7 ms·

My D-Link router had domain.name as the default dhcp domain name, which caused some of my devices connected to it to resolve <whatever.tld>.domain.name when <wh

My D-Link router had domain.name as the default dhcp domain name, which caused some of my devices connected to it to resolve <whatever.tld>.domain.name when <whatever.tld> fails to resolve and someone have set up ad pages in many .domain.name pages to take advantage of the flaw. I've recently blogged about it(https://harigovind.org/articles/who-is-hijacking-my-nxdomains/ https://harigovind.org/articles/who-is-hijacking-my-nxdomain...). Need to be always careful when configuring things like this especially since we now have hundreds of tlds like .email, .work etc.

myself248 7y ago
I feel like there should be fines for using anything other than reserved-by-RFC names. When will it end?
- MichaelApproved 7y ago
  Supposedly, the free market should correct this when consumers stop buying the flawed product. Companies will recognize that poor security is not profitable and make improvements. In reality, consumers aren't (and can't) be educated enough to avoid products with these types of flaws. So, it's up to government to regulate but consumers (citizens) still need to care enough to ask the government to regulate with fines and recalls. EU citizens seem to have that type of government but US citizens would still rather protect corporate bad actors than protect themselves. If we see any kind of legislative pressure, my bet is it'll be from the EU well before the US.
  - mgkimsal 7y ago
    how do I deal with this as a consumer when... I go buy a router from target... bring it home. 4 months later there's a security upgrade which also changes the DNS resolution behavior to give me ads. What's my recourse as a consumer in this case? return to target? return to dlink or whoever manufactured it?
  - dahfizz 7y ago
    > Supposedly, the free market should correct this when consumers stop buying the flawed product. Any free market purist will tell you that all transactions must be both mutually consenting and informed. If these conditions are not met, it is the governments job to step in.
    - MichaelApproved 7y ago
      Genuinely curious to see a source for that claim.
      - rocelot 7y ago
        I think the implication is that, to quote Eric Weinstein from that Kayfabe article, "economic theory ... currently uses as it's central construct a market model based on assumptions of perfect information."
        QuesnayJr 7y ago
        Does he say that? Because it's very wrong -- economics of imperfect information has been a dominant theme of microeconomics for the last 50 years. They gave Akerlof, Stiglitz, and Spence the Nobel back in 2001. They gave a second Nobel in 2007 for mechanism design, which is on when and how you can design institutions so that imperfect information doesn't wreck everything.
      - dahfizz 7y ago
        Here is an excerpt from Milton Friedman: Fundamentally there are only two ways in which the activities of a large number of people can be co-ordinated: by central direction, which is the technique of the army and of the totalitarian state and involves some people telling other people what to do; or by voluntary co-operation, whch is the technique of the market place and of arrangements involving voluntary exchange. The possibility of voluntary co-operation in its turn rests fundamentally on the proposition that both parties to an exchange can benefit from it. If it is voluntary and reasonably well informed, the exchange will not take place unless both parties do benefit from it.[1] You will see a similar disclaimer in any bit of free-market libertarian thought, because you can't have voluntary exchange without informed consent. If transactions without informed consent are taking place, it is easy to argue that someone's property rights are being violated. Any libertarian since John Locke will tell you that protecting your rights is the first and foremost job of government[2]. [1] https://oll.libertyfund.org/pages/friedman-on-capitalism-and-freedom https://oll.libertyfund.org/pages/friedman-on-capitalism-and... [2] https://plato.stanford.edu/entries/locke-political/ https://plato.stanford.edu/entries/locke-political/
  - kryogen1c 7y ago
    >In reality, consumers aren't (and can't) be educated enough this is a gravely serious statement. in America youre talking about a fundamental shift in the relationship between the governed and the government. many states would violently oppose the idea that the government knows whats best for you and should create laws for you backed by lethal force. >US citizens would still rather protect corporate bad actors than protect themselves. you missed the point. its not about protecting corporations, its about allowing personal freedom, even if that freedom includes suboptimal results. moreover, it is abjectly false that the government can simply do whats best for everyone.
    - xxpor 7y ago
      >this is a gravely serious statement. in America youre talking about a fundamental shift in the relationship between the governed and the government. many states would violently oppose the idea that the government knows whats best for you and should create laws for you backed by lethal force. You sure about that? The FDA, USDA, CPSC, FCC, FAA etc all exist already.
    - kdmccormick 7y ago
      > this is a gravely serious statement. in America youre talking about a fundamental shift in the relationship between the governed and the government. Uh, consumer protection laws have existed in the US for over a century. The FTC was founded in 1914. The mindset that laws should protect people from things that they don't understand is not an abrupt or fundamental shift. If not for the government, would you know how to find out if an apartment was built and wired in a safe way? Or do you rely on government permits and inspectors for that confidence?
      - kryogen1c 7y ago
        >The FTC was founded in 1914 the ftc was founded as an anti-monopoly arm of the government, and is not the same thing as saying "consumers aren't smart enough to know whats good for them" IMO as a libertarian, trust-busting is one of the fundamental responsibilities of the government because consumers and small businesses usually cannot overturn a monopoly.
  - SifJar 7y ago
    > Supposedly, the free market should correct this when consumers stop buying the flawed product. Surely this is only true if the consumer _values_ security? Even assuming every (potential) consumer is educated enough to recognise security flaws, that doesn't necessarily mean the typical consumer will value security enough to purchase an alternative product they deem inferior in some other aspect
    - myself248 7y ago
      Arguably many consumers, even if they _could_ evaluate a product's security before purchase, wouldn't _care_ because they don't understand how it affects them. And often, the effects (DDoS nets, etc) are against someone else anyway. I'm not sure if "tragedy of the commons" is the right term for this, but I feel it's in the ballpark. Insecure devices create a form of pollution on the internet, let's say. And perhaps we should think of them like other polluters. Obviously pollution controls have a cost, just like security, but we all understand that it's in everyone's interest to have air we can breathe, and ultimately lowers health care cost. Likewise, it could be argued that it's in everyone's interest (and perhaps a national security priority, as well) to have devices that don't allow themselves to be taken over by arbitrary attackers. I think these are the regulatory models we should be considering.
  - TeMPOraL 7y ago
    Here's an underappreciated thing that makes free market's "customers will recognize Bad Aspect X and buy something else" not work. It's not a conspiracy, but it seems like something the market is naturally optimizing towards. Choice has a cost, and we're all completely DDoSed by issues in our lives. So yes, the router turns out to redirect NXDOMAIN to a page full of ads. Also, my back aches, I'm burned out at my job, my spouse has a bad mood today, I should've bought flowers in the morning but I forgot (maybe if I leave work 20 minutes early I'll manage to get them on the way back?), I've just discovered my bank is severely overcharging me for my account relative to the competition, the city council has just passed a bullshit increase in garbage collection rates, also the asshole who owns the apartment above has put it on AirBnB and we can't get a good night's sleep now, and .... and yes, my router is redirecting NXDOMAIN to a page full of ads. There's this belief that people are too whiny these days. I start to feel it's opposite: we're too saturated with bullshit to have time to be whiny enough - enough to turn it into meaningful purchasing choices.
    - AnthonyMouse 7y ago
      Is this not what the likes of Consumer Reports is for? You pay them money, they tell you what to buy and then you don't have to evaluate everything yourself. Naturally people don't want to pay for it, but it costs money to provide it, so what do you want? The best thing the government could do is provide the same service for free.
      - TeMPOraL 7y ago
        > Is this not what the likes of Consumer Reports is for? It's a stop-gap solution, yes. Unfortunately, AFAIK there's nothing like this in my country, at least not trustworthy. For general electronics, I trust WireCutter and have never been anything but completely happy by just buying one of their top recommendations in a given category. The question is, is the complexity of our lives all necessary, or is most of it incidental? And regardless, the point is: existence of this complexity makes the market mechanisms of ranking of products and services quite weak.
        7y ago
  - AnthonyMouse 7y ago
    > In reality, consumers aren't (and can't) be educated enough to avoid products with these types of flaws. So, it's up to government to regulate Why is the proposed answer to information problems always bans and fines? Is the government, or anyone else in the market, lacking in the capacity to instead provide people with better information? If you want the government to do something, why not have them go out and evaluate the products that exist in the market? Then if they find vulnerabilities, they can report them to the manufacturers before they're discovered by attackers, and they can rate the vendors on their security practices and publish the information so that customers do have the information on which vendors make better products. How is this not vastly superior to the thing where they destroy all small vendors with onerous regulations and then everything costs fifty times as much because the only vendors big enough to comply with the regulations are Oracle and IBM?
- andrewaylett 7y ago
  But it's useful! If your search domain is `internal.company.com` and you've got a Jira instance at `jira.internal.company.com` then all you've got to do is navigate to `jira` and it works. It's also quite possible to turn off walking up the search domain: it's just a checkbox. None of which makes it a good idea, and the best thing to do is actually to just _not set_ the search domain.
lightswitch05 7y ago
That was a fascinating write-up! I too immediately looked for `domain.name` registration and would have marked it up to DNS trickery after that gave a NXDOMAIN. I'm glad you followed the rabbit down the hole on this one. I've added the resolving domains to my Pi-hole block list: https://www.github.developerdan.com/hosts/ https://www.github.developerdan.com/hosts/
- scalableUnicon 7y ago
  Thanks!:) What was even more confusing, but I didn't mention in the article, was that visiting domain.name in my browser did take me to a similar website. That was because firefox will try www.<doman.tld> when <domain.tld> fails, so it was actually www.domain.name I was getting instead of domain.name. This behavior can be turned off by setting `browser.fixup.alternate.enabled` to false.
  - lightswitch05 7y ago
    I had no idea about that config, but I've seen the behavior before. That behavior is even more interesting considering that Firefox will hide the 'www' subdomain in the URL[1]. So not only will it silently add the www, but it also won't show it in the URL! SMH! 1: https://www.ghacks.net/2020/02/28/firefox-75-address-bar-results/ https://www.ghacks.net/2020/02/28/firefox-75-address-bar-res...

myself248 7y ago

I feel like there should be fines for using anything other than reserved-by-RFC names. When will it end?

MichaelApproved 7y ago
Supposedly, the free market should correct this when consumers stop buying the flawed product. Companies will recognize that poor security is not profitable and make improvements. In reality, consumers aren't (and can't) be educated enough to avoid products with these types of flaws. So, it's up to government to regulate but consumers (citizens) still need to care enough to ask the government to regulate with fines and recalls. EU citizens seem to have that type of government but US citizens would still rather protect corporate bad actors than protect themselves. If we see any kind of legislative pressure, my bet is it'll be from the EU well before the US.
- mgkimsal 7y ago
  how do I deal with this as a consumer when... I go buy a router from target... bring it home. 4 months later there's a security upgrade which also changes the DNS resolution behavior to give me ads. What's my recourse as a consumer in this case? return to target? return to dlink or whoever manufactured it?
- dahfizz 7y ago
  > Supposedly, the free market should correct this when consumers stop buying the flawed product. Any free market purist will tell you that all transactions must be both mutually consenting and informed. If these conditions are not met, it is the governments job to step in.
  - MichaelApproved 7y ago
    Genuinely curious to see a source for that claim.
    - rocelot 7y ago
      I think the implication is that, to quote Eric Weinstein from that Kayfabe article, "economic theory ... currently uses as it's central construct a market model based on assumptions of perfect information."
      - QuesnayJr 7y ago
        Does he say that? Because it's very wrong -- economics of imperfect information has been a dominant theme of microeconomics for the last 50 years. They gave Akerlof, Stiglitz, and Spence the Nobel back in 2001. They gave a second Nobel in 2007 for mechanism design, which is on when and how you can design institutions so that imperfect information doesn't wreck everything.
    - dahfizz 7y ago
      Here is an excerpt from Milton Friedman: Fundamentally there are only two ways in which the activities of a large number of people can be co-ordinated: by central direction, which is the technique of the army and of the totalitarian state and involves some people telling other people what to do; or by voluntary co-operation, whch is the technique of the market place and of arrangements involving voluntary exchange. The possibility of voluntary co-operation in its turn rests fundamentally on the proposition that both parties to an exchange can benefit from it. If it is voluntary and reasonably well informed, the exchange will not take place unless both parties do benefit from it.[1] You will see a similar disclaimer in any bit of free-market libertarian thought, because you can't have voluntary exchange without informed consent. If transactions without informed consent are taking place, it is easy to argue that someone's property rights are being violated. Any libertarian since John Locke will tell you that protecting your rights is the first and foremost job of government[2]. [1] https://oll.libertyfund.org/pages/friedman-on-capitalism-and-freedom https://oll.libertyfund.org/pages/friedman-on-capitalism-and... [2] https://plato.stanford.edu/entries/locke-political/ https://plato.stanford.edu/entries/locke-political/
- kryogen1c 7y ago
  >In reality, consumers aren't (and can't) be educated enough this is a gravely serious statement. in America youre talking about a fundamental shift in the relationship between the governed and the government. many states would violently oppose the idea that the government knows whats best for you and should create laws for you backed by lethal force. >US citizens would still rather protect corporate bad actors than protect themselves. you missed the point. its not about protecting corporations, its about allowing personal freedom, even if that freedom includes suboptimal results. moreover, it is abjectly false that the government can simply do whats best for everyone.
  - xxpor 7y ago
    >this is a gravely serious statement. in America youre talking about a fundamental shift in the relationship between the governed and the government. many states would violently oppose the idea that the government knows whats best for you and should create laws for you backed by lethal force. You sure about that? The FDA, USDA, CPSC, FCC, FAA etc all exist already.
  - kdmccormick 7y ago
    > this is a gravely serious statement. in America youre talking about a fundamental shift in the relationship between the governed and the government. Uh, consumer protection laws have existed in the US for over a century. The FTC was founded in 1914. The mindset that laws should protect people from things that they don't understand is not an abrupt or fundamental shift. If not for the government, would you know how to find out if an apartment was built and wired in a safe way? Or do you rely on government permits and inspectors for that confidence?
    - kryogen1c 7y ago
      >The FTC was founded in 1914 the ftc was founded as an anti-monopoly arm of the government, and is not the same thing as saying "consumers aren't smart enough to know whats good for them" IMO as a libertarian, trust-busting is one of the fundamental responsibilities of the government because consumers and small businesses usually cannot overturn a monopoly.
- SifJar 7y ago
  > Supposedly, the free market should correct this when consumers stop buying the flawed product. Surely this is only true if the consumer _values_ security? Even assuming every (potential) consumer is educated enough to recognise security flaws, that doesn't necessarily mean the typical consumer will value security enough to purchase an alternative product they deem inferior in some other aspect
  - myself248 7y ago
    Arguably many consumers, even if they _could_ evaluate a product's security before purchase, wouldn't _care_ because they don't understand how it affects them. And often, the effects (DDoS nets, etc) are against someone else anyway. I'm not sure if "tragedy of the commons" is the right term for this, but I feel it's in the ballpark. Insecure devices create a form of pollution on the internet, let's say. And perhaps we should think of them like other polluters. Obviously pollution controls have a cost, just like security, but we all understand that it's in everyone's interest to have air we can breathe, and ultimately lowers health care cost. Likewise, it could be argued that it's in everyone's interest (and perhaps a national security priority, as well) to have devices that don't allow themselves to be taken over by arbitrary attackers. I think these are the regulatory models we should be considering.
- TeMPOraL 7y ago
  Here's an underappreciated thing that makes free market's "customers will recognize Bad Aspect X and buy something else" not work. It's not a conspiracy, but it seems like something the market is naturally optimizing towards. Choice has a cost, and we're all completely DDoSed by issues in our lives. So yes, the router turns out to redirect NXDOMAIN to a page full of ads. Also, my back aches, I'm burned out at my job, my spouse has a bad mood today, I should've bought flowers in the morning but I forgot (maybe if I leave work 20 minutes early I'll manage to get them on the way back?), I've just discovered my bank is severely overcharging me for my account relative to the competition, the city council has just passed a bullshit increase in garbage collection rates, also the asshole who owns the apartment above has put it on AirBnB and we can't get a good night's sleep now, and .... and yes, my router is redirecting NXDOMAIN to a page full of ads. There's this belief that people are too whiny these days. I start to feel it's opposite: we're too saturated with bullshit to have time to be whiny enough - enough to turn it into meaningful purchasing choices.
  - AnthonyMouse 7y ago
    Is this not what the likes of Consumer Reports is for? You pay them money, they tell you what to buy and then you don't have to evaluate everything yourself. Naturally people don't want to pay for it, but it costs money to provide it, so what do you want? The best thing the government could do is provide the same service for free.
    - TeMPOraL 7y ago
      > Is this not what the likes of Consumer Reports is for? It's a stop-gap solution, yes. Unfortunately, AFAIK there's nothing like this in my country, at least not trustworthy. For general electronics, I trust WireCutter and have never been anything but completely happy by just buying one of their top recommendations in a given category. The question is, is the complexity of our lives all necessary, or is most of it incidental? And regardless, the point is: existence of this complexity makes the market mechanisms of ranking of products and services quite weak.
      - 7y ago
- AnthonyMouse 7y ago
  > In reality, consumers aren't (and can't) be educated enough to avoid products with these types of flaws. So, it's up to government to regulate Why is the proposed answer to information problems always bans and fines? Is the government, or anyone else in the market, lacking in the capacity to instead provide people with better information? If you want the government to do something, why not have them go out and evaluate the products that exist in the market? Then if they find vulnerabilities, they can report them to the manufacturers before they're discovered by attackers, and they can rate the vendors on their security practices and publish the information so that customers do have the information on which vendors make better products. How is this not vastly superior to the thing where they destroy all small vendors with onerous regulations and then everything costs fifty times as much because the only vendors big enough to comply with the regulations are Oracle and IBM?
andrewaylett 7y ago
But it's useful! If your search domain is `internal.company.com` and you've got a Jira instance at `jira.internal.company.com` then all you've got to do is navigate to `jira` and it works. It's also quite possible to turn off walking up the search domain: it's just a checkbox. None of which makes it a good idea, and the best thing to do is actually to just _not set_ the search domain.

lightswitch05 7y ago

That was a fascinating write-up! I too immediately looked for `domain.name` registration and would have marked it up to DNS trickery after that gave a NXDOMAIN. I'm glad you followed the rabbit down the hole on this one. I've added the resolving domains to my Pi-hole block list: https://www.github.developerdan.com/hosts/ https://www.github.developerdan.com/hosts/

scalableUnicon 7y ago
Thanks!:) What was even more confusing, but I didn't mention in the article, was that visiting domain.name in my browser did take me to a similar website. That was because firefox will try www.<doman.tld> when <domain.tld> fails, so it was actually www.domain.name I was getting instead of domain.name. This behavior can be turned off by setting `browser.fixup.alternate.enabled` to false.
- lightswitch05 7y ago
  I had no idea about that config, but I've seen the behavior before. That behavior is even more interesting considering that Firefox will hide the 'www' subdomain in the URL[1]. So not only will it silently add the www, but it also won't show it in the URL! SMH! 1: https://www.ghacks.net/2020/02/28/firefox-75-address-bar-results/ https://www.ghacks.net/2020/02/28/firefox-75-address-bar-res...