4 ms·

Tellingly, the article almost completely ignores the apparently sizable number of US ISPs that return something very different from NXDOMAIN ("not found") when

Tellingly, the article almost completely ignores the apparently sizable number of US ISPs that return something very different from NXDOMAIN ("not found") when you ask for a nonexistent domain name. A working DNS server is a good thing.

AgentConundrum 15y ago
This is why I use Google's DNS servers (8.8.8.8, 8.8.4.4). I was surprised by this rather recently, when my girlfriend and I moved in with her brother to conserve finances (both his and ours, since their other brother had just moved out leaving him with larger-than-payable bills). I mistyped a URL and it came back with an ISP-provided search page, which infuriated/surprised me. As it turns out, I only had the wireless connection set to use GDNS, but I was temporarily using a wired connection until I could buy a new wireless router (the previous one was a modem/router combo from the ISP, despite the fact that when I returned it the woman at the desk "corrected" me when I told her I was returning the router, saying that they don't deal with routers. I just smiled, did my business, and left.)
- desigooner 15y ago
  Comcast and Verizon both do this. Verizon's been pointing to YellowPages website with a frame above notifying the user that the domain does not exist.
  - ejdyksen 15y ago
    Comcast hosts anycast DNS servers that opt out of the "domain helper" feature (and support DNSSEC): 75.75.75.75 and 75.75.76.76 http://dns.comcast.net/dns-ip-addresses2.php http://dns.comcast.net/dns-ip-addresses2.php
- alastairpat 15y ago
  It's not a uniquely American thing - Telstra/BigPond in Australia do it too, partnering with Yahoo search. It's frightfully annoying (but easily disabled for the technically-aware), because it actually redirects - this means fixing newss.ycombinator.com requires retyping the URL in its entirety.
- trebor 15y ago
  You hate the ISP doing it, but you'll freely give Google a list of all sites you visit? Admittedly this doesn't tie to your Google account directly, but if you hit it recently enough for both requests to have a similar time and IP address... you can figure the rest. I prefer to use OpenDNS. They do show a search page, or a "not responding" page, but they don't bug or track me that I'm aware of.
ay 15y ago
I understood the whole article is supposed to be about them, except that this fact is very much disguised by a poor quality of the article. The statement of "DNS server in question not passing the query directly to the search engine but through a host of other URLs" is factually nonsense - DNS server only is supposed to pass the query (that being a query for an A/AAAA records in the browser case, not the search query as they imply) to the authoritative servers within the hierarchy. I think what this article means is as follows: - the browsers try the name lookup on the DNS before treating the contents in the address bar as a search query. - this treatment happens if the DNS replies NXDOMAIN - if the domain exists (the browser gets A/AAAA record), the browser contacts the server in the reply. - so the malicious DNS servers take the queries for which they are supposed to return the NXDOMAIN and instead interpret them and return the A/AAAA answers pointing to the servers filled with ads related to the keyword which was present in the DNS query. - this is bad. Of course this kind of "setup" breaks other applications besides the web - but, HTTP being north of 90% traffic volume, no-one cares too much, probably.

AgentConundrum 15y ago

This is why I use Google's DNS servers (8.8.8.8, 8.8.4.4). I was surprised by this rather recently, when my girlfriend and I moved in with her brother to conserve finances (both his and ours, since their other brother had just moved out leaving him with larger-than-payable bills). I mistyped a URL and it came back with an ISP-provided search page, which infuriated/surprised me. As it turns out, I only had the wireless connection set to use GDNS, but I was temporarily using a wired connection until I could buy a new wireless router (the previous one was a modem/router combo from the ISP, despite the fact that when I returned it the woman at the desk "corrected" me when I told her I was returning the router, saying that they don't deal with routers. I just smiled, did my business, and left.)

desigooner 15y ago
Comcast and Verizon both do this. Verizon's been pointing to YellowPages website with a frame above notifying the user that the domain does not exist.
- ejdyksen 15y ago
  Comcast hosts anycast DNS servers that opt out of the "domain helper" feature (and support DNSSEC): 75.75.75.75 and 75.75.76.76 http://dns.comcast.net/dns-ip-addresses2.php http://dns.comcast.net/dns-ip-addresses2.php
alastairpat 15y ago
It's not a uniquely American thing - Telstra/BigPond in Australia do it too, partnering with Yahoo search. It's frightfully annoying (but easily disabled for the technically-aware), because it actually redirects - this means fixing newss.ycombinator.com requires retyping the URL in its entirety.
trebor 15y ago
You hate the ISP doing it, but you'll freely give Google a list of all sites you visit? Admittedly this doesn't tie to your Google account directly, but if you hit it recently enough for both requests to have a similar time and IP address... you can figure the rest. I prefer to use OpenDNS. They do show a search page, or a "not responding" page, but they don't bug or track me that I'm aware of.

ay 15y ago

I understood the whole article is supposed to be about them, except that this fact is very much disguised by a poor quality of the article. The statement of "DNS server in question not passing the query directly to the search engine but through a host of other URLs" is factually nonsense - DNS server only is supposed to pass the query (that being a query for an A/AAAA records in the browser case, not the search query as they imply) to the authoritative servers within the hierarchy. I think what this article means is as follows: - the browsers try the name lookup on the DNS before treating the contents in the address bar as a search query. - this treatment happens if the DNS replies NXDOMAIN - if the domain exists (the browser gets A/AAAA record), the browser contacts the server in the reply. - so the malicious DNS servers take the queries for which they are supposed to return the NXDOMAIN and instead interpret them and return the A/AAAA answers pointing to the servers filled with ads related to the keyword which was present in the DNS query. - this is bad. Of course this kind of "setup" breaks other applications besides the web - but, HTTP being north of 90% traffic volume, no-one cares too much, probably.