Slashdot Mirror
Comcast DNSSEC Goes Live
An anonymous reader writes "In a blog post, Comcast's Jason Livingood has announced that Comcast has signed all of its (5000+) domains in addition to having all of its customers using DNSSEC-validating resolvers. He adds, 'Now that nearly 20 million households in the U.S. are able to use DNSSEC, we feel it is an important time to urge major domain owners, especially commerce and banking-related sites, to begin signing their domain names.'"
Nice, one can get to their absurd caps that much faster. Get rid of the caps and perhaps there might be something worth talking about.
DNSSEC is fine by itself, but it is only a distraction as implemented by Comcast.
Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
There won't be much point to this if SOPA / PIPA passes, requires DNS redirects, and bans circumvention.
Yes, and for our next trick, we're going to disable end-users' ability to do their own DNS lookups to only our servers -or- selectively deny DNS lookups that have a destination outside the United States. You know... to stop people from getting around SOPA and other anti-piracy measures. YAY DNSSEC! /sarcasm.
#fuckbeta #iamslashdot #dicemustdie
If I go to a website that has DNSSEC, how do I know? I just went to www.comcast.com, and there is no indication or message that DNSSEC is active.
I guess I'm not sure how SOPA and DNSSEC overlap, could someone explain it in a couple of sentences? Does DNSSEC hinder or help? I would assume hinder SOPA... I'm going to research more, but was hoping to get a quick brief from someone knowledged...
Given that Comcast has been more proactive about implementing DNSSEC than all the other major ISPs, I was very surprised to learn that they support SOPA, which will make it impossible to for ISPs to implement DNSSEC. I assume that their stance is motivated by the fact that they own half of NBC, and I wonder how their engineering staff plans on handling this situation if the bill is passed.
Just in time for...that SOPA bill to break it? The same SOPA that Comcast supports?
I'm confused now. Why are they implementing a system that will break once the laws they support get passed?
I have a dozen domains on my own server. If I would like to use DNSSEC, is there a good practical how-to guide on what I would have to do to my bind configuration?
And would I need to buy a certificate? Currently I just use my own CA and certificates for encryption of my mail traffic and a few private web pages. I really don't want to give money to some anonymous foreign company so that they can "certify" who I am. After all, I should know who I am better than they would.
In the case of registries outside of US jurisdiction, SOPA requires all ISPs within the US to filter domain name requests for allegedly infringing sites, when ordered by the US Attorney General.
"If"
Those who advocate genocide deserve every protection afforded by law, and none afforded by common human decency.
With the size of comacst and how it's tech is setup people in one area do not know what the other is doing.
Being build on lot's systems that became comcast by buying up other systems does not help them stay on the same page.
Some times the call center has a had time to tell the techs / installs basic stuff like need a cable card for the job.
I think for those that mentioned that it would be illegal or ISP would block you from using a non approved DNS could be realistic. The FCC/US government has done something similar in the recent past. The 860Mhz alalog cellular region comes to mind. Cellular companies were using unencrypted clear unaltered audio over this frequency range. People with police scanners or a a tv with an analog UHF tuner could pick up all phone conversations in the clear. The phone companies fucked up and asked the government to step in and help so they could ease public concern and still sell phones without using readily available technology to encode the audio. The FCC did step in, they made it illegal for someone to listen in, then they banned the sale of scanners that could tune to this region, then they banned the "easy" bypassing of the ban and the act of reprogramming the scanner to get these signals. They even tried other measures for those that had scanner that could recieve images of those frequencies. It was a cat and mouse game. All to prop up the phone companies profits and to prevent them from paying for their shortsightedness. I'm sure the IP lobbyists are a much greater force now and could get something like banning "rogue" DNS servers passed into a law.
If you're so gung ho about OpenDNS you might like their DNSCrypt. It basically tunnels DNS through an encrypted tunnel direct to OpenDNS. It's not DNSSEC. But if you trust OpenDNS to not be evil or pwned it might be better since it would immediately apply to all sites, not just the few that currently implement DNSSEC.
I've just recently seen email coming to me with a "DKIM-Signature"
"DomainKeys Identified Mail (DKIM) lets an organization take responsibility for a message that is in transit."
http://www.dkim.org/
While the e-mail came from across the pond, these go through Yahoo and seems to be a part of their system.
I haven't researched it any further than that.
I like these approaches though, it avoids using the Trusted Platform Module (TPM).
http://en.wikipedia.org/wiki/Trusted_Platform_Module
They own all ALL of the cable companies in Pennsylvania, they have most if not all counties, townships bal bla, ect.. paid off by giving the township employees free phones and cable, you cannot even get any other competitor to come in to offer lower priced service.. I been bitchin about this to local politicians they just stroke themselves off and could care less (really not surprising thats about all they do).. FTC goes protects Apple, and MS, and Comcast.. This is silly... We have a reverse of communism, companies that dictate everyone..
I like Comcast's DNSSEC resolvers and movement to incorporate it on their regular name servers, and to promote DNSSEC. However, they apparently could not convince comcast.net to go along, while the blog site is in fact signed. Let's see if they fix it.
http://dnsviz.net/d/comcast.net/dnssec/
They're making legislation now to just have an ex-parte hearing and declare your citizenship void because you are "hostile" to the United States.
That would take two-thirds of both houses and three-fourths of the states because as I understand it, the Fourteenth Amendment locks in the citizenship of anyone born here.
I have felt that this is a good idea for a very long, long, long time. The thing on the Internet that tells you where to go to get to a domain name is the DNS server. Thus, the owner of the DNS server really should be the source of the certificate public keys, not some random 3rd party whose true interests lie in selling certificates more cheaply and doing just enough certification that they aren't actually deemed to be insecure.
Which means random third parties will try other methods to sell certificates. A CA might, say, fork Chrome and have it give a warning page for any certificate that isn't EV. Comodo Dragon already does this: "The security (or SSL) certificate for this website indicates that the organization operating it may not have undergone trusted third-party validation that it is a legitimate business."
Actually, what's to stop SOPA from going after verisign and telling them to change the zone info directly?
The fact that the U.S. Government lacks jurisdiction to do that to offshore registries not controlled by VeriSign or any other U.S. entity, such as the many country code TLDs used in cute domain hacks.
That's because Comcast likes to cheap out and not buy enough upstream, allowing its connection to Tata to saturate for much of the day.
I'm saying that when you share an internet connection you naturally use more.
Allow me to make an analogy: Four tickets to an all-you-can-eat buffet cost more than one.
being an unfortunate slob who lives in an area serviced by Comcast's fantastic stated speed of 16M/2M (they won't upgrade this area as it they don't consider it "financially attractive enough" tied to it being an area that is about 25% poorer than surrounding counties (and having notably poorer health care, as the feds reimburse the area about 25% less for Medicare),
I'm tied to comcast (DSL would give me 3M/768). I can say they have not even contacted some of their customers about signing their hosted domains. ;-./
unless Comcast has a way of increasing the cap by spending more money
Yes, and it's called Comcast Business Class. I've been told that you have to talk to a different division of the company to get it set up, so it might be confusing at first.