3 ms·

This is one of the many problems that DNSCurve solves, by setting up encrypted and authenticated connections between you and any DNS servers you decide to trust

by pjscott 15y ago

This is one of the many problems that DNSCurve solves, by setting up encrypted and authenticated connections between you and any DNS servers you decide to trust. http://dnscurve.org/ http://dnscurve.org/ OpenDNS already supports it: http://blog.opendns.com/2010/02/23/opendns-dnscurve/ http://blog.opendns.com/2010/02/23/opendns-dnscurve/

snarkinatree 15y ago
It's great they support it, but how many people have DNSCurve enabled authoritative nameservers? And how many OpenDNS cache users are routing their queries through a DNSCurve forwarder? It's the same as with DNSSEC. To get the full benefit, every point in the chain needs to be on board, from the source to the sink. If any link in the chain doesn't support it, you're SOL. If you read Dempsky's announcement carefully, you notice the words "whenever possible". That could be almost never depending on DNSCurve uptake among DNS admins and users. An easier solution is to just run your own instance of dnscache. That's what OpenDNS uses.
kijin 15y ago
Meanwhile, OpenDNS hijacked NXDOMAIN results and tried to show me ads the last time I used them. Have they stopped doing that?
- pbhjpbhj 15y ago
  I imagine typo domain suggestion/resolution is one of their key selling points for people who don't know what NXDOMAIN is (ie most of their customers), removing it seems unlikely.
  - kijin 15y ago
    Fair point, but I think it's the browser's job to decide what to do when the user types a domain that doesn't exist. Chrome gives you a search page if you enter a nonexistent domain.
    - hubbit 15y ago
      Let me guess, a Google search page. How convenient. It's clear to see everyone wants a piece of this nxdomain action. Whether it's the DNS service provider, the ISP, or the browser company (Microsoft does a redirect too, not sure about Mozilla) or the typosquatter. The blog post is on a blog sponsored by a DNS service provider. ISP's are stealing their nxdomain traffic! The horror! I can remember when a 404 was a 404. No ads. "Those were the days."
- cdr 15y ago
  Yes, they still hijack NXDOMAIN among other things. The "other things" you can mostly disable with settings, but there's no way to get rid of the NXDOMAIN hijacking - at least for free, maybe you can pay them money to. It annoyed me sufficiently I switched back to Google DNS, even though I was getting better streaming performance with OpenDNS.

by pjscott 15y ago

snarkinatree 15y ago

It's great they support it, but how many people have DNSCurve enabled authoritative nameservers? And how many OpenDNS cache users are routing their queries through a DNSCurve forwarder? It's the same as with DNSSEC. To get the full benefit, every point in the chain needs to be on board, from the source to the sink. If any link in the chain doesn't support it, you're SOL. If you read Dempsky's announcement carefully, you notice the words "whenever possible". That could be almost never depending on DNSCurve uptake among DNS admins and users. An easier solution is to just run your own instance of dnscache. That's what OpenDNS uses.

kijin 15y ago

Meanwhile, OpenDNS hijacked NXDOMAIN results and tried to show me ads the last time I used them. Have they stopped doing that?

pbhjpbhj 15y ago
I imagine typo domain suggestion/resolution is one of their key selling points for people who don't know what NXDOMAIN is (ie most of their customers), removing it seems unlikely.
- kijin 15y ago
  Fair point, but I think it's the browser's job to decide what to do when the user types a domain that doesn't exist. Chrome gives you a search page if you enter a nonexistent domain.
  - hubbit 15y ago
    Let me guess, a Google search page. How convenient. It's clear to see everyone wants a piece of this nxdomain action. Whether it's the DNS service provider, the ISP, or the browser company (Microsoft does a redirect too, not sure about Mozilla) or the typosquatter. The blog post is on a blog sponsored by a DNS service provider. ISP's are stealing their nxdomain traffic! The horror! I can remember when a 404 was a 404. No ads. "Those were the days."
cdr 15y ago
Yes, they still hijack NXDOMAIN among other things. The "other things" you can mostly disable with settings, but there's no way to get rid of the NXDOMAIN hijacking - at least for free, maybe you can pay them money to. It annoyed me sufficiently I switched back to Google DNS, even though I was getting better streaming performance with OpenDNS.