Slashdot Mirror


5 Years After Major DNS Flaw Found, Few US Companies Have Deployed Long-term Fix

alphadogg writes "Five years after the disclosure of a serious vulnerability in the Domain Name System dubbed the Kaminsky bug, only a handful of U.S. ISPs, financial institutions or e-commerce companies have deployed DNS Security Extensions (DNSSEC) to alleviate this threat. In 2008, security researcher Dan Kaminsky described a major DNS flaw that made it possible for hackers to launch cache poisoning attacks, where traffic is redirected from a legitimate website to a fake one without the website operator or end user knowing. While DNS software patches are available to help plug the Kaminsky hole, experts agree that the best long-term fix is DNSSEC, which uses digital signatures and public-key encryption to allow websites to verify their domain names and corresponding IP addresses and prevent man-in-the-middle attacks. Despite the promise of DNSSEC, the number of U.S. corporations that have deployed this added layer of security to their DNS server is minuscule."

146 of 313 comments (clear)

  1. DNSSEC is not the best long term fix by Anonymous Coward · · Score: 4, Informative

    DNSSEC is a flaw too! Once I watched a keynote from Daniel J. Bernstein at FISL pointing out all the flaws that make DNSSEC vulnerable. So he pointed to a better solution called DNSCurve: http://en.wikipedia.org/wiki/DNSCurve

    1. Re:DNSSEC is not the best long term fix by GameboyRMH · · Score: 2

      Furthermore see Moxie Marlinspike's criticisms of DNSSEC:

      http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authenticity/

      About 2/3 way down the page.

      --
      "When information is power, privacy is freedom" - Jah-Wren Ryel
    2. Re:DNSSEC is not the best long term fix by Bengie · · Score: 1

      From the sound of the wiki article, DNSCurve only secures the channel communicating to the DNS server, while DNSSEC secures channel and the actual DNS records.

      We need both secure communications and validation that the returned entries haven't been modified by the server itself.

    3. Re:DNSSEC is not the best long term fix by Anonymous Coward · · Score: 1

      He doesn't get it. People who tout SSL keys in DNSSEC are very aware of the hierarchical nature of the DNSSEC trust relations and who we would be trusting if we used DNSSEC to distribute SSL keys. The point is that we're already trusting the very same people now, in addition to the CAs, and they're not even using trustworthy DNS yet. When you get a certificate from a no-frills CA, you only need to be able to receive mail at one of a few local parts under the domain that you want the certificate for. Bam, everybody who uses SSL must also trust the DNS hierarchy not to enable an attacker to divert mail. SSL keys in DNSSEC are not less secure than what we have now, but they're much simpler, much cheaper and don't pretend to do more checking before issuing a certificate than they actually do. SSL keys would be the killer app for DNSSEC. Let the CAs do thorough verification and kick out any CA which issues or enables others to issue spoofed certificates. We can still have reasonably secure encryption for most web traffic, and by enabling anybody to switch on HTTPS without having to pay extra for a certificate, SSL keys in DNSSEC would make the web much more secure than it is today.

    4. Re:DNSSEC is not the best long term fix by Anonymous Coward · · Score: 1

      Having delved into both deeply, implementing DNSCurve in one server and partially having implemented DNSSEC elsewhere, I can give you a better comparison.

      DNSCurve secures the channel between a recursive DNS cache and upstream authoritative servers. It does not attempt to secure the client->cache channel, although there have been related proposals (modifications of the same basic guts DNSCurve had) to secure that channel as well. DNSCurve is designed for a world where you implicitly trust your cache. Either you decide your ISP or shared cache provider (e.g. OpenDNS) is trustable, or you simply run your own cache. Some people claim the DNS doesn't scale well like that, but it actually copes just fine. Having a recursive cache on every home router is not the end of the world, and makes DNSCurve a fully-secure solution that's miles better than DNSSEC.

      DNSSEC is designed around a world that assumes un-trustable, even adversarial, shared DNS caches. It assumes you can't (god knows why) run a local recursive cache or use one that you implicitly trust for other reasons. It assumes that the caches you're forced to use will actively try to screw with your DNS data. So it goes about protecting the actual data end-to-end with digital hashes of the authoritative records that can be verified (after passing through N levels of untrusted caches) all the way down at the client. However, it doesn't secure any of the channels in the general sense, it's design is extraordinarily complex, and it has repeatedly caused security problems of its own (e.g. amplification attacks, denial of service, hash flaws, and new pathways to remotely list the hostnames within a domain via DNSSEC probing). The key management is pretty arcane too, and was clearly set up to make certain DNS companies a lot of money hosting DNSSEC for others because nobody else would want to deal with that crap.

      The world as DJB tried to paint it, with DNSCurve and local/trusted caches, is a far better one. The modifications to the DNS were much simpler in nature, it was far easier to implement, and far less prone to introducing new security problems. The only real pragmatic hangup that prevented widespread adoption (well, aside from the "professional" long-term BIND/DNSOPS/Verisign/etc community hating him for constantly pointing out their silliness) was that his public-key sharing mechanism was to essentially name your nameservers after your public key. So for example, if I went to the .com registrar and wanted to register example.com and use DNSCurve on example.com's nameservers, I had to use a base64-encoded public key as a hostname, and it was a long one. Instead of registering "ns1.example.com" upstream, you had to register "aoiejf0a4uaoisrjao84o8halsidjfalkejfoq48falsierfjalskef.example.com" as a nameserver hostname (or whatever, imagine that random crap was a long base64 string).

      Some others worked on a modified DNSCurve proposal which dropped the ugly nameserver names in place of stealing DNSSEC's DS or KEY records (and just using them in isolation at the registrar as a registered DNSCurve public key), but that also gained no traction. Really, that variant could've won the day, and should have, if it weren't for bickering and politics.

    5. Re:DNSSEC is not the best long term fix by marka63 · · Score: 2

      Slides from a Bernstein talk
      A quote:

      Summary so far:
      DNSSEC does nothing to improve DNS availability.

      Neither does DNSCurve.

      DNSSEC allows astonishing levels of DDoS amplification, damaging Internet availability.

      Which is not a problem of DNSSEC per say but a basic problem of DNS. It is also solvable. It just requires will to deploy the solutions.

      DNSSEC does nothing to improve DNS privacy.

      This was a explicit non goal of DNSSEC.

      DNSSEC, even with NSEC3, leaks private DNS data.

      No more than DNS leaks private data.

    6. Re:DNSSEC is not the best long term fix by marka63 · · Score: 1

      DNSSEC was designed around real world constraints, not the mythical world where every resolver can talk to authoritative servers directly or only through trusted recursive servers. Yes, there are ISP that force you to use their name servers.

      DNSSEC is designed to cope with untrusted authoritative servers. Most people don't have the resources to provide the servers necessary for fault tolerance. With DNSCurve you have to trust those operators to not change the data as any change they make can go undetected. With DNSSEC the worst they can do is reduce the effective number of name servers for the zone.

      As for OpenDNS you still have to establish a trusted path to them.

  2. Sweden Innovates by ptudor · · Score: 4, Informative
    So, there's OpenDNSSEC to automate deployments; I strongly suggest spending the time to watch the .SE NIC's nine-part training videos from 2010 at Youtube to improve one's understanding: http://www.youtube.com/watch?v=zl3gdM5tDTo

    Some respected members of our community dismiss DNSSEC. This video of DJB presents an opinion: DJB at 27C3

    1. Re:Sweden Innovates by Eunuchswear · · Score: 1

      videos? Does noone know how to rite anymore?

      Aargh - the next fucker is telling me to look at some flash shit!

      --
      Watch this Heartland Institute video
    2. Re:Sweden Innovates by kwark · · Score: 1

      If you just kept reading instead of getting distracted by flash, you'd have seen the next link point to human readable text explaining (briefly) how dnssec works and how to implement it for a specific named. I just have to hope you read past flash this time.

    3. Re:Sweden Innovates by drinkypoo · · Score: 1

      If I need to watch a nine-part training video to understand DNS, then someone has fucked up DNS. That is bullshit.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  3. Re:How custom hosts files help vs. DNS flaws... ap by dickplaus · · Score: 2

    I only scanned this, but I'm supposed to turn off my computer and no longer use the interwebs is what I gathered?

  4. Re:How custom hosts files help vs. DNS flaws... ap by Sheetrock · · Score: 2

    Nah, just edit once and have the other 4999 machines fetch through Gnutella with a batch file. It's not like this isn't a solved problem.

    --

    Try not. Do or do not, there is no try.
    -- Dr. Spock, stardate 2822-3.




  5. Basic rule of computer security by dkleinsc · · Score: 2

    Many potentially targeted organizations will not spend the time and money to make the necessary changes without prodding. I've seen this in payment security too: A lot of companies are shocked and dismayed when they find out that they are supposed to store credit card numbers in some way other than in plaintext in a database accessible to anyone with the single database login that everyone in the company has.

    The only thing that will prod them is experiencing a cost of doing nothing that is higher than the cost of implementing the solution.

    --
    I am officially gone from /. Long live http://www.soylentnews.com/
  6. I deployed it at our ISP recursive servers by whois · · Score: 4, Interesting

    It broke access to several DNSSEC enabled websites that were misconfigured. After a few months of support problems where we suggested the websites fix their issues and they ignored it, it was requested by management that we turn it off.

    It's a very bad design as it stands now. It's unable to return any error but NX Domain for DNSSEC errors for reasons of backword compatibility, which is stupid since you need a DNSSEC enabled resolver to make the request.

    It also has an incredibly steep learning curve that even experienced public key administrators face problems with.

    1. Re:I deployed it at our ISP recursive servers by bbelt16ag · · Score: 1

      sounds like job security..

      --
      NEVER NEVER NEVER NEVER NEVER NEVER NEVER NEVER GIVE UP! "No limitations, no boundaries, there is no reason for them."
    2. Re:I deployed it at our ISP recursive servers by anom · · Score: 1

      This. I recently set up a new name server and had to disable it for similar reasons.

    3. Re:I deployed it at our ISP recursive servers by nullchar · · Score: 1

      Would either the parent or GP like to list some sites that were broken with DNSSEC? There are some decent tools to test DNSSEC queries, so I'm surprised the DNS admins for the broken zones have left it broken. There's not really any half-assed zone signing with DNSSEC, you either sign the entire zone or you don't.

    4. Re:I deployed it at our ISP recursive servers by gweihir · · Score: 1

      And there is the little problem that in the long run, its certificate system is just as broken as the SSL cert system is now. My guess is it is not worth the effort at all.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    5. Re:I deployed it at our ISP recursive servers by Anonymous Coward · · Score: 1

      Except the largest cable ISP in the US, Comcast, has DNSSEC resolvers enabled for customers by default, and they manage to deal with these problems.

      They even track and publish informaiton of (large) failing domains and in the backend work with website owners to notify them of the deficiancies. As a Comcast customer, I notify the Comcast DNS folks whenever I have DNSSEC problems, as they have a large amount of clout and will use it to notify website owners.

      More large ISPs need to get on board - when we have critical global mass with the majority of the large ISPs enabling DNSSEC, DNS operators will fix their problems - or better yet monitor and proactively update their signatures, keys, etc. This is much like they do with SSL certs.

    6. Re:I deployed it at our ISP recursive servers by kwark · · Score: 1

      "its certificate system is just as broken as the SSL cert system is now"

      Can you explain this? DNSSEC hasn't got much common with the SSL cert system. There is only 1 root authority, the weak point during a key change. Each domain/tld has their own (multiple) keys. tld and domains should regenerate the short Zone Signing Keys fairly often (a couple of weeks), while the bigger Key Signing Keys should be regenerated about once in a year. If a tld is compromised it only has to create a new KSK, individual domains aren't affected (IIRC). If an individual nameserver or domain is affected only that server of domain needs to regenerate a KSK.

    7. Re:I deployed it at our ISP recursive servers by whois · · Score: 1

      We beat Comcast to the punch by about a year. I'm happy that they turned it on and can afford to support it, but 90% of the customers you have are dumb and don't care why it doesn't work from your ISP, they just care that it works at Starbucks and doesn't work at their house.

      Being a huge monopoly has an advantage when it comes to telling customers to pack it up when they have DNS issues. I too am a comcast customer and I run my own resolver (for flexibility, not because they implemented DNSSEC)

      All the domains that didn't work at the time were government sites. Usually obscure subdomains that only individual customers needed access to, so hounding random government agency to fix their problems didn't really help the rest of your customers. Also, contact with random government agency admin, which isn't easy to begin with, might be impossible if their admin contact has an MX within the broken DNSSEC domain (or we're forced to use non-DNSSEC enabled resolvers for our own email servers to contact them)

    8. Re:I deployed it at our ISP recursive servers by gweihir · · Score: 1

      Too many people in there. Somebody will either mess up or be corrupt. A PKI only works in practice if there is a single CA or a very small number of CAs under tight control. Ignoring the non-technological angle is just incompetent.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    9. Re:I deployed it at our ISP recursive servers by kwark · · Score: 1

      But there are no CAs in DNSSEC. There are only public/private keypairs under control of the owner of the domain.
      www.example.com. has 3 pairs/signatures to check:

      • .
      • com.
      • example.com.

      example.com. tells the com. authority what it's public KSK is.
      com. tells the root zone what it's public KSK is.
      The public KSK of the root is known by all people/software that want to check dnssec signatures (the weak point since how do you securely distribute and update that one?).

    10. Re:I deployed it at our ISP recursive servers by idontgno · · Score: 1

      Well, if your assertion is that "people are a problem", you're not the first to make that observation..

      It's a little-considered fact that 100% of insider crime is committed by insiders.

      Short of extincting the human race, I don't see a good solution. Maybe we should not fixate on the insolubles?

      --
      Welcome to the Panopticon. Used to be a prison, now it's your home.
    11. Re:I deployed it at our ISP recursive servers by KiloByte · · Score: 1

      It also has an incredibly steep learning curve that even experienced public key administrators face problems with.

      There's a way to do it in the name server itself, but here's a way for newbies:

      1. in named.conf.local, change file "example.org.zone"; to file "example.org.zone.signed";
      2. where you would do rndc reload example.org after a change, you instead do zonesigner --usensec3 -zone example.org. example.org && rndc reload example.org
      3. read the key-signing key zonesigner created, log in to your registrar, add a DS record by pasting data from that file
      4. if you want the keys to expire (zonesigner's default), set up a cronjob to re-sign the zone. This can be automated with rollerd, but cron is something everyone already knows.

      That's all. I don't think someone not able to follow these steps should muck with DNS records.
      (Yes, there are nicer ways, but this one is simplest.)

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    12. Re:I deployed it at our ISP recursive servers by dkf · · Score: 1

      The public KSK of the root is known by all people/software that want to check dnssec signatures (the weak point since how do you securely distribute and update that one?).

      The usual way with PKI is to have two identities involved in the root. One, the master, has a public key very widely known and with a very long life, and only ever used to validate the "operational key"; the master private key is kept offline in a safe somewhere. Perhaps with armed guards or something like that. The operational key is what is used to validate child domains, and as such is in use a lot more and so is more exposed. On the other hand, you can generate new ones (with only the hassle of the armed guards) without needing to update all the consumers of the keys; operationally, that's entirely practical.

      I have no idea if DNSSEC is set up to work this way. It's quite possible that it isn't, with clients assuming that the identity of the agent authorizing the root zone is its own lonesome thing.

      --
      "Little does he know, but there is no 'I' in 'Idiot'!"
    13. Re:I deployed it at our ISP recursive servers by gweihir · · Score: 1

      And that makes com a CA. Or how do you think the signature of com gets onto the public key of example.com? Magic?

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    14. Re:I deployed it at our ISP recursive servers by gweihir · · Score: 1

      Indeed. The problem I see with things like DNSSEC is that it implies trustworthiness that may well not be there, hence I understand why people are not bothering with it. (Aside from it being another protocol monster form a really clueless tram...) It is also generally not needed for things like remote access, just use 2-sided authentication.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    15. Re:I deployed it at our ISP recursive servers by kwark · · Score: 1

      "Or how do you think the signature of com gets onto the public key of example.com? Magic?"

      It doesn't. And you are confusing a web of trust with CA, it's like PGP. com. can only tell a dnssec user what it thinks the public KSK of example.com. is. That should have been communicated in a secure way to com. It is oneway trust between direct parent-child relations in the dns tree.

  7. Dutch solution by CAPSLOCK2000 · · Score: 2

    SIDN (the maintainer of .nl) offers a small discount to domains that use DNSSEC. This was sufficient motivation for a few large hosting companies to enable DNSSEC across all their domains. In just a few days a fifth of all Dutch domains switched over. By now 26% of the .nl domains (1.381.790 out of 5.153.408) use DNSSEC.

  8. And do you know why it's not widely deployed? by grasshoppa · · Score: 1

    Because the standards are a pain in the ass and most implementations are needlessly complex.

    --
    Mod me down with all of your hatred and your journey towards the dark side will be complete!
    1. Re:And do you know why it's not widely deployed? by bbelt16ag · · Score: 1

      then fix it! whats your excuse now? and if you can't then complain to the ones who can.

      --
      NEVER NEVER NEVER NEVER NEVER NEVER NEVER NEVER GIVE UP! "No limitations, no boundaries, there is no reason for them."
    2. Re:And do you know why it's not widely deployed? by grasshoppa · · Score: 3, Insightful

      Wrong actually. Security works best when it's simple. Make it too complex, or needlessly complex, and you open yourself up for implementation flaws.

      Security implementation should only be as complex as needed. Added complexity only serves to compromise the security you are trying to achieve in the first place.

      --
      Mod me down with all of your hatred and your journey towards the dark side will be complete!
    3. Re:And do you know why it's not widely deployed? by nullchar · · Score: 2

      Agreed. Implementing DNSSEC is a royal pain in the ass for the authoritative server operator. If it was easy, many would have done it.

      Additionally, your domain registrar must support DNSSEC to list the digest records or even public keys with the registry so they can be listed in the TLD-root zone. Once you sign a domain, you cannot transfer the domain to a non-DNSSEC-implementing registrar.

    4. Re:And do you know why it's not widely deployed? by gweihir · · Score: 1

      Indeed. Security is even more dependent on simplicity and clarity than reliability is. Today, we have not even really mastered software reliability and then some people think a complex security mechanism is a good idea? Talk about really not getting it.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    5. Re:And do you know why it's not widely deployed? by nullchar · · Score: 1

      Of course you can always un-sign your zone. But the idea is that we all should sign our zones to prevent cache poisoning or MITM DNS responses or ISP filtering/wildcarding, etc.

      Just like most mail server admins have enabled SPF via simple TXT records, only a few of those have implemented DKIM which requires signing each outbound email.

      I do appreciate the beauty of a crazy chaotic and somewhat democratic process to create new standards (IETF/RFC) and implement them laissez-faire style on an as-needed basis.

      If cache poisoning or abusive DNS filtering/hijacking was happening on a regular basis and reported widely in the [tech] media, DNSSEC would be implemented rapidly. There's just not enough threat to cover the pain of zone signing. Also, we have to trust the root server operators to never lose their keys...

    6. Re:And do you know why it's not widely deployed? by nullchar · · Score: 1

      What? When you transfer a domain, you usually KEEP the existing nameservers. It's often not wise to use DNS provided by your registrar -- because then when transferring the domain, you need to pre-copy the zone to a new DNS provider.

      Yes, you can move the DNS zone from a set of nameservers to another set of authoritative servers, and reducing TTLs for the SOA and NS records are advisable before making that change. However, the registry operators almost always set 48 hour TTLs on the set of authoritative nameservers, and that cannot be changed. Thus, you need the zone active on BOTH sets of nameservers for at least 48 hours.

      There is no poisoning of any cache when either transferring a domain or moving the DNS zone to another provider. Various resolver caches may have different values for the SOA and NS records, but those caches are still correct and not poisoned by a 3rd party.

  9. Re:Dutch Innovate by kwark · · Score: 2

    Why choose this instead of powerdnssec? I strongly suggest the dnssec training at http://www.dnsseccourse.nl/en/player.html (flash) to improve one's understanding of the dnssec protocol. And powerdns to implement it http://doc.powerdns.com/powerdnssec-auth.html

    BTW dnssec adoption is amongst the highest for .nl in absolute numbers of domains, simply because there is a bounty for every domain signed. If you have a few hundred of domains the costs to implement are lower than the discount given till mid 2014 == profit for implementing dnssec. And since powerdns does all the hard work automatically and dynamically in a transparant way (except importing the DS key in the tld)

  10. Re:Dutch Innovate by ptudor · · Score: 1

    Why choose one over the other? I don't care :) So far people have chosen neither.

  11. DNS is not a security mechanism... by gweihir · · Score: 3, Insightful

    If your security depends on DNS working, you are screwed anyways. That is likely the main reason nobody uses DNSSEC: It does solve the wrong problem.

    1. The sane way for remote access it is to require 2-sided authentication on connection, making DNSSEC entirely redundant.
    2. For the open web, things are a bit differently, but there you can land on a malicious page any time and the only solution for that is a not vulnerable browser or a secure browsing environment.

    There is also the small issue that DNSSEC is badly borked and a nightmare to install and maintain. In addition, the other PKI (SSL certs) is badly broken, and there is really no reason the DNSSEC PKI would fare any better if widely deployed. In the long run, it is very likely that DNSSEC is just a waste of time and effort.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    1. Re:DNS is not a security mechanism... by jd · · Score: 1

      2-sided authentication was mandated in the early IPv6 specs by the IPSec mechanism. Sun offered an alternative, SKIP.

      Since then, both have been ported to IPv4.

      IPSec is occasionally used by VPN clients, but that's about it. Most VPN clients are run on laptops or other portable devices, often over a wireless link. This is where Sun SKIP was stronger than IPSec, which is ideal for a wired network but gets noisy when you've links that aren't guaranteed stable and error-free.

      Regardless, neither is used for meaningful network-to-network or host-to-host 2-sided authentication on the wired Internet.

      As for solving the wrong problem, again with IPv6, I'll point to the UK's solution which is to use carrier NAT. Which breaks just about everything. (Which is frustrating a hell. I was one of the pioneers on IPv6 in the UK, and indeed had the first registered node on the 6Bone At that time, the most recent Linux kernel was 2.0.20 and you had to use a special patchset to get the IPv6 support.)

      What this boils down to is that there is no desire AT ALL in industry to use correct solutions, good solutions or even workable hacks. The industry wants things that are fundamentally broken to stay broken because repairs hurt profits and profits are god to them. (Which is clearly irrational, Linus made it quite clear HE was God.)

      In a pure or semi-pure market economy, profitable defects are superior to costly integrity. The market is incapable of addressing this because the market isn't designed to consider intangibles like security, reliability, robustness, etc. It's designed to keep shareholders and directors happy and stuff the plebs actually using the products.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    2. Re:DNS is not a security mechanism... by gweihir · · Score: 1

      And this is relevant how? IPsec is known to be another protocol monster by clueless designers. How IPsec ever passes the IETF process is a mystery to me. Numerous people must have messes up simultaneously.

      TLS (as in OpenVPN, for example) and SSH for UNIX provides a much better basis for 2-sided authentication, and both are in widespread use.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    3. Re:DNS is not a security mechanism... by dmelomed · · Score: 1

      The problem with IPv6 adoption is its design, not politics. It was designed as a replacement instead of IPv4 backward-compatible extension. An administrator and end-users have to go through hoops to make this garbage work, and that's why nobody wants to. Why should/would they? IPv6 should have been designed such that neither administrators, nor end-users would have to do much to upgrade.

    4. Re:DNS is not a security mechanism... by jd · · Score: 1

      TLS vulnerability on Slashdot frontpage today.

      SSH is of dubious value as it encrypts only select channels, whereas the remaining channels may contain sufficient information to pose a significant vulnerability.

      Give me something that WORKS, for Pete's sake, and not this backyard crap.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    5. Re:DNS is not a security mechanism... by jd · · Score: 1

      IPv4 is intrinsically incapable of being secured. So, if you want to design a secure IP protocol, you cannot have one that is backwards-compatible.

      IPv4 is also necessarily fragmented - there is no correlation between IP address and location within the network, leading to bloat in router tables, inefficient routing decisions, excessive latency and greater vulnerability to MitM attacks via router poisoning.

      IPv4 requires manual configuration, whereas IPv6 is autoconfigurable by design.

      IPv4 has support for IP Mobility and Network Mobility, via kludgy message forwarders, whereas IPv6 can support these using transitional IP addresses and backbone redirects.

      IPv6 does indeed require very little to upgrade.

      This is the sum total of what users actually need to do: NOTHING.

      This is the sum total of what network administrators need to do: Activate autoconfigure on the router and have dynamic DNS pick up allocations from there.

      That's it. That is all. NOTHING MORE.

      By doing NOTHING more than the above, you would be able to pick up a laptop and migrate from wireless access point to wireless access point seamlessly - any changes in IP address and routing would be handled for you. Yes, that means you could move from the library to a cafe to your home without dropping a single packet and all connections remaining intact.

      You demonstrate the real reason IPv6 isn't mainstream at this point - you've bought into the ignorant naysayers' arguments and know nothing about what IPv6 does, how to use it, or what it offers.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    6. Re:DNS is not a security mechanism... by dmelomed · · Score: 1

      "You demonstrate the real reason IPv6 isn't mainstream at this point - you've bought into the ignorant naysayers' arguments and know nothing about what IPv6 does, how to use it, or what it offers."

      Right, by doing nothing!

      What's there to buy into? The problems with IPv6 and its lack of adoption are widely discussed on mailing lists (it's got many warts, the need for 'AAAA' records, needless complexity, etc., etc., and even people who write firewall code and run ISPs for a living will tell you they'd rather run carrier grade NAT. If it is automatic and easy, why haven't we switched yet when so many SOHO routers still have trouble with IPv4!? By doing nothing??

  12. Re:Smart companies have you logout @ day's end by DroolTwist · · Score: 1

    Especially under system32/drivers. Don't look there!

  13. Re:Dutch Innovate by kwark · · Score: 1

    Nobody is using them? 1/5 of the .nl domains are registered DNSSEC domains:
    http://xs.powerdns.com/dnssec-nl-graph/

  14. Re:How custom hosts files help vs. DNS flaws... ap by ilikejam · · Score: 1

    APK - what's to stop someone poisoning one of the source hosts files you use to generate yours? Like, for example, adding an entry for google.com which points to a drive-by infection site?

    --
    C-x C-s C-x k
  15. Re:Dutch Innovate by mooingyak · · Score: 1

    If you have a few hundred of domains the costs to implement are lower than the discount given till mid 2014 == profit for implementing dnssec

    I'm assuming there's some kind of catch in there so that it's not worthwhile for someone to register a few thousand new domains and then implement DNSSEC on them.

    --
    William of Ockham had no beard. The most likely explanation is that it was chewed off by squirrels every morning.
  16. "Major flaw" is a tricky term by jbmartin6 · · Score: 1

    How "major" is the flaw when there are few reports of it being used in attacks? People will change their behavior when there is a real reason to do so. Until there is an upswing in DNS cache poisoning, most will see no reason to go to the expense of converting. As another poster pointed out, there are plenty of other techniques attackers are using to impersonate websites.

    --
    This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    1. Re:"Major flaw" is a tricky term by jd · · Score: 1

      There are few reports of people flying planes into office blocks. People changed behavior, not because there was a reason, but because it was highly visible.

      There are many reports of drunk driving fatalities every day. (More die in road accidents per day than have died in terrorist attacks in the past decade.) Nobody changes their behavior because these deaths are NOT highly visible.

      People don't give a shit about risk assessment (and aren't capable of it anyway), people only care about the emotional, visible things in life.

      This is why cybersecurity will never get implemented sensibly - nobody bar the most hardcore geek gets emotionally attached to the functioning of a device, and visibility is near-zero.

      Corporations lose billions each year due to computer fraud. How often do you see such attacks in the news? How many of those attacks were caused by DNS poisoning? (My guess is that nobody knows the figure because most companies who admit being attacked don't say how, and most companies attacked don't admit to having been broken into. No data, so nothing to base any figures on.)

      We have to assume that as long as computer fraud is taking place with no indication of how it is taking place that all open vectors are suspect. Some are more likely than others, so you should definitely be closing high priority ones in the absence of information, but closing very low maintenance vectors early is also a good idea - those will be things most often forgotten about and/or assumed to have already been dealt with. Putting the DNS fix in before you forget to is wiser than forgetting to ever put the fix in at all.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    2. Re:"Major flaw" is a tricky term by jbmartin6 · · Score: 1

      When I say 'reports' I refer to the data on successful attacks, not necessarily 'news'. Despite your assertion, there are several sources of such data. And you'll have to provide a citation regarding how much fraud is taking place with no indication of how. According to some of the other posters here. moving to DNSSEC is not 'very low cost maintenance', so doing it when the apparent threat is very close to zero is in most cases going to be judged a waste of time.
      Regardless, my intended point could be phrased like this: people will make the change when they perceive a reason to do so. And right now there doesn't appear to be a reason. The simple fact of a vulnerability isn't a reason, we will accept it just like all the other vulnerabilities we live with every day.

      --
      This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    3. Re:"Major flaw" is a tricky term by jd · · Score: 1

      Most of the vulnerabilities we live with are stupid and are only there because humans are incapable of assessing risk. (Those times I refer to myself as an elf, it is because I completely disavow any association with such monstrous stupidity and there are no existent homo sapien subspecies recognized that I could otherwise label myself as. As it is, I am debating whether to lobby the scientific establishment on nomenclature because there's bugger all evidence of any wisdom amongst the humans I've encountered.)

      You understand that the US and British Government have lost both civilian and military laptops, unencrypted, not because enabling encryption would have been hard but because the bloody plebs in said establishments were too bloody lazy! They did not comprehend that risk existed, assuming that a computer that wasn't online was guaranteed safe. That each and every e-commerce site that puts a database of credit card details plus names and addresses on the SAME BLOODY MACHINE as the web server is not doing so because typing in "192.168.0.2" is so much harder than "127.0.0.1", but because e-commerce companies have a god complex and thus risk is what other people face.

      "According to some of the other posters...." Sorry, Anecdotal Evidence is not acceptable. Please re-watch Dilbert and try again. I have never had a problem implementing DNSSEC, it took me about 45 minutes to get IPv6 up and running the first time in 1996 (including time to compile kernel, establish tunnels, configure the router, register with the 6Bone, etc) and about 45 seconds to get IPv6 up and running the other day (99.9% of everything has already been done). I absolutely refuse to accept such wimpy excuses, especially in a tech/geek forum. If the CEOs want to go play with their Barby dolls, that's fine, but I don't accept whining from those who should know better.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    4. Re:"Major flaw" is a tricky term by jbmartin6 · · Score: 1

      humans are incapable of assessing risk

      Well that's not true. Humans assess risk all the time. For example, I drove today even though I know there is a chance I could get in a fatal accident. Just because the assessment of others doesn't agree with your assessment doesn't mean they are stupid or wrong.

      --
      This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
    5. Re:"Major flaw" is a tricky term by jd · · Score: 1

      First, look up the research and don't base your arguments on Anecdotal Evidence (even your own). The peer-reviewed research says they are stupid and wrong, therefore they are stupid and wrong until there is sufficient evidence to reject that hypothesis. Given your use of Anecdotal Evidence, it is clear that such a rejection may take a while.

      Second, I am old enough to be tired of the utter ignorance of the world around me. I've been deep into science for longer than most Slashdotters have been alive. Hell, I've been on Slashdot longer than most Slashdotters have been alive. But not once has that science been particularly difficult or challenging. I've seen more challenging recipes for marshmallow candy. There is simply no reason for anyone to be ignorant. It isn't justifiable on the grounds of difficulty of material (much of which boils down to 1+1=2, when you get right down to it), or difficulty of access (the interwebs aren't just for lolcats, although I'm beginning to think lolcat caption writers put more effort into their work than most Slashdotters). If there's no rational justification for ignorance, then there is only one option left - you're all either mad or stupid.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
  17. Not a criticism of DNSSEC by pavon · · Score: 1

    That isn't a criticism of DNSSEC. That is a criticism of using DNSSEC for things other than DNS resolution. Domain names and IP addresses have to be allocated in a centrally managed fashion, so to avoid conflicts. DNS already has a hierarchical design by nature and DNSSEC simply makes it more secure.

    SSL key distribution/validation on the other hand doesn't have to be centrally managed, so adopting a hierarchical control structure like DNSSEC for that task is a suboptimal solution. In fact the problems in the CA system we currently have directly stem from such a hierarchical trust scheme. We would be much better of going with a truly distributed system for SSL key validation.

    But that doesn't mean that using DNSSEC for domain name queries is a bad idea.

    1. Re:Not a criticism of DNSSEC by dkf · · Score: 1

      In fact the problems in the CA system we currently have directly stem from such a hierarchical trust scheme. We would be much better of going with a truly distributed system for SSL key validation.

      I'm unconvinced. (I'm particularly unconvinced by the handwave-assert-jedi-mind-trick style of argument there, but that's by-the-by.) The fundamental problem is that it is very hard to work out if the assertions in a public certificate are true; all you can tell is that the information was digitally signed by someone or something. With a web of trust model, either you have non-transitive trust (which totally doesn't scale at all!) or you have transitive trust, in which case all it takes is for one person to get it wrong and the bad guys get in (and their first acts will be to seek to leverage their new trustedness to obscure how they got in). I suppose you could have someone acting as an authority that says who can be trusted to handle transitive links, but that's virtually back to the CA model except with plenty more technical complexity than before.

      --
      "Little does he know, but there is no 'I' in 'Idiot'!"
  18. Re:Dutch Innovate by kwark · · Score: 1

    No catch, just a discount per domain registered for dnssec (0.28 EUR/year). I have about 1k .nl domains, I spend a few days figuring out what dnssec was about, how to implement, test and maintain it. Activated it on the corporate domain, some personal and a couple of test domains and waited 2 months to see if there were problems (none). So now it is active for all domains saving us 420 EUR till the discount ends in 2014-06. For us it was not enough to cover the expense of my time, but this had to be implemented eventually, so better do it now while you still get some discount.

  19. Re:How custom hosts files help vs. DNS flaws... ap by aztracker1 · · Score: 1

    If you have that many machines to manage, then running your own DNS server with those zones setup as you would a hosts file shouldn't be an issue.

    --
    Michael J. Ryan - tracker1.info
  20. Re:Dutch Innovate by kwark · · Score: 1

    Math fail detected: 250*10^6 domains, 5*10^6 .nl, 10^6 .nl with dnssec. So atleast 0.4% of all domains are dnssec:
    5/250/5 == 0.004 * 100% == 0.4%
    .nl is in the 5 top of most used country TLDs. .nl is used for about 70% of the domains targetting the dutch market. So dnssec implementation is huge for the local market. And while it still might not be perfect, it is better than just plain DNS.

  21. Re:Dutch Innovate by ptudor · · Score: 1

    Whether it's the AC's numbers or your numbers, you're both talking about less than a percent as though it's greater than a margin of error in the real world. Export your expertise and let's all work on dotcom next.

  22. Re:Dutch Innovate by kwark · · Score: 1

    Like I said, for the local market dnssec presence is huge, and last time I checked NLD is still part of the real world and it still has some influence on it (especially considering its size).

    But .com has everything in place to do dnssec. So if an owner of a .com wants to get dnssec support, they should get a dutch dns provider, there are many that give the customer the option to activate dnssec.

  23. DNSSEC is a PITA by FuegoFuerte · · Score: 1

    And the Dans are both tools (Kaminsky and Bernstein). And to the guy who suggested hosts files with nasty scripts copying things to and fro, ummm... NO. Sounds like some of the horror stories I've heard of how things are cobbled together at a certain large Seattle-based internet retailer, and it's the kind of hair-brained idea a DevOps fan might dream up.

  24. Re:My data sources do... apk by ilikejam · · Score: 1

    Hmm. That's a lot of sources, any one of which could be compromised at any time.

    P.S. in-addr.arpa PTR records are delegated from the root nameservers just like A records - doing reverse lookups doesn't buy you much in terms of security, if you're worried about hijacked DNS.

    --
    C-x C-s C-x k
  25. Quick thoughts from a DNS implementer by MaraDNS · · Score: 1

    Really quickly:

    • DNScurve, as pointed out above, doesn't do nearly as much as DNSSEC does. In particular, DNScurve still allows "NXDOMAIN recirection" but DNSSEC doesn't. In addition, Bind, NSD, Unbound, and PowerDNS (non-recursive) have DNSSEC support, but there is not a mainstream DNS server out there with DNScurve support.
    • djbdns hasn't been updated since 2001 and even the unofficial forks do not have patches for all three CVE security holes in DjbDNS. Since DjbDNS' goal was security, I consider it abandoned until someone makes a fork fixing all of the known security problems.
    • There are ways to make blind DNS spoofing almost impossible without needing to add complex cryptography. Crypto, however, is needed when the attacker can watch the DNS packets that the victim sends.
    • I would love to implement DNSSEC for MaraDNS, but I would need $50k US to pull it off. I would like make it a kickstarter project, but I think people would rather just use Unbound/NSD (which, unlike MaraDNS, was funded with a government grant) instead of throwing money my way.
    --
    MaraDNS is an open-source DNS server.
  26. Oi by Anonymous Coward · · Score: 1

    DNSSEC has nothing to do with the Kaminsky attack.

    The Kaminsky attack took advantage of what was essentially bad randomness in DNS resolver implementations.

    DNSSEC solves the problem of DNS being plaintext (and consequently vulnerable to man-in-the-middle attacks) in the first place. If you want to call that a "vulnerability", it's one that's been around (and known) for as long as DNS; I guess ~30 years? Current internet culture requires more security so DNSSEC throws a layer of cryptography on top of traditional DNS; the same way that TLS/SSL/IPSec throw a layer of cryptography on top of TCP/UDP. Why not let TLS/SSL/IPSec solve the problem as they are used at a layer below DNS you ask? Because not everyone wants everything crypto'ed all the time (it eats up processing power), and TLS/SSL/IPSec don't solve the DNS problem in the form they are currently used.

    As far as cryptography, DNSSEC has no known flaws beyond the standard complaints against PKI based systems (and no one's agreed on a way to improve on PKI).

    As far as usability, DNSSEC has unfortunately exposed a lack of fundamental DNS/crypto knowledge amongst sysadmins. Adding to the problem is the fact that BIND/Unbound were messy to administer in the first place, but systems that automate the process have seen very steady development/improvement.

    It pains me how uninformed the currently modded comments are. It similarly pains me that this comment will likely not catch anyone's attention. It pains me the most that I bothered to write it.

  27. Re:Challenge STILL stands, unscathed... apk by Beetjebrak · · Score: 1

    Dude.. I've just read post upon post of agressive flaming here, mostly from you. Expressing yourself in such an insufferable know-it-all kind of way detracts hugely from any technical merit your software may have, which I'm not disputing because I haven't looked at it. I'm simply extremely distrustful of anyone who keeps repeating that they're unquestionably right on everything they say. Sounds too much like a priest I knew as a child.

    --
    Learn from the mistakes of others. There isn't enough time to make them all yourself.
  28. Re:Challenge STILL stands, unscathed... apk by gmhowell · · Score: 1

    Sounds too much like a priest I knew as a child.

    That's interesting; I'm starting to wonder if APK is explainable by an interaction with a priest HE may have had as a child.

    --
    Jesus was all right but his disciples were thick and ordinary. -John Lennon
  29. Re:Illogical off-topic ad hominem attacks by Stalks · · Score: 1

    Someone take the bold tag away from this guy, it hurts.

  30. Re:How custom hosts files help vs. DNS flaws... ap by Stalks · · Score: 1

    This fails in 2 ways ...

    1.
    Using the hosts file is incredibly inefficient. Just role a DNS server, run it on localhost if you have to, and use that instead.

    A hosts file needs 2 entries per domain. ie.
    127.0.0.1 example.com
    127.0.0.1 www.example.com

    It then needs a new entry for every single subdomain.
    127.0.0.1 ad100.example.com
    127.0.0.1 ad200.example.com
    127.0.0.1 ad300.example.com

    2.
    By setting up your malicious content to use random subdomains, like a4bacd4adef.domain.com renders any host files useless as they can't possibly list every permutation.

  31. Re:On your 2nd point? Here's where you fail... apk by Stalks · · Score: 1

    I'm sorry but you fail to counter any points. Hosts file = inefficient and random subdomains CANNOT be countered by a hosts file.

    As a spammer, I could setup a wildcard entry "* IN A " and just use simple PHP to set every image and every advert to use .domain.com. Hosts file cannot solve this. There is no argument here, this is FACT.

    Your attempt to counter the localhost DNS server point by saying that the server itself would be compromised is a joke. You demonstrate complete misunderstanding of computer logic. You give a DNSBL listing as an example and it wasn't even mentioned..... You say it could be compromised. It is LOCALHOST. At which point is the DNS server listening on localhost anymore liable to attack than a file in /etc? The file in etc is static, it can be edited, it is a known entity, its flaws are transparent.

    You have shown a complete lack of thought in your responses, your aim is to attempt to squash any rebuttle, even if it makes yourself look stupid to your peers (which is everyone else at this point). Therefore this internet discussion is pointless. You are pointless.

  32. Re:On your 2nd point? Here's where you fail... apk by Stalks · · Score: 1

    Didn't realise "plain old text" reformatted tags.

    Actual line #2:
    As a spammer, I could setup a wildcard entry "* IN A [ip]" and just use simple PHP to set every image and every advert to use [random].domain.com. Hosts file cannot solve this. There is no argument here, this is FACT.

  33. Re:On your 2nd point? Here's where you fail... apk by Stalks · · Score: 1

    your data required is LARGER, hands-down, undeniably

    hosts file at %windir%/system32/drivers/etc/hosts
    b026324c6904b2a9cb4b88d6d61c81d1.adverts.example.com 127.0.0.1
    26ab0db90d72e28ad0ba1e22ee510510.adverts.example.com 127.0.0.1
    6d7fce9fee471194aa8b5b6e47267f03.adverts.example.com 127.0.0.1
    48a24b70a0b376535542b996af517398.adverts.example.com 127.0.0.1
    1dcca23355272056f04fe8bf20edfce0.adverts.example.com 127.0.0.1
    9ae0ea9e3c9c6e1b9b6252c8395efdc1.adverts.example.com 127.0.0.1
    84bc3da1b3e33a18e8d5e1bdd7a18d7a.adverts.example.com 127.0.0.1
    c30f7472766d25af1dc80b3ffc9a58c7.adverts.example.com 127.0.0.1
    7c5aba41f53293b712fd86d08ed5b36e.adverts.example.com 127.0.0.1
    31d30eea8d0968d6458e0ad0027c9f80.adverts.example.com 127.0.0.1
    166d77ac1b46a1ec38aa35ab7e628ab5.adverts.example.com 127.0.0.1
    2737b49252e2a4c0fe4c342e92b13285.adverts.example.com 127.0.0.1
    aa6ed9e0f26a6eba784aae8267df1951.adverts.example.com 127.0.0.1
    367764329430db34be92fd14a7a770ee.adverts.example.com 127.0.0.1
    8c9eb686bf3eb5bd83d9373eadf6504b.adverts.example.com 127.0.0.1
    [...forever...]

    dns server on localhost
    $ORIGIN example.com
    * IN A 127.0.0.1

  34. Re:WTF kind of hosts entries are those? apk by Stalks · · Score: 1

    0.0.0.0 microsoft.com

    This doesn't work. I can still access the site.
    Please give me a working example of how to quickly and easily block ALL of microsoft.com in a single line.

    DNS on localhost isn't compromisable. You are the very example of FUD. http://en.wikipedia.org/wiki/Fud

  35. Re:Funny you conveniently ignore these facts... ap by Stalks · · Score: 1

    1.) MORE "moving parts" complex in services/daemons, & front-ends to them

    Yes more moving parts.

    2.) MORE complex in entries necessary (and knowledge for it)

    False. Still haven't found case to handle wildcards.

    3.) Wasteful of CPU cycles due to more parts

    Citation needed.

    4.) Wasteful of ELECTRICITY (due to extra moving parts)

    Citation needed.

    5.) Wasteful of RAM (data is larger, see that DNSBL I put out)

    Data used for configuration != Data used in RAM during use.

    6.) Wasteful of other forms of I/O too

    OS needs to re-read hosts file. DNS servers are much more efficient.

    9.) Hosts are an integrated part of the IP stack itself, running in Ring 0/RPL 0/kernelmode & merely a filter for it (which the IP stack has over 40++ yrs. of optimization & refinement put into it, as well as hardening vs. compromise)

    It reads a text file into RAM, it isn't any more secure that any other configuration file. A local dns server has the same vulnerabilities. ie. Edit "HKLM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath" registry entry, hosts file is not longer used. Protection bypassed.

    10.) I've seen DNS servers that run in far, Far, FAR SLOWER Ring 3/RPL 3/usermode as well vs. kernelmode & the IP stack as noted in point #9"

    Oh, your local text file is read faster than the DNS server 1000s of miles away? Try again with a local one.

    Hmm.

    a large HOSTS file (over 135 kb) tends to slow down the machine

    - mvps.org

  36. Re:Ms does it for THEIR sites (good reason)... apk by Stalks · · Score: 1
    Okay, there is one flaw in hosts file, they can be bypassed.

    I will now try with slashdot.org

    0.0.0.0 slashdot.org

    ...

    C:\>ping -n 1 slashdot.org
    Ping request could not find host slashdot.org. Please check the name and try again.

    Okay, it blocks it, great.

    C:\>ping -n 1 www.slashdot.org
    Pinging www.slashdot.org [216.34.181.48] with 32 bytes of data:
    Reply from 216.34.181.48: bytes=32 time=107ms TTL=245

    Oops, sorry. I remain unconvinced. I'll stick to an internal DNS server for blocking. Single point of configuration, works on ALL devices on my local network and handles wildcards.

  37. Re:The premise of this article dusts you... apk by Stalks · · Score: 1

    Okay I see you have no citations for those points, just guesswork. I accept this as you conceding the argument in my favor. That is acceptable.

    Any operating system tricks to cache data are not exclusive to just a hosts file so any points made there are moot and disregarded.

    Besides, the SPEED difference of any of these system would be unmeasurable (unless you have citations? oh you don't don't nevermind that then), its not what I am arguing. An internal DNS system (not affected by any sort of poisoning vulnerability, ie. internal, internal, internal) would be a much better suited solution to your problem because of pervious unresolved points.

    Haha, a "favourites at the top" sorted text file beats indexing, what planet are you on.

  38. Re:Addendum (important 4 security (UAC))... apk by Stalks · · Score: 1

    So read-only file flag and NTFS ACLs. Nothing special then.

    BTW I'm loving this discussion, I know you're a troll, and a good one, but its awesome to see how far people will go. Especially when you're also getting your link count up with each post :)

  39. Re:DNS servers can be bypassed (see article)... ap by Stalks · · Score: 1

    (It does so, every 500ms, & NO programs' or malware-in-general that's NOT a driver powered rootkit's going to get past that, since the timer registered with the OS is as 'fast as it gets' in usermode, period!)

    Oh, you opened yourself up for being owned now :)

    Any other process capable of writing to the hosts file is running as administrator. Therefore it kills your applications PID, and disables any service. The end.

  40. Re:Large diff. in devs like me, & techs like y by Stalks · · Score: 1

    Please don't turn this into an e-peen competition. My kids are into that sort of thing. I have been writing software for over 35 years, so lets just put that to rest, it's immature.

    Indexing vs "favourites at top" has no argument. Indexing was designed to speed up search, linear searching is the base at which indexing is compared to. Sure, for those at the top, its faster, for those at the bottom its slower, you can't predict the browsing habits of your users, so this sorting won't work. Overall, indexing is faster. If you are what you claim, then you know this.

  41. Re:Same goes for your DNS servers too (touche)... by Stalks · · Score: 1
    Yes I understand it is the same. You are now desperate enough that instead of claiming APK is superior, that you are now happy enough to say that it has the same protection as other software. The very point I was making.

    Also, you are now slipping up on some important parts..
    You just stated:

    Plus, it can't be done - Not every 1/2 ms while my app runs... no way, no how!

    but then you argued that DNS is:

    Wasteful of CPU cycles due to more parts

    I can guarentee that an idle DNS server doesn't waste time checking its database for errors every 500ms. This now puts your software way out of reach of my proposed system (dns server running on localhost) in terms of CPU usage, and as you claimed, electricity usage. Try again.

  42. Re:DNS servers can be bypassed (see article)... ap by Stalks · · Score: 1

    Please respond to the fact hosts file cannot handle wildcards as you claim they do.

  43. Re:You failed vs. my DNS inefficiency points... ap by Stalks · · Score: 1

    Whoa, your e-peen is massive! I'm not worthy! I'm not worthy!

    I also don't care. I did a TLDR from "I shit on guys like you, everyday", not worth my time.

    You're cracking at the seems with the rambling!

    Right, back to the APK crap you keep going on about. You should place a notice on the software page that it requires an SSD in order to benefit.

  44. Re:NO, not the same... apk by Stalks · · Score: 1

    Did you miss the memo? "MS Security Essentials" is no longer trusted anti-virus software in the eyes of independent AV researchers. You look silly.

    Notepad++ can edit hosts file and bypass the "MSSE protections", so um, yeah ... just, wow. Notepad++ must be awesome.

  45. Re:NO, not the same... apk by Stalks · · Score: 1

    I have to leave the internets now :( I'm glad my afternoon appointment had been cancelled so I had the chance to make you sweat.

    However at night I am a father and a husband and don't have time for these unimportant discussions.

    Good day!

  46. DDOS problem by snsh · · Score: 1

    My DNS provider was planning to deploy DNSSEC signing several years ago, but they still haven't.

    They claim the reason is that since DNSSEC responses are 75x the size of vanilla DNS responses, this makes DNSSEC providers more vulnerable to DDOS attacks.

  47. Re:It's more secure than DNS queries... apk by ilikejam · · Score: 1

    I'm not sure you understand how DNS works - the reverse entries are delegated to the IP space owners, so it's just as likely that the in-addr.arpa records are being poisoned, and so your reverse lookup check doesn't buy you much. It's better than not checking, but a well organised poisoning attack will be modifying PTR records to cover SSL full-circle checks anyway.
    In fact, you're still trusting that DNS is sound to check your hosts files are coming from the right places, and then adding further vulnerability by trusting that A Bunch Of Suppliers aren't feeding you bogus entries.
    Even if your hosts file _is_ OK, you still can't protect yourself from resolving xyz.domain.com entries, because hosts files can't use *.domain.com so you can't stop your PC from resolving rapidly changing subdomains.
    So, in terms of poisoned host records you're actually more at-risk by using a huge custom hosts file, not less. Statically defining host records to 127.0.0.1 will protect you from reaching a known attack site, but fast-flux subdomains nullify that protection in a lot of cases, and for similar reasons it offers only limited protection from the Kaminsky attack.

    --
    C-x C-s C-x k
  48. Re:How custom hosts files help vs. DNS flaws... ap by Sardaukar86 · · Score: 1

    Hahahahhaa APK, what a surprise - here you are, regurgitating the same tired old rubbish.

    Get this through your thick skull, nobody wants to read your shite about the fucking hosts file any more.

    We've seen you spew this crap over and over and over and over again, don't you think it's time to give it a rest? Face it APK, you're a fifty-year-old man-child with an obsessive pattern of behaviour and a compulsion to make an annoyance of yourself that you should have gotten under control by your age.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  49. Re:Logon scripts & my app I posted... apk by Sardaukar86 · · Score: 1

    P.S.=> Ever heard of a logon script? Migrating custom hosts to 1000's of client rigs on a LAN/WAN is cake because of logon scripts...

    ... apk

    I think people here know about logon scripts, you arrogant little snot. How do you find yourself wondering why your posts are modded down? It should be pretty obvious to even a half-wit such as yourself by now. There are plenty of intelligent people on /. who would run rings around you at a technical level so try to dial back your condescension and self-importance a bit, mmmkay?

    Now's probably a great time for one of your whiny APK 'poor me' post by now. Don't forget to put a bunch of links to the handful of worthwhile up-moderations you've managed to accumulate over the eight years you've polluted this forum with your immature man-child behaviour. Why do you bang on about this rubbish so frequently? Perhaps you're just too self-absorbed to understand that most of the world moved away from host file management years ago, and with good reason. I'd hate to be one of your clients with your one-eyed approach to network security.

    Now's probably a good time to post your list again, or even better, a list of your most recent failed arguments that you can claim as victories.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  50. Re:You're in error: %Windir%\system32\drivers\etc by Sardaukar86 · · Score: 1

    Not obsessed - I just know custom hosts are effective for added speed, security, reliability, & even anonymity to an extent is all... & yes, they work!

    (Better than competing solutions like AdBlock, Ghostery, & even DNS - which custom hosts can overcome its shortcomings supplementing them, even the secured-filtered ones I used listed in my 1st post)...

    Nice part is, because of hardcoded fav. sites of yours you can put into it for the above benefits? It "lightens the load" of DNS server requests for those that admin them too - BONUS!

    ... apk

    So, what would you call compulsive and repeated behaviour in the same manner on the same topic with the same point..? English already has a word for that, we call it obsessive. Sorry APK, but if the shoe fits..

    Secondly, who in their right mind gives a fuck about load on internal DNS servers these days? Surely your paid time is better spent on other aspects of network management?

    Oh and this would probably be the right time for you to claim one of your little man-child victories here, gotta be consistent APK. Don't forget to add it to your list, there's a good boy.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  51. Re:You call 2-3 minutes full runtime slow?... apk by Sardaukar86 · · Score: 1

    P.S.=> Mind you, that's ONLY on an Intel Core I7 920 cpu @ stock 2.67 ghz here, & a SLOW FIOS connection... put it on a faster CPU, & faster internet connection for import? Cut that time down by a HELL of a lot!

    ... apk

    Wow, you're quite the coder there, APK.

    Some have wondered where exactly all the power goes from the ongoing harvest of Moore's law's rich yield. Others may have speculated but what now seems apparent is that the additional power we gain is squandered away by chumps like APK who think 'program optimisation' means running the software with a faster CPU.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  52. Re:As usual, I am correct in my predictions... apk by Sardaukar86 · · Score: 1

    As usual, APK trumpets his own mighty awesomeness and publicly congratulates himself on his precognitive abilities yet continues to be genuinely puzzled why people can't be bothered with him.

    Yup, now's your chance to chalk this up as another victory for APK! (Might be a good time to get some of your AC sockpu^H^H^H^H^H^Hfriends to pop out of the woodwork to defend you)

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  53. Re: APK demonstrates his mental illness again by Sardaukar86 · · Score: 1

    APK, you asked for it, you got it, now you cry.

    Poor man-child, wipe away your tears! You received a polite and genuine response from someone, there's no need to roll around on the floor screaming in fury, leaving urine-stains on the carpet.

    It's hard to believe you are (by your own admission) something like fifty years old. I can't say I've met anyone over the age of about twenty who'd be as shameless as to behave the way you do, APK, you immature little sniveller.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  54. Re:WRONG again on THIS too... apk by ilikejam · · Score: 1

    1) Symantec is the only one of those sources I would even remotely trust, and I'd still be checking every single entry, even with them.
    2) You _are_ relying on "ON A WORLD FULL OF UNPATCHED DNS SERVERS", unless you only ever visit the _exact_ hostnames _specifically_ entered in your hosts file, and _only_ if those site _only_ have links and included references (javascript sources, etc) which are _exactly_ listed in your hosts file.

    Do me a favour - run wireshark on your PC, filter for port 53. See how often your host with its massive hosts file still relies on DNS. In terms of the problem the Fine Article talks about, you're no more protected than anyone else.

    --
    C-x C-s C-x k
  55. Re:Have YOU done more, better, & earlier?... a by Sardaukar86 · · Score: 1

    No, APK, I don't need to have done better personally to call you out on your stupidity. When is that going to sink into your thick, thick head? One does not need to be a chicken to know a bad egg!

    Furthermore, I note you fail to respond to my assertion. You make a bone-headed statement that shows up your myopic world-view, get yourself called on it then respond with irrelevances, lists of junk and childish name-calling. In other words, you say anything to ignore or otherwise cowardly avoid the point.

    In your arrogance you then go on to issue nonsense 'challenges' and deem anyone who doesn't want their time wasted with your drivel to have 'run from the challenge'. Real logic at work there, pal.

    As it happens, I am a hobby programmer. I enjoy writing and tweaking tight code and I wouldn't trouble myself with your jumble of source given the quality of your disjointed, rambling, barely-coherent posts. Get on to some meds, buddy, you're in orbit.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  56. Re:Sardaukar86: Reduced to illogical off topic by Sardaukar86 · · Score: 1

    Hey, APK, how long to you intend to stay asleep at the keyboard? You've got it into your pointy little head that you need to convince me about your goddamn hosts file. I don't care about your technical drivel, I have no interest in countering it or even reading it completely; you could be completely right or completely wrong and it wouldn't make any difference to me at all. You can claim you 'won' the argument because I won't engage with regard to your hosts crap but I can play that game just as easily, by demanding you read through a local phone book (or something equally irrelevant) first and claim my own 'victory'. It would be just as Phyrric a victory and just as childish as the basis for all your arguments. All you are capable of is regurgitate-and-spit-insults. If there's anything more to you than that I've not seen any evidence.

    Any real argument and you're the first to turn tail and flee, you gutless retard.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  57. Re:Sardaukar86: Reduced to illogical off topic by Sardaukar86 · · Score: 1

    Ad hominem attacks... oh the pity of it!

    It seems to be the only level you are capable of operating at, or perhaps you hypocritically missed that part where most of what you have posted is precisely that. I've noticed that reasoned arguments appear to somehow bounce off your little noggin. Nothing sinks in. It leaves precious little room for much else when people like you, APK, face even the most basic of arguments by sticking your fingers in your ears and shouting "LA LA HOSTS HOSTS LA LA" by way of rebuttal.

    You are consistent, I'll give you that - you never FAIL, to fail, vs. myself... lol!

    ... apk

    Yeah, you're one hell of a badass. You're a real Internet toughguy, I know, you say so all the time so it must be true, right?
    Did you actually have a basis to your argument after all that?

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  58. Re:Have YOU done more, better, & earlier?... a by Sardaukar86 · · Score: 1

    It now occurs to me that you didn't understand what I was saying to you in the earlier post, so let me spell it out so there's no confusion:

    I don't care what you are coding, be it hosts-related or something to do with the dead poodle in your chest freezer. It's irrelevant to me, because I've seen how you post, how you argue, how you reason and how erratic you are. That's enough to know I have no interest in anything you produce; it is valueless to me.

    Please keep detailed records of all the times other people find themselves exasperated at seeing the same tired old shite popping up from you. The same boring crap that gets posted and sometimes repeatedly posted the moment anyone mentions anything which could possibly be construed by an OCD manchild as fair game for squeezing in a mention of his own cure-all hosts file solution.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  59. Re:Why'd I have to suggest it then (it works)?... by Sardaukar86 · · Score: 1

    You're NOT one, that's certain... lol, see below!
    By the way? WHERE ARE THEY THEN?? WHY DO I HAVE TO MAKE THE SUGGESTIONS FOR THEM???

    It is another clear example of your egocentricity and arrogance that you feel you have to make the suggestions for them. Grow up, man-child and stop shouting.

    Oh and you've got some real clever reasoning going on there, pal. You obviously think that 'because no expert in networking got a post in before me (as I camped out hoping for a first post), there can't possibly be anyone with any networking knowledge on the forum!'
    Yup, that's right APK, we were all just sitting out there in our ignorance until APK the Hostfile Hero came along to lay a fat Mr. Whippy information-turd into our collective gaping mouths.

    Hoooray! Thanks goodness for our Hostfile Hero! Another 'victory' for APK the Anonymous Assclown!

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  60. Re:LMAO - you FAIL again, "ne'er-do-well" troll... by Sardaukar86 · · Score: 1

    LMAO - When I challenge you to it? You do, and you failed

    No, APK, I wasn't replying to you about your fucking hosts file rubbish and you know it. You are welcome to clumsily switch my answers around in a childish little pantomime but it just shows you up for the dishonest intellectual weakling you are.
    We were talking about code, if you recall. Surely you can't be that ill as to involuntarily conflate the two concepts in that nutty little head of yours?

    Why can't you make even a single argument that stands on its own without the need of your typical methods of relying on spam, irrelevant and delusional commentary, public self-preening and screeched insults for support? I can hold my own without any of that, why are you so damn weak?

    Ooooh, look, a bird flew overhead, that'll be another 'victory' for APK then. Ah, now a car just beeped its horn, another clear 'victory' for the mighty APK.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  61. Re:"Run, Forrest: RUN!!!" especially you vs. hosts by Sardaukar86 · · Score: 1

    Thanks for the laugh APK, I just checked out the last of your three lower links in your post. It provides a beautiful example of your technique:

    I wrote:

    Oh, what a surprise, someone mentioned the hosts file and look.. not half a day later(snip)

    APK's response:

    ".denwaps t'nevah uoy em llet esaelP >= .S.P .erif a ni ylwols eid ot *UOY* etivni *I* :reffo-retnuoc a ekam ot referp I sa noitativni ruoy tcejer I .god eiriarp elttil ylgu na ekil pu spop KPA dellac toggam sseldnim ,taf a dna retal yad a flah ton ..kool dna elif stsoh eht denoitnem enoemos ,esirprus a tahw ,hO" - by Sardaukar86 - ANOTHER 'off-topic' total "ne'er-do-well" troll on /. (850333) on Sunday July 31, @02:50AM (#36937434) Homepage "???" Uhm... Could we get a translation of that off-topic "troll-speak/trolllanguage" of yours, please?

    That's right - he reversed my words then complained he couldn't read the resulting text.

    Just gorgeous, a purer example of Straw Man in the wild than this would be a rare treat indeed.

    APK, I take my hat off, the fail is strong with you.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  62. Re:"Run, Forrest: RUN!!!" especially you vs. hosts by Sardaukar86 · · Score: 1

    How many times have YOU personally run from disproving my points on hosts

    How many times have you had it pointed out to you that I don't give a fuck about your hosts stuff, I just want you to shut the fuck up about it?
    Hosts files may be just as shiny, wonderful and stay-sharp as you say they are - I don't take any issue with that, get it? I just don't fucking care! Stop conflating that with a technical objection already, I simply don't care enough about the hosts file to argue the point! Is that so hard to understand?

    My overall point about you stands: on balance, you are not a worthwhile contributor to Slashdot. No, I don't need to be the highest-rated user here to say that. No, a list of times your jumbled dross managed to get moderated to +1 from 0 does not prove anything and certainly not without a corresponding list of down-mods.

    What about all the other inanities of yours I've responded to that you've failed to understand and replied with more lists and garbage? Did I 'run' from those too? Why, yes I did, in APK parlance. Because APK automatically 'wins' everything and won't let reality get in the way of a nice imagined victory or two.

    was your "FoaMiNg-@-TeH-MouTh"

    What the fuck is this shit supposed to be anyway? This is something I'd expect to see on a site for tweenies. Grow up, you fifty-year-old manchild.

    how effete & ineffectual you are

    Hmm, effete eh? That's a nice word from a spineless yellow-belly who can't address a simple argument, APK. Goodness knows I've offered you plenty but you've cowardly avoided them all; now you accuse me of same, hypocrite.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  63. Re:"Run, Forrest: RUN!!!" especially you vs. hosts by Sardaukar86 · · Score: 1

    You're seriously deranged. I've looked over those posts of yours and they say nothing about your worthless stinking hosts file. My comments were a response to seeing your goddamn Church of the Hostfile proselytising again and being sick of the sight of it and sick of seeing poorly-formatted rubbish from you.

    Somehow you pea-brained this into a technical complaint about your hosts file sputum. I mean, how can you misconstrue a statement as simple as this one I posted in response to yet another mindless spewing of massive, mis-formatted Hostfile horseshit with typical APK evangelical fervour:

    Oh fuck off, fuck off FUCK OFF ALREADY!!

    Nevertheless, APK managed to fuck it up again.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  64. Re:For Pete's sake enough (you're non-sequitur) by ilikejam · · Score: 1

    "...you even ADMIT I do get better security via my methods"
    Umm, I didn't. I said quite specifically that your security is likely worse than just using DNS. But hey. If that's how you choose to configure your hosts, then that's great. Good luck to you.

    I'll be out here in the badlands running with an empty hosts file, javascript switched on, frames enabled, cookies allowed, and Flash installed. Living the dream, baby.

    Peace out, much love, etc.

    --
    C-x C-s C-x k
  65. Re:It's just fact, disprove it... apk by Sardaukar86 · · Score: 1

    Did they suggest them to me? No! BOTH in logon scripts & AD level rights + abilities (to access nodes/disks/shares to copy over hosts to any LAN/WAN network node) - show me otherwise.

    What is this drivel? What has this even got to do with what I just said? What are you replying to? A question that only you heard perhaps? Re-read my post and try to understand it this time.

    There's a reason you get lots of advice to 'seek help', both here and across the various boards on the Internet. How's it feel to a global laughing-stock, man-child? Whenever I see a post from you on the net, little exchange between you and someone else is required before they (and others usually) query you as to whether you're off your meds that day.

    What's it like to be a living piece of Internet comedy? What's it like, having to lie to yourself so you won't have to face the truth?

    Just "face the music" here, & disprove my points on hosts files (which cure this problem with DNS servers no less by not having to access them the way my program allows) blah blah blah blah

    What is this drivel? Are you still convinced you can successfully defend yourself from any attack with your limp-wristed wittering about something nobody really gives a shit about?

    lol... yes, you have issues, you caused them for yourself!)

    ... apk

    Oh, I've got issues alright, but they're not too dissimilar from most people's issues. They tend toward the mundane; I have issues over being Here when I need to be There and vice versa, however like most people I mitigate these issues with conventional means. In the case of this example, I drive a vehicle to get from Here to There.

    Your issues, however - yes, the ones lots of people mention when you post on Internet forums - are a little deeper-seated than mine, I'm afraid. The fact that your responses to people questioning your mental health is so well-rehearsed tells a story all of its own. Nothing like the overwhelming anecdotal evidence of a thousand strangers observing your behaviour and calling you crazy, huh? Don't worry APK, it's going to be alright, they're wrong and you're right, shhhh, there there, it's going to be alright.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  66. Re:Did you see the topic of this article? by ilikejam · · Score: 1

    "ACTUAL STORAGE CENTRAL POINT FOR THEM"
    Again, there is _no_ central storage for in-addr.arpa. The reverse records are delegated just like the A records are. Do you honestly think the root servers hold every single PTR record on the public internet?

    You know, for someone who makes a lot of noise about hosts files and DNS, I'd expect you to at least understand how DNS works.

    --
    C-x C-s C-x k
  67. Re:You've tried it & failed it 5x or more... a by Sardaukar86 · · Score: 1

    You're too self-obsessed to understand. You ignorantly conflate my contempt for you with a criticism of the technical validity of your hostfile gibberish. So, in effect, you are setting up a straw man argument that has nothing to do with what I am attacking you for, just so you can knock it down triumphantly and claim another 'victory' for APK the Dean of Delusion.

    BOY did I 'do a job' on you... pity you can't handle what you bring on yourself!

    Can you show me even one example where you actually engaged my argument enough to 'do a job' on me? You haven't addressed any of my points, you've just barfed hostfile crap and a bunch of links to the wrong comments (I'd proof your links before posting if I were you - all your links go to your own wafflings). You like to claim this stuff but you still fail to understand over and over that you are simply cowering behind your hostfile screeds to yap at me like a small dog when the argument is something completely different.

    You're reactionary and dull-witted, lifting up your 'Hostfile manifesto' placard as a universal argument in an attempt to silence your critics, regardless of the nature of their criticism. You fail on so many levels it's quite extraordinary.

    Case in point:

    No disproving my points on hosts either! You never stay on topic either... ah, you're just an amusement to me, a diversion @ this point - one that makes ME, look GOOD too (thanks, lol).

    No, APK, I've said numerous times that I don't take issue with the technical details of your hostfile postings, because I don't read them.

    Why are you so incapable of simple reasoning? Why do you consistently attempt to re-frame the argument into something it is not? When are you going to get it that your hostfile stuff isn't the problem, YOU are?

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  68. APK fails again by Sardaukar86 · · Score: 1

    I'll post what I want, where I want, & how ever much I want - got that? Good.

    * Get over yourself

    Oh, I'm quite content with myself, thank you for asking. I believe it is you who is suffering personality issues and delusions of grandeur, not myself, as I'm not the one who gets asked to take his meds by other people on a regular basis (your feeble attempts at this notwithstanding)

    - you don't give ME, orders... & you're certainly not qualified on anything else (hence your psycho off topic stalkings of myself).

    APK

    I love your confidence in stating obvious nonsense.. unless, of course, you are fully privy to my educational and industry qualifications somehow? No? Thought not. Another APK logic fail. You're not really very good at this, are you?

    P.S.=> Now, do us all a big favor: Crawl back into the hole you came from, alright? LOL... apk

    No, APK. That would do only you a favour. I don't do favours for retards.

    Please continue to call me a troll though, when the evidence is there for all to see: I am simply responding to your cry-baby "why does everyone mod poor old APK down?" post and have used your mindless spewing of hostfile crap on other threads as an example to help you understand your own idiocy a little better. So don't call me a troll when you have brought this upon yourself, man-child.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  69. Re:Go crawl back into your hole, troll... apk by Sardaukar86 · · Score: 1

    If what you say is true, why are there no examples of people jumping up to your defence during our discussion?

    Why haven't other people told me off for giving you a hard time?

    It is because people know you are a jerk.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  70. Re:Evidence 242++:1 as the ratio against you... ap by Sardaukar86 · · Score: 1

    You're just too stupid to understand that your list is meaningless. Simply observe the general reaction of /. posters to your drivel and you'll see what I mean. Well, maybe not, on second thought. Perhaps if you weren't suffering a superiority complex that prevents you from interacting with reality, but before then, probably not.

    I'll repeat: you are too stupid to understand that your list is meaningless without a corresponding list of your down-mods. Understand? No, I didn't think so. It's very hard to get a person to understand a thing when the basis for his argument is dependent upon not understanding a thing.

    Easily utterly dusting you by letting you dust yourself, lol, & making you "EAT YOUR WORDS", flavored with "the bitter taste of SELF-DEFEAT" & YOUR FOOT IN YOUR MOUTH!

    Very colourful, keep dreaming. You are obviously deranged if you think you can 'dust' me by failing to respond to my points. No, spewing nonsense lists that have long since been debunked doesn't help your case. Only an ignorant child would claim victory in this circumstance.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  71. APK further demonstrates his lack of understanding by Sardaukar86 · · Score: 1

    The fact that you think this is 'evidence' to prove your point simply confirms mine: you have no argument and a list of up-mods (over an eight year period for goodness sake, how pathetic can you be) is all you have by way of support for your case. Your list provides evidence that most of what you say is barely worth reading, especially as fully two thirds only received a +1.

    Yet, you still think this is a 'win' for you. How them critical thinking skills, APK?

    Now, it would be relatively easy to discredit you further if I had the time to gather up every example of your repeated down-modding. I'm sure you would agree my list would be much larger than yours.

    However my argument is that such a list is quite unnecessary for most thinking people. You are a pariah here on Slashdot and everybody knows it; no amount of list-spewing from anyone will change that.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  72. Re:He asked for evidence & he got it to his di by Sardaukar86 · · Score: 1

    No, APK, the point was nobody defends YOU, or did that terribly complex distinction sail over your head as well?

    How do your words taste, since you HAD to "eat them" flavored with 'the bitter taste of SELF-DEFEAT' & YOUR FOOT IN YOUR MOUTH?

    A very colourful fantasy, for sure. I'm pretty sure you're the only one who agrees with you.
    I'm curious; where are all your AC 'friends' who always seem to be around to write in your style and back you up when you're feeling cornered? Such childishness, APK, fits neatly onto your own definition of 'reprehensible behaviour' you frequently accuse me of.

    I don't need TV comedy, I've got APK to keep me chuckling! :-)

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  73. APK claims 'victory', fails to understand AGAIN by Sardaukar86 · · Score: 1

    You can keep posting your silly list as much as you like, it proves nothing except that over the course of eight years, even a stopped clock like yourself can be right twice a day. Your list does you more harm than good, so keep posting it!

    Claim another hollow victory, man-child.

    Every time you post that shit you prove to everyone that you just don't have a clue and can't make a reasoned argument.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  74. APK's life is just one 'victory' after another! by Sardaukar86 · · Score: 1

    In other news, the Pope delivered an afternoon sermon, prompting APK to claim 'victory'.

    Later on, APK crapped his pants and claimed a 'crushing defeat' for all his enemies.

    That evening, in bed, APK cracked a fart and found himself immediately rushing to his computer to claim another 'victory' for APK and his list of upmods.

    In the morning, the birds began singing. You guessed it - this is a sure sign that APK's detractors just 'ate their words' and suffered the 'bitter taste of self-defeat', resulting in another clear 'victory' for APK and his powers of reasoning.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  75. Re:242++:1 odds against you - eat your words by Sardaukar86 · · Score: 1

    Am I correct in my understanding that you are seriously suggesting your coveted 244 up-moderations are evidence for the quality of your postings?

    If so, am I also correct in my understanding that you do not believe your myriad down-moderations over the same period count against you in the same way as the up-moderations count for you?

    If this really is the case, perhaps you can further explain the methodology you employed to reach this conclusion?

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  76. Re:You've tried it & failed it 5x or more... a by Sardaukar86 · · Score: 1

    This clearly shows otherwise, & WHY you won't, many times -> http://it.slashdot.org/comments.pl?sid=3417867&cid=42743095 [slashdot.org]

    No, it doesn't. It simply shows you attempting to defend yourself with more lists. You just don't seem to get that I don't care about your hosts rubbish. My beef is with you and your inflated self-opinion that results in you attempting to 'educate' everyone about your little pet subject at every opportunity even when you've already posted it hundreds of times.

    You are a profoundly arrogant man.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  77. APK's responds: "I know you are I said you are.." by Sardaukar86 · · Score: 1

    Please elucidate.

    What you have is a bunch of twaddle and a long-running claim of my 'failure' and your 'victory'. You don't seem to be able to address my actual arguments nor have you made any compelling points. No, posting an unbalanced and unscientific list in support of your claim is not considered a 'compelling point' by most people.

    Post another list, claim another 'victory', goto 10. This is your method of debate, visible nearly every time you end up in an argument. Weak, APK, really really weak.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  78. Re:No, it shows you EATING YOUR WORDS, lol by Sardaukar86 · · Score: 1

    It's very telling of your cognitive and reasoning abilities that you think your list provides evidence to the contrary.

    It's a pity you can't seem to understand simple concepts. Despite your vanity list (66% of which are lame +1 posts), it is clear to all that you are modded down with much greater frequency than you are modded up. I'm sorry that you don't get that.

    If through some miracle you finally managed to understand this, you'd also understand that posting your list (again) doesn't magically prove your point for you.

    Not exactly holding my breath waiting for your 'Aha!' moment.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  79. Let's have some more angry, bold, upper-case text! by Sardaukar86 · · Score: 1

    Well, see your sentiments there, outnumbered by /. posters regarding my posts as NOT being 'drivel' in the link above - you FAIL, as always & to the tune of nearly 250:1 against you!

    Statistics: you fail it.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  80. Re:You're blind then troll... apk by Sardaukar86 · · Score: 1

    Not blind, quite observant actually.

    You were not asked a question - you simply unloaded your bowels all over this thread before anyone had a chance to get a word in. You're doing the world a real favour there, jackass.

    Or, perhaps you were referring to this, a comment from someone who values your contribution about as much as I do:

    Yes, fine for a few machines... but how about 5000? You really want to make 5000 hosts file entries every time you want to lock down a domain name? idk, running your own DNS server, and locking that down, sounds shittons easier.

    Let me clue you in: this is a literary technique known as rhetoric. You demonstrate your conceit, pathetic over-eagerness and power the mammoth chip on your shoulder has over you when you respond.

    Oh, and can I assume you're going to ignore the -1 mod you got on your 'solution', posted above? You can't very well include it, can you, because this wouldn't help your argument.

    APK: always ready to overlook the truth in your campaign to claim everything as a 'victory'.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  81. Who's blind, APK? by Sardaukar86 · · Score: 1

    you said others here are "so bright" well... if they KNEW about logon scripts as you said earlier, why didn't THEY state it?

    I'm feeling charitable, I'll help: probably because you are a bore and most people skip over your comments.
    Contrary to your pompous, arrogant opinion on the matter, this is not evidence that you are the only knowledgeable person here. Your simplistic reasoning skills have left you high and dry again. I don't suffer from your flavour of mental illness, which is a shame really because I could then maintain a list of your down-moderation incidents throughout your posting history and post them to you in long lists as answer to any question you posed me.

    However, I fully expect you to consider this as cast-iron evidence for your own high level of popularity on this board. You are deluding yourself; your defence is toilet tissue.

    Even if every Slashdotter posted in unison to this effect you still wouldn't believe them. In fact, I could very easily see you trying to counter by sending your lists of 'evidence' to each an every one of them; you're just that nutty.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  82. APK has difficulties with the truth, read on; by Sardaukar86 · · Score: 1

    Well, see your sentiments there, outnumbered by /. posters regarding my posts as NOT being 'drivel' in the link above - you FAIL, as always & to the tune of nearly 250:1 against you!

    And, there you go - rotlflmao!

    ... apk

    No, you missed it again APK. I'd like to counter your last tirade by taking a moment to explore your 'logic'.
    Let's make up a little scenario: say you have infinite time and over the course of a number of years, you make three hundred thousand /. posts. Let's also assume, for the sake of the example, that nearly every one of these posts earns itself a -1 down-modding by members of the community.

    I put it to you that your only counter is to post your list of 244 up-mods in a disingenuous attempt to frame this as the full story. ("No, see, 244 people modded me up, so you are wrong")

    It is not the full story, APK, and I believe you know it is not, for these reasons:

    • 1. 244 people did not mod you up. Your list shows up-moderation instances, not unique moderators. You are wilfully distorting the truth by omitting this information.
    • 2. Claiming "No, see, 244 people modded me up, so you are wrong" is also disingenuous, because you are failing to account for the other 299,756 posts that were down-modded. You are therefore passing yourself off as something you are not, every time you pull out that list. Once again you are wilfully distorting the truth by omitting this information.
    • 3. You fail to respond to arguments that seek to address these discrepancies. Your only counter is to scream obscenities in bold, caps and WaReZ (it's been a while since I saw that in the wild) and post your list again. You are wilfully avoiding the matter because you know you are telling lies.
    • I don't imagine you see how this applies to your current behaviour, however I can assure you that it most certainly does. Your list proves nothing other than APK is a liar, because the entire list is a lie by omission intended to distort the truth and paint a false picture of the value of your contributions. You are a liar and a fake and a very sore loser. You lost when you first trotted that list out and you've done nothing but squirm and wriggle to avoid facing it in every post to me since.

      Childish claims of 'dusting me' etc. are just a smokescreen to avoid answering the question.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
    1. Re:APK has difficulties with the truth, read on; by Sardaukar86 · · Score: 1

      Hey look APK! I missed closing the (ul) tag in my last post!

      Guess that means you win the argument, huh?

      --
      ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  83. APK needs much repetition before he learns by Sardaukar86 · · Score: 1

    You just proved the point of my other post:

    Your only counter is to post your list of 244 up-mods in a disingenuous attempt to frame this as the full story. ("No, see, 244 people modded me up, so you are wrong")

    It is not the full story, APK, and I believe you know it is not, for these reasons:

    1. 244 people did not mod you up. Your list shows up-moderation instances, not unique moderators. You are wilfully distorting the truth by omitting this information.

    2. Claiming "No, see, 244 people modded me up, so you are wrong" is also disingenuous, because you are failing to account for the vast majority of your posts that were down-modded. You are therefore passing yourself off as something you are not, every time you pull out that list. Once again you are wilfully distorting the truth by omitting this information.

    3. You fail to respond to arguments that seek to address these discrepancies. Your only counter is to scream obscenities in bold, caps and WaReZ (it's been a while since I saw that in the wild) and post your list again. You are wilfully avoiding the matter because you know you are telling lies.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  84. How can nobody care about my hostfile wank? ..apk by Sardaukar86 · · Score: 1

    If your contributions are so valuable, why is this most informative post of yours still modded as Troll?

    Why hasn't it managed to do anything more than languish at the bottom? Maybe the bottom is where it belongs?

    Poor APK, I'm sure the gang here at /. just has you all wrong.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  85. Re:I'd call it you since you stalk me... lol! apk by Sardaukar86 · · Score: 1

    Well, of course you'd call me the same thing. It's the meat of your argument: "I know you are, I said you are, but what am I?"
    Some big guns you've got there buddy!

    It's often said that "repeating the same mistakes and expecting different results" is a symptom of insanity

    Definitely. They were thinking of behaviour like yours when they said that.

    ..so is LIBELING others, which is ILLEGAL!

    (Which you've done shown repeatedly in the link above, showing you DO NOT CONSIDER THE CONSEQUENCES OF YOUR ACTIONS either (especially illegal ones like libel)

    Oooooh, goody! Is this the bit where you threaten me with lawyers? I especially enjoyed when you got some sand in your vagina, puffed yourself up to the full extent of your pomposity and did just that here. Look at that APK, you behave like enough of a prick for someone to make a page to warn others about people like you!

    I especially enjoyed the summary later where, as expected, you wriggled away with your pride in tatters and your tail between your legs:

    Thor Schrock said on June 10th, 2008 at 8:56 am
    Case and point. No lawsuits, no communications from lawyers, and the eventual 'I wasn’t really going to sue you'.

    You later came back with:

    That’s right, you keep your mouth shut alright: You have NOTHING to say, & no backup vs. my questions here – some “computer expert” you are Thor lol!

    Yeah, APK - you're a real class act.

    P.S.=> Sardaukar86, when you get your PhD in the psychiatric sciences, a license to practice in them, and most importantly a FORMAL EXAMINATION of my "alleged mental state" given in a licensed professional psychiatric environs? Get back to us... it won't be libel then (why do you think courts of law bring in shrinks to court in matters of insanity pleas? They're the ONLY folks that can do that, & literally have certificates proving they're 'sane')...

    APK, if you were under court order to undergo such an examination and were found to be mentally ill, it is obvious that you wouldn't believe the doctor anyway. You're just too arrogant.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  86. Re:I also know this, per this article, lol... apk by ilikejam · · Score: 1

    None of that shows that you know anything about DNS. You're ranting into the abyss.

    What have I done? Like you, noting of note. If we're waving our dicks about, though, I have a BSc in Computing Science, an RHCSA and an SCSA. I administer Unix, DNS and LDAP for a FTSE100 company.

    And yet, here I am on Slashdot arguing with APK for some reason.

    --
    C-x C-s C-x k
  87. Re:Did you see the topic of this article? by ilikejam · · Score: 1

    You read the wikipedia page! Good for you!

    Yes, it is it's own TLD. It's also delegated out from the root nameservers, so there's still no central storage point and you're still vulnerable if you're relying on reverse lookups.

    --
    C-x C-s C-x k
  88. Re:How custom hosts files help vs. DNS flaws... ap by Sardaukar86 · · Score: 1

    Your post history shows you're projecting since you stalk him endlessly and obsessively.

    Your madness shows itself by forcing you to pretend to be someone unrelated, solely to post remarks in support of your own non-argument, APK.

    BTW if you weren't so self-deluded you wouldn't need to tell lies about me 'stalking endlessly and obsessively'; I have responded to precisely one question you asked in a public forum and I have referred you to one or two places to illuminate to you that a) I understand your strategy and it stinks of fail and b) you are demonstrating my point for me as your other poorly-received postings get the down-moderation they deserve.

    If you are going to post pathetic, whinging, immature rants phrased as questions against your perceived ill-treatment, do expect to get called on it and don't cry like a little bitch when it happens.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  89. Re:How custom hosts files help vs. DNS flaws... ap by Sardaukar86 · · Score: 1

    Oh, I almost forgot to call you out on posting AC in a shallow pretence of support for your post. Again.

    Grow up, you pathetic old fool.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  90. Re:Sardaukar86 never learns & repeats his mist by Sardaukar86 · · Score: 1

    In response in the link above, I merely easily replied WITH EVIDENCE TO THE CONTRARY, when I posted nearly 250 contrary opinions of your /. peers in my upward moderations from them, easily, to THAT rubbish from YOU, quoted above!

    No, you didn't. Your 'evidence' proves nothing, retard, that's the whole point that you're wilfully missing.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  91. Re:Statistics show you "eating your words" by Sardaukar86 · · Score: 1

    Post your same non-arguments again - you're a retarded robot with the personality and reasoning skills of an escapee mental patient.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  92. Re:Sardaukar86's "telling" us he likes to... by Sardaukar86 · · Score: 1

    What was all that about?

    Ah, of course, more smokescreen to prevent you from actually tackling the points I make, idiot.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  93. Re:Sardaukar86 has difficulties "eating his words" by Sardaukar86 · · Score: 1

    Posting your list again proves my point, not yours my mentally-incompetent friend.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  94. Re:"Eating your words" makes ya feel charitable? by Sardaukar86 · · Score: 1

    "Simply observe the general reaction of /. posters to your drivel and you'll see what I mean" - by Sardaukar86 on Thursday January 31, @05:43PM (#42756289) QUOTED VERBATIM FROM -> http://slashdot.org/comments.pl?sid=3417867&cid=42756289

    Well, see your sentiments there, outnumbered by /. posters regarding my posts as NOT being 'drivel' in the link above - you FAIL, as always & to the tune of nearly 250:1 against you!

    And, there you go - rotlflmao!

    ... apk

    Why are you having so much trouble with this simple concept, APK? You're not even bothering to comprehend the argument I just made, you are only capable of kindergarten-level squealing without a shred of rational thought.

    So, counter my point: you have far more down-mods than you do up-mods. Thus, your list proves only your insanity, not your popularity.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  95. Re:We can all be observant too, lol... apk by Sardaukar86 · · Score: 1

    If this repetitive shit is the best you can do, you've proven yourself too stupid to engage in a rational discussion.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  96. Re:DNSSEC & Root 13 DNS servers... apk by ilikejam · · Score: 1

    I'm at a loss here. You think when you do a reverse lookup you're only hitting the DNSSEC secured root servers? You really, genuinely don't understand how DNS works.

    Well, it's been weird. I'm out. I hope your hosts file providers are never compromised, and your reverse lookups always return valid hostnames. Good luck. You'll need it.

    --
    C-x C-s C-x k
  97. Re:Statistics show you "eating your words" by gmhowell · · Score: 1

    Post your same non-arguments again - you're a retarded robot with the personality and reasoning skills of an escapee mental patient.

    There ya go. I was wondering when you would come around to the conclusion that APK is an eliza-bot. A poorly (or brilliantly) coded one at that.

    --
    Jesus was all right but his disciples were thick and ordinary. -John Lennon
  98. Re:Statistics show you "eating your words" by Sardaukar86 · · Score: 1

    There ya go. I was wondering when you would come around to the conclusion that APK is an eliza-bot. A poorly (or brilliantly) coded one at that.

    Yeah, I'm a bit slow on the uptake. I've wondered at my own continuation of the debate with him (it?) and can only conclude it must be some sort of grim fascination on my part. He's something all right.

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  99. Re:Statistics show you "eating your words" by gmhowell · · Score: 1

    I can't fault you. It can be entertaining to engage with it. The biggest problem is when it gets broken and starts replying to EVERY post you make.

    --
    Jesus was all right but his disciples were thick and ordinary. -John Lennon
  100. Re:Statistics show you "eating your words" by Sardaukar86 · · Score: 1

    Oh Jebus, I think I must have enraged it. Sorry you got caught in the crossfire. :-(

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  101. Re:Statistics show you "eating your words" by gmhowell · · Score: 1

    Oh Jebus, I think I must have enraged it. Sorry you got caught in the crossfire. :-(

    Nah, I step in its line of fire every once in a while when I get bored.

    --
    Jesus was all right but his disciples were thick and ordinary. -John Lennon
  102. Re:You're a trolling scumbag George M. Howell by gmhowell · · Score: 1

    P.S.=> GEORGE M. HOWELL (gmhowell) "thrives" on creating hassles for others & apparently do this ON PURPOSE? Please - grow up... apk

    I won't grow up,
    (I won't grow up)
    I don't want to go to school.
    (I don't want to go to school)
    Just to learn to be a parrot,
    (Just to learn to be a parrot)
    And recite a silly rule.
    (And recite a silly rule)
    If growing up means
    It would be beneath my dignity to climb a tree,
    I'll never grow up, never grow up, never grow up
    Not me!
    Not I,
    Not me!
    Not me!
    I won't grow up,
    (I won't grow up)
    I don't want to wear a tie.
    (I don't want to wear a tie)
    And a serious expression
    (And a serious expression)
    In the middle of July.
    (In the middle of July)
    And if it means I must prepare
    To shoulder burdens with a worried air,

    --
    Jesus was all right but his disciples were thick and ordinary. -John Lennon
  103. Re:Then, take your meds George M. Howell by gmhowell · · Score: 1

    Interesting, the chatbot APK can take observations about itself and attempt to turn them on others.

    --
    Jesus was all right but his disciples were thick and ordinary. -John Lennon