4 ms·

Let me just further highlight this specific part: >we may also wildcard your DNS to localhost and set the TTL on your zone out to a year. You’ve been warned M

by FDSGSG 7y ago

Let me just further highlight this specific part: >we may also wildcard your DNS to localhost and set the TTL on your zone out to a year. You’ve been warned Maliciously tampering with customer DNS configs to DoS them for extended periods? Fucking incredible.

nprateem 7y ago
And I'd be surprised if it couldn't lead to a successful legal claim against them for damages.
- jeremy7600 7y ago
  Wait, you want to expose your shady spam operation so you can claim damages? Tell me how that works out for you.
  - FDSGSG 7y ago
    Where exactly does the quoted text mention shady spam operations? It's about DDoS victims, not cybercriminals. >We are NOT a DDoS Mitigation Service. Yes, we have a lot of DDoS mitigation in place. No, this isn’t here so that you can get cheap DDoS mitigation. You cannot use any services here if you are, have been or think you may be the direct target of a DDoS attack. Contact us instead for a referral to a real DDoS mitigation company. If you come on this system knowingly bringing a DDoS on your heels we shut down service (we may also wildcard your DNS to localhost and set the TTL on your zone out to a year. You’ve been warned).
    - mikehodgson 7y ago
      > If you come on this system knowingly bringing a DDoS on your heels
      - FDSGSG 7y ago
        So hosting a minecraft server? Or a game server of any kind? An IRC server? An internet forum? An email provider? All things notorious for attracting DDoS attacks.
        fludlight 7y ago
        What motivates a DDoS attacker? Are they all just wannabe vigilantes seeking to right some perceived wrong (such as being banned from a club, opposing political views, etc)? Is there ever a clear economic motive?
        lima 7y ago
        Yes, most are wannabe vigilantes. Sometimes ransom but CloudFlare has kind of killed that line of business.
cat199 7y ago
agree it's an overkill solution - but, devils advocate, maybe it's just there to scare off potential spammers/scammers? Having worked at an ISP in security/spam/abuse, these people are a huge drain on resources.
- FDSGSG 7y ago
  >but, devils advocate, maybe it's just there to scare off potential spammers/scammers? Why are you engaging in these bizarre mental gymnastics to defend this? The threat is made in a context strictly unrelated to spammers/scammers.
- danShumway 7y ago
  Speaking as a consumer, I'm kind of tired of companies giving themselves enormous amounts of power and then saying, "don't worry, we won't use it." That's not a professional relationship to me. And I would hazard a guess that if I tried to contract with EasyDNS and added clauses that gave myself similar amounts of power over them, they wouldn't be as trusting of me. The point of a legal document is to set explicit boundaries, not to set a "tone" to the relationship or scare off scammers. Setting tone is what your FAQ is for.
- soraminazuki 7y ago
  It doesn't matter because it also scares off everyone else also wanting to do business with them.
dubcanada 7y ago
Correct me if I am wrong, but a TTL is specific to nameservers. So if you switch from easyDNS to say cloudflare your TTLs get completely reset and the caching does as well.
- FDSGSG 7y ago
  Firstly, in practice this would be very unlikely to affect a domain for an extended period of time, none of the big providers really treat TTLs like that. It's the mere spirit of the thing that counts. However, I don't see why changing your nameservers would help if your resolver was always hitting a cache entry with a 1yr TTL.
- toast0 7y ago
  In theory, maybe? But if the TTL is 1 year, why would my caching resolver try to find the new nameservers? Also, there's a long tail of totally garbage behavior in the DNS space. At my last job, as part of moving our domains off of Dyn/Oracle, we delegated the domains to our self hosting via the domain registry, and changed the NS records at Dyn to point only at our self hosting, but we were still seeing a steady trickle of traffic to Dyn after 30 days.
- blackflame7000 7y ago
  It would change the Authoritative server's TTL but it wouldn't necessarily propagate to caching DNS servers.

by FDSGSG 7y ago

nprateem 7y ago

And I'd be surprised if it couldn't lead to a successful legal claim against them for damages.

jeremy7600 7y ago
Wait, you want to expose your shady spam operation so you can claim damages? Tell me how that works out for you.
- FDSGSG 7y ago
  Where exactly does the quoted text mention shady spam operations? It's about DDoS victims, not cybercriminals. >We are NOT a DDoS Mitigation Service. Yes, we have a lot of DDoS mitigation in place. No, this isn’t here so that you can get cheap DDoS mitigation. You cannot use any services here if you are, have been or think you may be the direct target of a DDoS attack. Contact us instead for a referral to a real DDoS mitigation company. If you come on this system knowingly bringing a DDoS on your heels we shut down service (we may also wildcard your DNS to localhost and set the TTL on your zone out to a year. You’ve been warned).
  - mikehodgson 7y ago
    > If you come on this system knowingly bringing a DDoS on your heels
    - FDSGSG 7y ago
      So hosting a minecraft server? Or a game server of any kind? An IRC server? An internet forum? An email provider? All things notorious for attracting DDoS attacks.
      - fludlight 7y ago
        What motivates a DDoS attacker? Are they all just wannabe vigilantes seeking to right some perceived wrong (such as being banned from a club, opposing political views, etc)? Is there ever a clear economic motive?
        lima 7y ago
        Yes, most are wannabe vigilantes. Sometimes ransom but CloudFlare has kind of killed that line of business.

cat199 7y ago

agree it's an overkill solution - but, devils advocate, maybe it's just there to scare off potential spammers/scammers? Having worked at an ISP in security/spam/abuse, these people are a huge drain on resources.

FDSGSG 7y ago
>but, devils advocate, maybe it's just there to scare off potential spammers/scammers? Why are you engaging in these bizarre mental gymnastics to defend this? The threat is made in a context strictly unrelated to spammers/scammers.
danShumway 7y ago
Speaking as a consumer, I'm kind of tired of companies giving themselves enormous amounts of power and then saying, "don't worry, we won't use it." That's not a professional relationship to me. And I would hazard a guess that if I tried to contract with EasyDNS and added clauses that gave myself similar amounts of power over them, they wouldn't be as trusting of me. The point of a legal document is to set explicit boundaries, not to set a "tone" to the relationship or scare off scammers. Setting tone is what your FAQ is for.
soraminazuki 7y ago
It doesn't matter because it also scares off everyone else also wanting to do business with them.

dubcanada 7y ago

Correct me if I am wrong, but a TTL is specific to nameservers. So if you switch from easyDNS to say cloudflare your TTLs get completely reset and the caching does as well.

FDSGSG 7y ago
Firstly, in practice this would be very unlikely to affect a domain for an extended period of time, none of the big providers really treat TTLs like that. It's the mere spirit of the thing that counts. However, I don't see why changing your nameservers would help if your resolver was always hitting a cache entry with a 1yr TTL.
toast0 7y ago
In theory, maybe? But if the TTL is 1 year, why would my caching resolver try to find the new nameservers? Also, there's a long tail of totally garbage behavior in the DNS space. At my last job, as part of moving our domains off of Dyn/Oracle, we delegated the domains to our self hosting via the domain registry, and changed the NS records at Dyn to point only at our self hosting, but we were still seeing a steady trickle of traffic to Dyn after 30 days.
blackflame7000 7y ago
It would change the Authoritative server's TTL but it wouldn't necessarily propagate to caching DNS servers.