful

modern corporate culture demands profit growth. not just continued profit, but growth of profits. how do you expect that to happen in a saturated market?
Re:malware by MrMr · 2009-07-09 07:19 · Score: 4, Insightful

Have the government outlaw your product?
Re:malware by basementman · 2009-07-09 07:26 · Score: 3, Insightful

How is this different from OpenDNS? OpenDNS shows ads if your page can't be found. That said I much prefer my ISPs ad free DNS service to OpenDNS.

--
A Magic the Gathering Article and Forum Aggregator
Re:malware by sopssa · 2009-07-09 07:34 · Score: 5, Informative

In what way is this relevant to OpenDNS? They actually do the same dirty trick aswell. Just because they have "open" in their name doesn't mean they're great and everyone should use them. They run their DNS servers to make profit from non-existing domains and hell, they even redirect requests to google.com to their own servers.
Thankfully there are open dns servers that dont do such either, for example university in Gothenburg, Sweden: 129.16.1.53 and 129.16.2.53 and several others. Those that have the technical knowledge can also set up their own dns recursive dns servers on their linux box and use those directly (while it fetches the results from root servers)
Re:malware by Anonymous Coward · 2009-07-09 07:37 · Score: 5, Funny

I tried to find this RFC, but when i opened the page, it redirected me to some 404 search page for my ISP.
Re:malware by Anonymous Coward · 2009-07-09 07:46 · Score: 5, Interesting

Just wanted to remind everybody that a few weeks ago, another slashdot article about comcast DNS hijacking appeared, and everybody wound up calling this specific blogger a liar.
What if before introducing mass trials, they randomly selected MAC IDs and did this in specific locations? Perhaps that blogger actually did break news.
But then, it wouldn't be the first time we trolled a legitimate story because its legitimacy was hard to validate at the time. :)
Also, this discredits Comcast's massive twitter efforts as ComcastBonnie so kindly made a slashdot account after seeing the twitter output from the article, and told us that the engineers promised no form of DNS hijacking was underway. Underway or not, it was certainly being planned, and coverups should not be appreciated.
Just my two cents
Re:malware by dimeglio · 2009-07-09 07:54 · Score: 4, Informative

Easy, through innovation and distinct added value. Shouldn't take a rocket scientist to figure it out but apparently it does. Recently, our ISP decided to offer a brand new service allowing you to double your bandwidth simply by adding another DSL line. Guess what, they are now the fastest growing ISP in Canada.
Schemes like DNS redirection are a scam and should be banned unless they contain no advertising or indirect revenue generation whatsoever.

--
Views expressed do not necessarily reflect those of the author.
Re:malware by jtownatpunk.net · 2009-07-09 08:21 · Score: 3, Insightful

Yeah, it's exactly the same thing. Except opendns is very clear about what they're doing and any computer or network using opendns must explicity configure their system to use the opends servers. Heck, I'm looking at an opendns redirect right now. It's hard to miss the big opendns logo. And the "Why am I here?" link. And the "did you mean" links. Yeah. Exactly the same "dirty trick".
Re:malware by deraj123 · 2009-07-09 08:55 · Score: 4, Informative

Try looking at the entire service. So far as I have been able to tell, you can turn off every single one of their "features", giving you a simple, straightforward dns service.
And for those replying to you confused about the google thing - they don't

redirect requests to google.com to their own servers
. What they do is provide a dns entry for www.google.com that points to their own servers. These servers proxy the real www.google.com to strip out some functionality that opendns found particularly offensive (I have not experienced the functionality, and can't say whether I agree or disagree with their views). However, like every other "feature" I've found at OpenDNS, you can turn this off. Yes, at first you couldn't. I stopped using OpenDNS for awhile. Now you can.
Re:malware by Tacvek · 2009-07-09 09:07 · Score: 2, Informative

The real nasty issue with these services are that they are claimed to be helpful to users. The issue is that it is not helpful. Modern browsers already provide options to redirect NXDOMAIN's to a search engine, or other useful things.
For example, Google chrome provides a nice page that says "DNS error - cannot find server" in the corner, and provides a helpful search box that is pre-filled with the words found in the domain name. (I have no idea what algorithm is being used to find the word breaks, but it seems to work reasonably well.)
If you have Google Toolbar installed in IE, it does the same thing (except for having Google Toolbar branding rather than Chrome Branding).
Other common search toolbars provide similar services.
I will admit that IE's default error page, and Firefox's default error page are not as helpful to most users, but rather than hijack DNS, why don't you (ISPs) just add the "feature" to the IE toolbar you provide on your Set-Up CD. Those who have no use for such a service don't use those CDs anyway.

--
Stylish sheet to fix many problems in Slashdot's D3: https://gist.github.com/801524
Re:malware by psyclone · 2009-07-09 17:43 · Score: 2, Informative

Um, this concerns me quite a bit:

These servers proxy the real www.google.com to strip out some functionality that opendns found particularly offensive...
What? That doesn't make any sense. They only appear to proxy the first page, enough to capture what you type in the search box.
Lets examine the evidence:
$ dig @resolver1.opendns.com www.google.com A www.google.com. 30 IN CNAME google.navigation.opendns.com. google.navigation.opendns.com. 30 IN A 208.67.216.231 google.navigation.opendns.com. 30 IN A 208.67.216.230
$ whois 208.67.216.231 OrgName: OpenDNS, LLC
Now visit both:
http://208.67.216.231/
http://www.google.com/
Notice anything different in the footer? Say the link that says Go to Google.com
There may be a good faith relationship between OpenDNS and Google, but it still means that OpenDNS is proxying your queries! Thus tracking your search queries.
It appears OpenDNS never responded to the many questions on their own forum
DNS redirection is bad, and proxying to collect information is evil. Both methods are employed by scammers and phishers.
Re:malware by L4t3r4lu5 · 2009-07-09 22:10 · Score: 2, Funny

This result was brought to you by Whoosh! Search Solutions, hosted by Comcast.

Click here for fr33 v14gr4! Guaranteed member of bigging to be!

--
Finally had enough. Come see us over at https://soylentnews.org/
Re:malware by rajkiran_g · 2009-07-10 02:14 · Score: 3, Informative

Here it is:
http://tech.slashdot.org/article.pl?sid=09/06/09/1731238

Here We Go Again by eldavojohn · 2009-07-09 06:41 · Score: 5, Informative

Some may remember when VeriSign tried this back in 2003, where it also failed.

Oh yeah, way back in the day. But let us not forget Earthlink's attempt at this or Canadian Rogers Cable or Charter or NJ Cabelvision or ... I'm sure you could find no end to this stream of providers offering their customers something the customers simply do not want.

And I'm pretty certain most of those ended or resulted in customers bitching out the provider. Yet here we go again. Why? Well, that's simple: ad revenue.

--
My work here is dung.

Re:Here We Go Again by northernboy · 2009-07-09 06:58 · Score: 5, Informative

If I'm not mistaken (although I often am, sorry in advance) Cox has been doing this for months now, and nobody posted anything about that. If I 'typo' a URL at home, when connected via my (or my neighbor's) Cox cablemodem, I get a Verisign page indicating that www.whateveriswas.com is Under Construction.
Is this not muchly the same thing??
It pisses me off, but not enough to hunt down a better alternative.
Re:Here We Go Again by Anonymous Coward · 2009-07-09 06:58 · Score: 2, Informative

Rogers is still doing it.
Re:Here We Go Again by jank1887 · 2009-07-09 07:21 · Score: 2, Informative

I believe my Verizon DSL service does this. It can be disabled either by changing your computer DNS settings or modem settings depending on which modem you use.
Verizon Support - Opting out of DNS assistance
Re:Here We Go Again by rminsk · 2009-07-09 07:31 · Score: 5, Informative

To "opt-out" all you have to do is change the last octet of the DNS servers they supply to you to 14. So if Verizon default DNS server is 123.123.123.12 change it to 123.123.123.14.
Re:Here We Go Again by raddan · 2009-07-09 07:41 · Score: 4, Interesting

Sprint currently does this with their AirCard service. In fact, even if you try to query a specific DNS server, it hijacks your request and redirects your packets to its own. I discovered this after wondering WTF my DNS server was not operating correctly-- it turns it that my new DNS record had not propagated to Sprint's DNS. Since I run our company's DNS, this is a major PITA to me. Oh yeah, they appear to mess with DNS record TTLs as well.

I'd gladly post examples but I'm at work and my AirCard is at home at the moment.

I would gladly switch to another ISP, but I'm locked-in to a 2-year contract. Unless I can argue that their DNS hijacking violates the TOS, but I doubt it.
Re:Here We Go Again by Khyber · 2009-07-09 08:15 · Score: 4, Informative

No, you threaten to sue them for lost company profits caused by their DNS hijacking and interfering with your work routine, and that you can 100% prove it and have documented everything relevant. That'll get you out of your contract in a hurry.
I just used that to help a motor sports company out here in CA get out of their contract with Comcast.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.

Who's providing a backdoor DNS service? by argent · 2009-07-09 06:43 · Score: 4, Insightful

Sounds like time to pick some semi-standard alternate port number and start setting up some alternate recursive DNS servers, something between alt.* and TOR.

Re:Who's providing a backdoor DNS service? by 644bd346996 · 2009-07-09 06:52 · Score: 4, Insightful

Why? It's not like Comcast is going to be intercepting all DNS traffic and routing it through their spammy DNS servers. Only the people who get their resolvers from DHCP (ie the people who don't know enough to care) will be affected.
Re:Who's providing a backdoor DNS service? by TheSpoom · 2009-07-09 08:23 · Score: 4, Informative

It's not like Comcast is going to be intercepting all DNS traffic and routing it through their spammy DNS servers.
Why not? As raddan posted above me, Sprint already did this with their aircard service. The huge majority of customers won't notice the difference since they don't know about alternative DNS servers.

--
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Re:Who's providing a backdoor DNS service? by totally+bogus+dude · 2009-07-09 16:27 · Score: 3, Informative

It's a problem because DNS is used by more things than web browsers with human operators. A "this host does not exist" response at DNS-level contains information that a "404 not found" response at HTTP-level does not provide. And that's even assuming they have the common sense to make their "default search page" return an error status code; it's highly likely it'll return an OK status, since as a general rule the people who understand how the internet works at a technical level will refuse to be involved in these kind of projects, which means people who don't really understand what they're breaking are in charge of it all.
When Verisign did this a few years ago, they set up an SMTP rejection service so that mistyped domain names in email addresses would result in an immediate bounce, rather than sitting in the mail queue attempting to be delivered to an address that didn't accept mail for a few days before finally being bounced. This service didn't actually work properly, with the result that if you had more than one incorrect domain in the recipient list, you would get a bounce for only some of the wrong domains. This is because the people that implemented the service didn't think it was necessary to actually parse the SMTP commands, and instead just responded with a scripted "Hello, Ok, Reject" over and over again regardless of what the input was. Needless to say, this was very confusing for actual mail servers.
In addition, people using web browsers that are configured to do something useful in the case of a non-existent domain name get screwed, because now every domain resolves and serves up web pages. If Comcast's "not found" service is not as good as whatever their browser was previously doing, too bad.
At least Comcast provide an opt out, and most of their customers are presumably using Comcast's SMTP relay servers, which one would hope use real DNS servers, so the problems should not be as widespread as when Verisign did it to the entire .com namespace. However whenever you change how a fundamental part of anything works (and has worked for decades) there will always be fallout and unanticipated issues. This is also complicated by the fact you can't differentiate DNS lookups by web browsers from DNS lookups from anything else; with a result being that even when you do anticipate issues, you can't provide a 100% adequate solution to mitigate it.

Call it what it is by wilsoniya · 2009-07-09 06:46 · Score: 5, Interesting

Didn't RTFA, but lets call a spade a spade--this is typosquatting

--
I can't remember the last time I forgot anything.

Re:Call it what it is by Zontar_Thing_From_Ve · 2009-07-09 07:21 · Score: 5, Interesting

This reminds me of a little known incident that happened in the mid 1990s. For a while, AT&T ran a service called 1-800-OPERATOR where you could call this number and get AT&T to connect you to a long distance call. For those who don't know, we're required (at least in most of the USA if not all of it) to pick a long distance service provider. That company does not have to be who you get local telephone service from. It was possible to place long distance calls with someone other than your long distance provider by simply dialing an access number that belonged to that company and you would get billed for the call from that company. So for example you might have, say, BellSouth as your long distance provider, but you could dial an access number and place calls on Sprint if Sprint offered a better rate. No need to change providers that way. So AT&T decided that it would be smart to get in on this too and lower their rates. So the way it worked was that you called 1-800-OPERATOR and someone at AT&T would connect you to your long distance call and charge you whatever rate AT&T had for the service. AT&T promoted this service on national television commercials and spent a lot of advertising money on it. Anyway, I had a friend at the time who worked for MCI in their marketing department. She told me that MCI had reserved the telephone number that corresponded to 1-800-OPERATER. MCI spent zero dollars advertising and simply waited for people who couldn't spell to call that number and they placed the call for the person and made the money off it. She told me "You would not believe how much money we made off this". Some months after the campaign started, AT&T quietly pulled the plug on it. I always assumed that too many people couldn't spell "operator" correctly and they were tired of giving business to MCI for nothing.
Re:Call it what it is by Hurricane78 · 2009-07-09 07:28 · Score: 2, Informative

Yes it is. What you described is the very definition of typosquatting, if you add the point of what you see on this "GUI interface" (which is the job of your browser to create, btw.)
And if you think about them paying for servers to display this "interface", you will know that there is a reason they do this:
To make money. Obviously.
And what is the reason, that typosquatters add a "GUI interface" to unused domains?
Also to make money. Obviously.
Point proven. :)

--
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Re:Call it what it is by typosquatting · 2009-07-09 07:36 · Score: 5, Interesting

Totally agreed - it is absolutely typosquatting on a massive scale.

Many people don't realize that there's TONS of traffic going to typo domains (whether registered or not). For instance, youtuve.com (notice the v instead of the b) got 358,751 visitors over the last 31 days. It redirects to another domain for cloaking purposes, but here is the traffic report. This level of traffic provides the financial incentive to implement these DNS schemes.

By the way, there's a new, free typosquatting scan tool at aliasencore.com. It shows you all the registered .COM domain names that are one character misspellings of any Alexa top 100,000 site you enter. It also displays screenshots of those typosquatting sites. It's a nifty way to get a quick idea of the rampant growth of typosquatting. Here's an example that shows the 431 registered .COM domain names that are one character away from google.com.

Full disclosure: I am Graham MacRobie, the CEO of Alias Encore, Inc. We help companies recover cybersquatting domain names, but we focus solely on "slam-dunk" typosquatting cases (obviously only registered domain names). I can speak from personal experience in this field that the very last thing we need is wholesale typosquatting at the DNS level.

Opt Out page is Slashdotted by Itninja · 2009-07-09 06:50 · Score: 2, Funny

Or is it Comcasted?

--
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.

Re:Opt Out page is Slashdotted by NeverVotedBush · 2009-07-09 07:29 · Score: 2, Funny

I keep hoping someone would take their new commercial with the woman walking through the virtual world kind of chanting and substitute a really raunchy parody chant... g . o . a . t . s . e ... r . o . f . l - ing...

I just signed up the competition... by GPLDAN · 2009-07-09 06:53 · Score: 4, Interesting

It was *MUCH* easier for me to sign up for basic TV + internet with Comcast than what I ended up doing. I wanted to keep everything at the magic $100/mo. number, so I went with AT&T - DirecTV partnership, where they give you DSL and a dish and DVR, and put it all on one bill. My DSL is 3Mb down/768kb up, where a Speakeasy test at my neighbor showed almost 12Mb down and nearly a full meg up. When he asked "why would you choose that?" - my answer was simple: Comcast.

AT&T doesn't touch my bandwidth. They don't cap it, they don't filter it - they aren't keeping a database of my URL lookups. That's worth a great deal to me - and Comcast will never get my business. I urge everyone else to do the same, even if it is some other DSL provider or dish provider.

Re:I just signed up the competition... by plaiddragon · 2009-07-09 07:02 · Score: 5, Informative

AT&T ... they aren't keeping a database of my URL lookups7.
Until the NSA asks them to. Let's not pretend that AT&T isn't evil.

--
* * * --they cant all be your best, that would be confusing
Re:I just signed up the competition... by tekproxy2 · 2009-07-09 07:35 · Score: 2, Informative

AT&T Caps my bandwidth. They charged me an extra 20 dollars a few months ago for going over the limit. I buy their "ultra mega super elite" DSL service and upload an average of 40kb a second every second of every month. They sent me an e-mail notifying me about this wonderful little change to my AT&T e-mail address which no one fucking uses. I first saw the change on the bill. Thanks AT&T.
Re:I just signed up the competition... by NeverVotedBush · 2009-07-09 07:36 · Score: 2, Informative

I agree completely on not going with Comcast. I go with Qwest for my DSL.

But you do know about the special rooms on the AT&T trunk lines that monitor all the traffic for the NSA, right?

Not that me using Qwest stops my traffic from being monitored too, but at least I am not directly supporting AT&T (or Verizon) and their habit of handing over whatever information is asked without requiring a search warrant to back it up.

Qwest refused to hand over data without a search warrant.

A LOT of ISPs already do this... by nweaver · 2009-07-09 06:53 · Score: 5, Informative

I don't want to name names, but Netalyzr showed that several major ISPs already do this, and allows you to check for yourself what the behavior is on your network.

Comcast is following the lead of other major ISPs which have been doing this for some time now.

--
Test your net with Netalyzr

Re:The Sky isn't faling. by Shakrai · 2009-07-09 06:54 · Score: 5, Interesting

The sky isnt falling.

It is if you were foolish enough to believe that the RFC/protocol standards would be obeyed and wrote code that relies on a NXDOMAIN response to detect a bad hostname. Now you are going to an 'A' record that points to a Comcast server. This will break various applications but they don't give a damn because it's all about the ad revenue and who uses the internet for anything other than surfing anyway?

--
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.

Re:So should... by blueg3 · 2009-07-09 06:56 · Score: 4, Informative

Except for the bit where Comcast users not using Comcast DNS servers are unaffected, as per TFS.

Unless you're complaining that they could, in theory, redirect port 53. Frankly, anyone remotely familiar with how the Internet works should know that your ISP *could* completely and arbitrarily control any nonauthenticated protocol, including DNS.

Re:The Sky isn't faling. by Maximum+Prophet · 2009-07-09 06:56 · Score: 5, Interesting

No, it will only show those pages that have paid to be listed as what you want to see. (at least after an initial trial run)

This could easily be done in the browser in a non-evil way. When you type in a name and get a non-response, similar names typed after would be recorded. Then, when you make the same spelling error, gooogle.com, it takes you to where you want to go. Since it's in the browser, people could edit and share their commonly misspelled domain names.

--
All ideas^H^H^H^H^Hprocesses in this post are Patent Pending. (as well as the process of patenting all postings)

Problems with this by DigitAl56K · 2009-07-09 06:58 · Score: 4, Interesting

I speak from the perspective of being a RoadRunner user rather than a Comcast user, but RR implements a similar service. They have a link in the lower right of their results page where you can click to set your preferences and disable the "feature". Except just the other week that preference broke for me, and I was stuck with DNS hijacking. I phoned their customer service line, the person on the other end of the line had absolutely no idea what I was talking about.

DNS hijacking is a bit like Phorm without profiling really. Well, assuming there is no profiling. If there was profiling they'd make more money from the ads they'll inevitably insert there to "support" the service (Edit: oh look, they already have!). Personally I put this issue, along with Phorm in a whole category of problems related to the fact that we still don't secure and authenticate most of our activities on the internet (http, dns, yadayada). ISPs can do what they like and it's hard to stop them. Third-party DNS services seem to be the way to go recently. Of course without security/authentication your ISP can put a stop to that quite easily too.

This is all before you get in to the technical details of clients that may implement specific behavior for when bad DNS queries are expected to fail but don't.

Re:The Sky isn't faling. by xvx · 2009-07-09 06:59 · Score: 2, Interesting

True, for anyone tech savvy they would know better. But what about people that don't know better and that extra ad revenue. Will that be passed back to the customer? Absolutely not.

Re:So should... by sopssa · 2009-07-09 06:59 · Score: 5, Informative

OpenDNS does exactly the same. (unless you register account and change it, but thats the case with this comcast thingie aswell)

Re:So should... by The+End+Of+Days · 2009-07-09 06:59 · Score: 3, Insightful

You can opt out, you know. It says so right in the summary.

Also please don't use "evil" to describe things that are merely inconvenient. It greatly diminishes the horror and suffering people have gone through at the hands of real, actual evil.

Keep trying till you succeed by Lead+Butthead · 2009-07-09 07:03 · Score: 4, Insightful

When in doubt, keep trying. When rejected, keep trying. Enough people do this, it becomes the norm. Sad, but true.

--
ELOI, ELOI, LAMA SABACHTHANI!?

Lots have failed, but some have succeeded by Sheafification · 2009-07-09 07:04 · Score: 4, Informative

I noticed the summary mentioned several attempts that have failed, but makes no mention of other ISPs that are still doing it. Time Warner Cable is one that has been doing this for a while now (maybe a year?). Anyone know of others?

Re:The Sky isn't faling. by mdmkolbe · 2009-07-09 07:04 · Score: 4, Insightful

Providing a nice GUI on a DNS lookup fail is the job of the web browser not the DNS server. DNS is infrastructure not user interface.

Re:So should... by Anonymous Coward · 2009-07-09 07:05 · Score: 5, Informative

OpenDNS does the exact same thing. To avoid DNS highjacking if you use OpenDNS, you have to have an account with them, change your preferences and always be identifiable to OpenDNS so that it can apply your preferences. It's easier to opt out at Comcast than to opt out at OpenDNS. Besides, OpenDNS also redirects www.google.com to OpenDNS servers, not just nonexistent domains.

Re:So should... by Ian+Alexander · 2009-07-09 07:05 · Score: 4, Informative

According to the fine article there's an opt-out button on the page you get redirected to so I'm not certain that would be necessary:

We also understand that sometimes customers want to surf their own way, without the assistance of services like Domain Helper, so we offer an easy way to opt-out right on the Domain Helper search page.

Re:The Sky isn't faling. by doshell · 2009-07-09 07:06 · Score: 5, Informative

It doesnt redirect you to another 3rd party site owned by the NSA, it simply provides a web GUI that suggest sites on what the system thought you wanted to see.

It doesn't redirect you to a third-party site owned by the NSA; it redirects you to a third-party site, full stop. This not only breaks a whole host of applications relying on DNS to inform them that a domain name doesn't exist, but it is in violation of the standards that hold the Internet together.

--
Score: i, Imaginary

They shouldn't control it. by Well-Fed+Troll · 2009-07-09 07:11 · Score: 2, Insightful

Why exactly does the ISP control DNS?
Given the shenanigans the ISPs and governmental authorities have been up to the last few years, I say we need to rethink TCP. You see, we've been assuming all along that ISPs are not malicious. We need to start assuming they are malicious. The new TCP protocol should only assume that all socket level data is sensitive and therefore must be encrypted as to both its contents AND its destination. This implies traffic shaping, onion routing and a public key based DNS

Bad assumption being made by FranTaylor · 2009-07-09 07:13 · Score: 4, Interesting

This is all done under the assumption that the DNS query is for an HTTP request.

What happens when other services run afoul of this setup?

For example: Is my POP client going to hand my login credentials to a Comcast server, if my email service's DNS does not resolve for some reason?

Re:Bad assumption being made by mdm-adph · 2009-07-09 07:28 · Score: 2, Funny

Forgive me for my lack of knowledge in this area, but isn't there some sort of encryption involved with that? Wouldn't you verify that the server you've reached is actually the server you wanted before you hand over credientials?

--
It is by my will alone my thoughts acquire motion; it is by the juice of the coffee bean that the thoughts acquire speed
Re:Bad assumption being made by blueg3 · 2009-07-09 07:40 · Score: 2, Informative

That depends. If you have server authentication, it won't. More importantly, if the Comcast server doesn't listen on any port but 80, it certainly won't.
If you were relying on correct DNS responses to provide security (such as preventing your login credentials from being given away), you were doing it wrong in the first place.

Re:Best DNS alternative w/o redirection? by sakti · 2009-07-09 07:14 · Score: 4, Informative

I use Level3's anycast dns resolvers. They are fast and work great. Pair them with a local dns cache and you'll be golden.

4.2.2.1, 4.2.2.2, 4.2.2.3, 4.2.2.4, 4.2.2.5, 4.2.2.6

In case you don't know about anycast.

http://en.wikipedia.org/wiki/Anycast

--
"It is better to die on one's feet than to live on one's knees." - Albert Camus

Re:So should... by Sir_Lewk · 2009-07-09 07:16 · Score: 5, Insightful

No.

Knock this shit off and mods, wise the fuck up. Just because it has "open" in the name doesn't make it suddenly good and benevolent, They do the exact same fucking thing.

Anyone who's been on slashdot for more than a week or two probably has seen dozens of comments suggesting OpenDNS in cases like this, always modded up. Every single time people post corrections pointing out that they do the same thing. Does anyone ever listen?

Wise the fuck up

--
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)

Re:Attempt? by Timex · 2009-07-09 07:16 · Score: 2, Interesting

I use Earthlink for an ISP. I also know how to change my "default" DNS servers, so I don't have to deal with their antics.

If people don't like what the ISP does to things like this, they should either learn how to fix the problem (because their ISPs will simply say there IS no problem because it's functioning as it was designed to do) or look for another ISP.

Why do I stay with Earthlink? Simple:

Cable modem service is cheaper than DSL rates in my area, given identical UL/DL speeds.
I don't have cable TV (by choice), so having cable modem service alone would be higher with Comcast, the Cable provider in my area.
Eathlink service (in my area, at least) is "powered by Comcast". If there are broadband-related issues, Earthlink will work with Comcast's people to work out any problems.

Generally, I'm pleased with Earthlink.

--
When politicians are involved, everyone loses.

Re:So should... by seizurebattlerobot · 2009-07-09 07:16 · Score: 5, Informative

Why do these OpenDNS posts keep getting modded up? OpenDNS utilizes the very practices this article bemoans! If you query a domain that does not exist, your browser is redirected to OpenDNS's ad-laden spam site.

Despite their claims to the contrary, OpenDNS's servers are likely farther away from you than your local ISP's. They also keep permanent logs of all queries, which could be subpoenaed by a government entity. Their joke of a privacy policy allows them to sell your logs to "Affiliated Businesses", which pretty much means anybody. Not that it really matters - they could amend their privacy policy tomorrow morning and be selling your info by the afternoon.

I think many people read the "Open" part of the OpenDNS name and turn their brains off.

Opt Out if you're not cool with this by ComcastBonnie · 2009-07-09 07:19 · Score: 2, Informative

Just go to the site below and opt-out :) https://dns-opt-out.comcast.net/

it can fail badly by RichMan · 2009-07-09 07:22 · Score: 5, Interesting

My ISP did it for a while. The problem was that it was badly implemented and increased to load on the upstream DNS services.

So if the middle layer DNS cache was empty and I asked for
mybank.com the bottom level DNS timed out and it failed over to the advertising page.

---
Think of searching on coke.com or any real address then the system failing and redirecting you to pepsi.com.

Think of the lawsuits. Think of the denial of service attacks possible
a) register not_mybank.com, have spoof of mybank.com page ready to launch
b) pay to have a fail on mybank.com route to not_mybank.com
c) denial of service attack to root servers for mybank.com, flip in your spoof page
d) have the ISP's magically send people to your spoof site from their saved URL's and collect passwords

Yeah this is a good idea.

Re:So should... by Hurricane78 · 2009-07-09 07:23 · Score: 3, Funny

Are you kidding, or do you work for OpenDNS?

Because I switched to OpenDNS because of people (you?) mentioning it here on Slashdot.

And then I noticed, that OpenDNS also does DNS redirection!

--
Any sufficiently advanced intelligence is indistinguishable from stupidity.

Not the same at all. by John+Hasler · 2009-07-09 07:28 · Score: 4, Interesting

> Some may remember when VeriSign tried this back in 2003, where it also failed.

Not the same at all. VeriSign tried to do it with the TLD servers, which nobody can avoid. These guys are just doing it with their own servers, which you can bypass unless they block you. Even if they do you can, at least in theory, switch ISPs. They aren't likely to bother with blocking, though, because the number of people who will bypass is tiny.

--
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.

What about non-HTTP? by slushdork · 2009-07-09 07:30 · Score: 5, Interesting

I'm a Comcast "customer" in an affected "market" (Colorado). How will this affect DNS resolution requests for non-HTTP purposes? There is no way for the Comcast DNS servers to know what a DNS name resolution request is for: it could be for HTTP, or it could be for SSH, FTP, etc. So if I mis-type an FQDN hostname in an SSH command, will the DNS resolution request now suceed? Previously SSH would fail with a "cannot resolve hostname" error or something similar. Will it now try to connect with SSH to the Comcast "domain helper" servers? What about its effects on local DNS caching servers (e.g. dnsmasq)?

Also, this statement from Comcast's blog is blatantly false:

Despite the fact that web addresses are easier to remember than their IP address counterparts, sometimes you mistype an address. Let's say you type in http://www.comtcas.com/ (instead of http://www.comcast.com./ Normally you then sit and wait for the Web browser to time out, then you receive an error message that the site does not exist, and then you have to retype the correct address.

Normally you would *never* "sit and wait for the Web browser to time out" (well, these *are* Comcast's DNS servers after all, so in this specific case it might be true). Normally, your browser would get a DNS resolution failure and show you a built-in error page instantaneously. Now, on the other hand, you have to wait until your browser goes off and loads a page of Comcast ads.

Domain Helper my a$$!

Oblig. by blackfrancis75 · 2009-07-09 07:32 · Score: 4, Funny

I've been a Comcast customer for HERBAL VIAGRA several years and have never had an issue with unsolicited REAL WEIGHT LOSS advertising of any kind.

Re:The Sky isn't faling. by SCHecklerX · 2009-07-09 07:36 · Score: 5, Insightful

If a domain name does not exist, I want my systems to receive an error telling them so, not be redirected to a system that they were not expecting to be directed to.

Re:The Sky isn't faling. -- Actually yes by jackb_guppy · 2009-07-09 07:36 · Score: 4, Interesting

This screws with "what is valid URL". Basically, now all URL are valid. So for example you want "coke.com" anyway you mistype that request: cole.com, Coce.com, koke.com, cooke.com and ... will be a valid URL, even if it does not exist.

Another way of looking at this is cybersquatting. They are taking the whole URL domain. So if you have a new URL, guess where it will not show up for a long while.

And third you can think of it as "DNS poisoning", since if you are running your own DNS, comcast will be suppling you fake information, with its own time out.

Re:So should... by ahecht · 2009-07-09 07:43 · Score: 3, Informative

OpenDNS is just as bad -- they do the same thing. The real solution is to change your DNS servers to use the L3 DNS servers at 4.2.2.1, 4.2.2.3, 4.2.2.4, 4.2.2.5, or 4.2.2.6, which are often faster than Comcast's anyway.

Re:The Sky isn't faling. by Tony+Hoyle · 2009-07-09 07:43 · Score: 4, Insightful

If you think it's OK to hijack DNS think about what happens if you mistype an email address, or what happens when your configured NTP server goes offline.

Re:I'm done. I'll be switching as soon as possible by griffjon · 2009-07-09 07:55 · Score: 5, Insightful

Me too.

Oh wait, Comcast doesn't have any competition for high-speed where I live.

Go go gadget free market!

--
Returned Peace Corps IT Volunteer

Re:So should... by Tony+Hoyle · 2009-07-09 08:00 · Score: 2, Informative

When opendns started it was precisely that - an open DNS system which even had its own set of free TLDs to play with.

Then they smelled money. And the rest is history.

Use the anycast DNS at 4.2.2.1, 4.2.2.2, etc. Run by Level3 who have plenty of money anyway and don't need to nickel and dime DNS for it.

Re:Best DNS alternative w/o redirection? by c0y · 2009-07-09 08:26 · Score: 2, Interesting

Open DNS recursion is it's own form of evil. I'm waiting for the day that Level3 locks those down to their own networks, and hundreds of our customers call us to complain "the Internet is broken" (it seems almost everyone knows those IPs and many choose to use them, despite the fact that our own DNS service is anycast and will always remain Redirect-free because we don't treat it as a potential revenue source, but a vital part of Internet infrastructure that ought to be inviolate).

Google "DNS recursive amplification" to see what I mean about the evils of open resolvers. Hell, even closing down recursion doesn't stop the madness since root hint amplification is being abused too.

We drop all IP traffic directed to our anycast IPs at our borders. You can't even ping them. query-source is not a listen-on address so it is impossible to get any type of response from our named. I predict most other ISPs being forced to do something similar. The poisoning threats are also ever on the horizon and this is another prudent safeguard.

I would find this acceptable if ... by Skapare · 2009-07-09 08:39 · Score: 2, Insightful

... in addition to their modem MAC based opt-out mechanism, they:

Provide alternative DNS cache servers that users can manually configure to bypass the redirection DNS cache servers. Support for this service can be limited to only informing the customer of the IP addresses of these DNS cache servers, such as on the tech support web page that tells customers how to opt-out. They do NOT have to support users on how to deploy this type of change.
Do NOT interfere with DNS queries sent to other DNS servers, whether with or without the recurse flag in the request. This is so that a user can run their own DNS cache server either on an internal network, or access a DNS cache server elsewhere on the internet (their own remote server, or a DNS caching/resolving service), without the need to set up a secure tunnel.
Do NOT interfere with any form of secure tunnel or other VLAN.
Do NOT intercept any UDP traffic, or TCP connections, or SCTP sessions, unless those are directed specifically to the provider's servers or services. For example the provider may offer HTTP caching services, media stream multipliers, IRC servers, etc., but must not affect users that want to bypass those services. ONE EXCEPTION: connections made to port 25 outside the provider's network SHOULD be intercepted unless the customer makes a "knowledgeable opt-out request" (for example, mentions "SMTP").
Do NOT do any other evil activity I don't have time to think about right now.

Anyone that knows what they are doing, or finds out via information from some source (the provider not being obligated to supply this information), should be able to use the internet exactly as it was originally intended.

--
now we need to go OSS in diesel cars

Re:What would this look like? by Anonymous Coward · 2009-07-09 08:51 · Score: 3, Informative

The web page looks the same. You have to look at the DNS results (or the TCP connections) to see what's going on. If you're using Windows, open a command prompt and compare the outputs of
nslookup www.google.com 4.2.2.1
and
nslookup www.google.com resolver1.opendns.com

The first parameter is the query, the second is the server. 4.2.2.2 is the anycast address of one of Level3's DNS resolvers, which implement DNS correctly. The result of the second command is a CNAME under the opendns.com domain and an IP address which belongs to OpenDNS LLC (you can verify this by asking whois.arin.net for information about the address with a whois client).

Re:What would this look like? by Pathwalker · 2009-07-09 09:10 · Score: 4, Informative

If you don't believe it, try the commands for yourself:
-=-=-=-=-
overmind% nslookup
Default Server: localhost
Address: 127.0.0.1
> set querytype=a
> www.google.com
Server: localhost
Address: 127.0.0.1
Non-authoritative answer:
Name: www.l.google.com
Addresses: 74.125.53.147, 74.125.53.104, 74.125.53.99, 74.125.53.103
Aliases: www.google.com
> server 208.67.220.220
Default Server: resolver2.opendns.com
Address: 208.67.220.220
> www.google.com
Server: resolver2.opendns.com
Address: 208.67.220.220
Non-authoritative answer:
Name: google.navigation.opendns.com
Addresses: 208.69.36.230, 208.69.36.231
Aliases: www.google.com
-=-=-=-
Talking to my local DNS server, www.google.com resolved to IP addresses in the 74.125.0.0/16 netblock, which is assigned to Google.
Talking to resolver2.opendns.com, www.google.com resolved to 208.69.36.230 and 208.69.36.231, which have no reverse information, but are in the 208.69.32.0/21 netblock which is assigned to OpenDNS.

Re:So should... by Darknight · 2009-07-09 11:06 · Score: 2, Funny

Yes, I see the wisdom of your post since you need to use the word "fuck" multiple times per sentence. You must be 100% correct, then. I salute your logic, sir.

--
________________________________ ___ _________ __ _______ _ ____ __ _ __ Darknight / _ \___ ____

Re:comcast and netflix by Antique+Geekmeister · 2009-07-09 12:39 · Score: 3, Insightful

You are blatnatly mistaken, sir.

Because your DNS tells you what the real IP address is, and in many locations, that is not what this "redirect" DNS service will lead you to. That may be a much nearer, but more bandwidth expensive location than Comcast wants you to use, or may not go through their monitoring and proxies and load balancers and most importantly, their _streaming video choking_ services. Comcast has established their willingness to interfere with bandwidth intensive services such as Bittorrent via SYN packats and other abuses: there's no reason to expect that they will provide this service for their customer's advantage, but rather for their own to guide traffic to their desired services.

Everything Comcast does has underlining motives by angelbunny · 2009-07-10 00:17 · Score: 2, Interesting

This new 'service' Comcast is testing helps comcast identify its customers better which helps with the 250GB cap. The new DNS setup locks out hacked modems (unregistered modems) without spoofing as a legit modem. It also limits the speed cap from the cmts (node) end as well as the cable modem so no more uncapped 30megabit/s down and 10megabit/s up on a single modem without cloning a developer na modem.

The real conversation should not be about openDNS but how comcast is going out of its way to make sure it can identify which users are breaking the 250GB cap which ultimately forces many of the not so legit comcast users who like their anonymity to spoof as someone else on the same network and therefor ultimately putting blame on the wrong person when comcast issues an abuse suspend. It is ironic really.

It may sound like a completely separate subject but by comcast playing with its dns forwarding has much bigger back end changes that seem not related but in fact are.

Slashdot Mirror

Comcast DNS Redirection Launched In Trial Markets

78 of 362 comments (clear)