8 ms·

No-IP's Formal Statement on Microsoft Takedown

224 points by wfjackson 12y ago

ntakasaki 12y ago
They also deny Cisco's allegations here. http://www.noip.com/blog/2014/02/12/cisco-malware-report/ http://www.noip.com/blog/2014/02/12/cisco-malware-report/ It doesn't compute that Cisco is casting blame on them and Microsoft got a court order when all they had to do is send an email. It's kind of strange, they're probably unable to keep up with the abuse reports and validating them or something. There are a lot of dynamic DNS providers so why do the bad guys pick them for the most part for their DNS needs?
- Omniusaspirer 12y ago
  Presumably because they have a free basic service if you use one of their subdomains. While other companies I'm not aware of might offer the same I've yet to stumble across them.
  - shawnz 12y ago
    DynDNS and afraid, which as far as I know are the next two most popular services like this, both have free options. EDIT: Looks like DynDNS recently got rid of their free offering. I wonder if that was related to this?
    - LukeShu 12y ago
      DynDNS dropped their free offering a couple of years ago. If you had created your account before then, you were grandfathered in, and still got 5(?) domains for free; as long as you logged in frequently enough.
      - krallja 12y ago
        Dyn permanently ended its free hostname program in May 2014, with 30-day notice given on April 7. http://dyn.com/blog/why-we-decided-to-stop-offering-free-accounts/ http://dyn.com/blog/why-we-decided-to-stop-offering-free-acc...
    - Fuxy 12y ago
      Also they wouldn't be able to go against afraid since it's fundamentally a different type of service. It offers a DNS service for your domain and the ability to share your domain with others. You can't seize the 100.000 domains being shared and used by bot nets so the only easy target was no-ip. What i find extremely troubling is the domains being handed over to another corporate entity this mechanism is just ripe for abuse.
  - stevekemp 12y ago
    http://dhcp.io/ http://dhcp.io/ is (my) new service, launched only recently. Mine doesn't use the same dyn update API, just curl, and you can self-host if you have an Amazon Route53 account.
- vacri 12y ago
  The press release smells to me like they're playing the innocent, and are savvy to the kind of language their audience likes. "We were very surprised this morning"... "Had Microsoft contacted us, we could and would have taken immediate action."? Surely at some point legal proceedings would have initiated some contact?
  - nitrogen 12y ago
    This comment (and its siblings in the thread) suggest that Microsoft got this order without prior notification to NoIP: https://news.ycombinator.com/item?id=7968762 https://news.ycombinator.com/item?id=7968762
jpgvm 12y ago
This smells like BS, this also isn't the first time that other entities have had to step in to cleanup their crap. Especially this quote: "Apparently, the Microsoft infrastructure is not able to handle the billions of queries from our customers." Azure DNS, Microsoft.com, Bing. Yeah, all of those already require billions of DNS queries. I don't doubt things are not working correctly, but insinuating Microsoft can't handle the load just makes their case smell even worse.
- norswap 12y ago
  I think what is insinuated is that they botched the job, not that they're not technically capable of doing it.
  - jpgvm 12y ago
    I can agree with the fact they probably botched it (potentially on purpose), but the way it's articulated in the No-IP reply leaves little ambiguity that it was intended as an attack on their technical capability. I am not in love with what Microsoft did here but No-IP is not doing the best job of defending their position.
- hrrsn 12y ago
  Not really. It looks like these domains are hosted on a different platform. $ host ns1.microsoftinternetsafety.net ns1.microsoftinternetsafety.net has address 199.2.137.250 $ host ns1.msft.net ns1.msft.net has address 65.55.37.62 ns1.msft.net has IPv6 address 2a01:111:2005::1:1 $
- mb0 12y ago
  Try and query anything.no-ip.biz. At the moment, I'm getting regular timeouts on queries to both ns7.microsoftinternetsafety.net and ns8.microsoftinternetsafety.net. It shouldn't take much for microsoft to log all incoming dns requests and put in an NS record to let traffic continue flowing down to no-ip's actual nameservers. A simple `dig whatever.no-ip.biz @a.root-servers.net +trace` will show you this.
- chmars 12y ago
norswap 12y ago
Wait, how can a company seize the domains of another?
- rdl 12y ago
  I agree, it's a bit troublesome that one private company can do this to another, vs. the government doing so.
  - ggchappell 12y ago
    It is the government. Specifically, the order was issued (it appears) by the U.S. District Court of Nevada. See also my root-level comment: https://news.ycombinator.com/item?id=7968365 https://news.ycombinator.com/item?id=7968365
- nimish 12y ago
  By convincing a judge that it was necessary? Actual detail here: http://www.noticeoflawsuit.com/index.htm http://www.noticeoflawsuit.com/index.htm
  - jevinskie 12y ago
    The legal team got a domain just for the notice?
- notsoMicrosoft 12y ago
  This is America. With enough money, you can do whatever you want.
  - threeseed 12y ago
    You can see it that way. Others will see it as Microsoft proactively removing bots and spam.
    - notsoMicrosoft 12y ago
      It is the FBI's job to enforce cyber criminal law and execute takedowns of malicious domains. Not Microsoft's[or any other NGO].
ddod 12y ago
The comments here are surprisingly pro-Microsoft. I'd personally rather deal with spam and botnets over a corporation legally being able to take over the DNS of other companies due to the actions of users of a service. Despite pretty clear slippery-slope arguments, I recognize this isn't a universal opinion. There are many people who would like to curb cyber-bullying at the expense of freedom of speech or curb terrorism at the expense of privacy and civil liberties. It takes all kinds, I guess.
- jpgvm 12y ago
  I don't agree with the precedent set here but it does seem No-IP was doing a pretty bad job of responding to mass abuse. While I do take issue to the actions of Microsoft and the courts I also think No-IP hasn't done themselves any favours and are at least partially to blame for this coming to pass. It stands to reason that it's close to impossible to create a free service that is impervious to abuse however it's still their responsibility to avoid mass abuse of their platform to orchestrate botnets.
  - ddod 12y ago
    That responsibility is not absolute, and could be interpreted differently in the frameworks of ethicality, legality, economics, and liberty. Ethically, I think you're correct that it's their responsibility to do what they can. Legally, the court in this situation thought it was somehow Microsoft's responsibility to fix it. Economically, I'd say being held liable to what users do on your platform will hurt innovation and competition. In terms of liberty, botnets and spam don't seem like they compare to an attack on someone's business, their users, and their freedom to operate independently. I guess you can choose which perspective makes the most sense to you, personally.
    - threeseed 12y ago
      You believe in terms of liberty that botnets who compromise machines in order to steal data, spam and many other nefarious activities doesn't compare to one business being temporarily affected ? That is a strange perspective I have to say.
ggchappell 12y ago
If this action is troubling, then we need to stop putting the blame in the wrong place. Microsoft does not have the power to seize domains. A federal court order made that happen. This order is (apparently) the responsibility of the U.S. District Court of Nevada. If you want to blame someone, then blame the court. Obnoxious people ask courts to do obnoxious things every day. Good courts do not comply.
- higherpurpose 12y ago
  So why not blame the "obnoxious people" in this case, too? It's like the patent system abusers (which perhaps not by coincidence, Microsoft is one, too) excuse: "don't hate the player, hate the game". Yeah, right. Nobody held a gun to their head to do this. It was a premeditated action by Microsoft.
  - ggchappell 12y ago
    You are correct that Microsoft would deserve some of the blame, if there is to be blame. However, user pessimizer put it very well: > Microsoft has no obligation to you. Your judicial system does. In any case, there is no "hating the game" here. The fault -- if one has a problem with this action -- is not with "the system", but with a very specific player: the federal judge who issued the order. (I don't feel like going through the trouble of finding his/her name, but I doubt it would be difficult.)
- konstruktor 12y ago
  Independent of the ethics of this particular case, I don't think your argument makes sense: The filing was a necessary, while not sufficient, condition for this restraining order, so you can't deny responsibility by denying agency.
- yeukhon 12y ago
  > Good courts do not comply. Problem is, there is no good court. It's always vary case by case. Is the Supreme Court good court? It did rule in favor of gay married couples entitled to federal benefits but not so on some other issues. Laws are meant to be interpreted differently and handled differently by different judges at different time. What you (and I and everyone is doing) is expressing our own opinion of how the complaint should be handle based on our interpretation of the law, responsibility, and society.
randunel 12y ago
So when will Canonical file an ex-parte TRO against Microsoft for failing to secure Windows XP against malware? It would be nice to see a windows update which upgrades to linux :P Later edit: Isn't this ironic, how most botnet members are running Microsoft's software, yet they get to do this?
- mpyne 12y ago
  Creating the tools by which anyone might theoretically spawn abuse is not the same as proactively hosting those engaging in the same. E.g. one might reasonably disrupt a farmer's market known to be selling beef infected with salmonella without banning cows of the same breed across the world.
  - pbhjpbhj 12y ago
    Would you shut down the printing company that makes the flyers that tell people where the market is though? Oh, and hand over the presses to a local supermarket to keep printing the flyers but with the convert replacement of the address of the supermarket as the place to source your meat.
  - pling 12y ago
    Creating a faulty lock mechanism that can be circumvented by anyone, then putting a gate at the end of the street to stop people getting back to their own houses that are now full of crack dealers because of the faulty locks... Yep totally the same...
starik36 12y ago
I was affected. Even though I used NoIP's free service simply to get to my home network, I still can't get in. Thanks Microsoft.
wfjackson 12y ago
Interesting that the claim they didn't get any notice, this is what Microsoft has to say in their complaint. >...United States, including those located in the state of Nevada and the city of Las Vegas. Defendant has a contractual obligation to take reasonable and prompt steps to investigate and respond to reports of Internet or computer abuse, and the company has also made representations to the public that it has an “abuse team” to police and take action against such malicious activity. Yet Defèndant has failed to take sufficient action to stop, prevent, or effectively control this malicious conduct in breach of its contractual obligations and best practices of the industry, causing further harm to Nevada and Las Vegas residents.
- Mandatum 12y ago
  We assume that this is on-going (No-IP was the go-to since 2004) and Microsoft has finally decided they'd be able to take it over. Unfortunately they didn't plan enough to anticipate the amount of traffic they'd receive. If I was No-IP, I'd be out for blood. Someone sends a court order to essentially handicap your business, putting it at risk for the sake of malevolent users. This was a situation where No-IP's "resolution" process should have been reported (ie they cater to criminals for profit), and not man-handled by a separate law and business body.
  - wfjackson 12y ago
    >Someone sends a court order to essentially handicap your business, putting it at risk for the sake of malevolent users. "Someone" in this is case is a federal district court which did that because there was no communication from No-IP. MS does not have the power to send court orders. The court ordered No-IP to send a response and looks like there was no response. >If I was No-IP, I'd be out for blood. Who's blood?
    - Mandatum 12y ago
      Sorry I worded that incorrectly. Someone requests for a court order to essentially handicap your business. It's not that No-IP didn't respond, it's that they don't continuously respond. Arguably No-IP does cater for these types of users who pay using gift cards bought with cash and generally only last a few weeks before signing up under another alias..
legutierr 12y ago
What I don't understand is the legal basis of Microsoft, a private entity, simply being handed over the property (the domain names) of another private entity. I understand that this is something that was ordered by a court, but under what legal theory was the order issued? I'm not a lawyer, but I think I've got at least a basic idea of the circumstances under which the government can take someone's property. This doesn't seem to coincide with any of those potential circumstances, especially when the seizure transfers the property to another non-governmental entity. What's more, where's the due process? No-IP seems to be saying that they didn't even know about the court case until being served with the order. Did they really not have the opportunity to contest this? EDIT: To summarize some of the documents people have linked to and analyzed below, it looks like Microsoft was granted a temporary restraining order under "Federal Rule of Civil Procedure 65(b)", which allows for such orders to be granted without providing notice as long as certain requirements are met. Microsoft was required to post a $200,000.00 bond, which is supposed to pay for any damages incurred by No-IP, and No-IP will be granted the ability to contest the order in court on July 10, and maybe earlier. However, it is clear that No-IP knew nothing about even the lawsuit until they lost control of their domains, as this was specifically ordered by the court. Also, there is no answer as to whether transferring control over domain names from a defendant to a plaintiff is something that courts should be empowered to do as part of a temporary restraining order. I hope a lawyer with some knowledge in this area can chime in to answer that question.
- jevinskie 12y ago
  I don't think they had any opportunity to contest. IT IS FURTHER ORDERED that the Registry Operators must: ... d. Shall completely refrain from providing any notice or warning to, or communicating in any way with Defendants or Defendants’ representatives and shall refrain from publicizing this Order until this Order is executed in full, except as necessary to propagate the changes ordered herein to all parts of the Domain Name System; http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order%20-%20flattened.pdf http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order... I haven't yet found Microsoft's justification for the seizure without notice.
  - 12y ago
secalex 12y ago
The Microsoft hate here is unfounded and ill informed. Those of us working defense at large organizations have known for a while that No-IP domains are wretched hives of scum and villainy. Any company with a threat model that includes at least one of a diverse set of characters ranging from malware authors to organized crime to nation state teams should be logging all DNS requests and treating any request to a No-IP domain as an indicator of compromise. Microsoft has a successful history of disrupting botnet C&C and distribution channels via domain seizures, which is why this request probably sailed through Federal Court. The only difference in this situation is that there are innocent bystanders affected, which generally doesn't happen since the other domains they have seized have been 100% used for fraud. I feel bad for those folks and the people at No-IP who maybe meant well, but the truth is that the fight to keep normal people safe is bigger than just technological, and needs to include civil legal actions like this.
- pbhjpbhj 12y ago
  >No-IP domains are wretched hives of scum and villainy // Is that rather like saying "Bing domains are full of malware". You appear to be claiming that No-IP are complicit in the actual hosting of content that gets pointed to with No-IP domains. MS facilitates a ton of illegal activity, I could spin up a Windows box and break 5 laws before bedtime. Of course shutting down MS would harm some innocent bystanders but handing their windowsupdate domains over to Google will lead to less malware, less spam, less successful scamming.
- liquidise 12y ago
  You seem to miss a key takeaway from this: the analogous comparisons to this in physical services companies is laughable: If, as a car company, i sell cars with potentially lethal flaws, i am required/told to recall and fix those vehicles. Other companies who sell cars are NOT allowed to have a court order the seizure of my phone numbers and have them direct to competitive business, so they can figure out who is driving safe cars and who isn't. Secondly, the idea that private companies can be labeled "wretched hives of scum and villainy" by other private employees and have that permissible as anything other than meaningless hearsay is itself, nonsense. I have read many documents on this today and every HN comment and I have yet to find someone present a case as to why on earth this is a good and sustainable precedent.
davidbanham 12y ago
If anyone needs a replacement for no-ip, I wrote this the other day: https://github.com/davidbanham/cloudflare_dyndns https://github.com/davidbanham/cloudflare_dyndns
- stevekemp 12y ago
  And I recently setup http://dhcp.io/ http://dhcp.io/ - source also on github.
  - andor 12y ago
    Nice! Simple HTTP API, no custom client needed, very easy to include in scripts. Is there any reason why you're not serving via HTTPS? Without encryption, credentials are completely open to the network.
    - stevekemp 12y ago
      Largely because this is a toy-project which has no income behind it. (It was initially going to be commercialized, but in the end I found people pretended they'd pay, rather than actually wanted to do so for extras like more hostnames, MX records, etc. So in the end I went with a different project https://dns-api.com/ https://dns-api.com/) I could pretend I regard DNS data as public, but sniffing the update token could allow malicious users to change things in surprising fashions so it really does deserve SSL, but I'm not going to pay for it. I would hope that if users cared about security they'd deploy their own instance - and pay for the resulting Amazon traffic.
vzhang 12y ago
If I keep getting spam emails from a Hotmail account, should I file a motion to take down the whole Hotmail domain?
- McGuffin 12y ago
  Sure, you could do that. Personally, I have always had a reply from their abuse department within the hour (usually it's solved by then, too). But indeed, if you feel you have sufficient evidence that MSFT is downright neglectful and turning a blind eye to spam accounts, feel free to file a motion and post a $200k+ bond.

224 points by wfjackson 12y ago

They also deny Cisco's allegations here. http://www.noip.com/blog/2014/02/12/cisco-malware-report/ http://www.noip.com/blog/2014/02/12/cisco-malware-report/ It doesn't compute that Cisco is casting blame on them and Microsoft got a court order when all they had to do is send an email. It's kind of strange, they're probably unable to keep up with the abuse reports and validating them or something. There are a lot of dynamic DNS providers so why do the bad guys pick them for the most part for their DNS needs?

Omniusaspirer 12y ago
Presumably because they have a free basic service if you use one of their subdomains. While other companies I'm not aware of might offer the same I've yet to stumble across them.
- shawnz 12y ago
  DynDNS and afraid, which as far as I know are the next two most popular services like this, both have free options. EDIT: Looks like DynDNS recently got rid of their free offering. I wonder if that was related to this?
  - LukeShu 12y ago
    DynDNS dropped their free offering a couple of years ago. If you had created your account before then, you were grandfathered in, and still got 5(?) domains for free; as long as you logged in frequently enough.
    - krallja 12y ago
      Dyn permanently ended its free hostname program in May 2014, with 30-day notice given on April 7. http://dyn.com/blog/why-we-decided-to-stop-offering-free-accounts/ http://dyn.com/blog/why-we-decided-to-stop-offering-free-acc...
  - Fuxy 12y ago
    Also they wouldn't be able to go against afraid since it's fundamentally a different type of service. It offers a DNS service for your domain and the ability to share your domain with others. You can't seize the 100.000 domains being shared and used by bot nets so the only easy target was no-ip. What i find extremely troubling is the domains being handed over to another corporate entity this mechanism is just ripe for abuse.
- stevekemp 12y ago
  http://dhcp.io/ http://dhcp.io/ is (my) new service, launched only recently. Mine doesn't use the same dyn update API, just curl, and you can self-host if you have an Amazon Route53 account.
vacri 12y ago
The press release smells to me like they're playing the innocent, and are savvy to the kind of language their audience likes. "We were very surprised this morning"... "Had Microsoft contacted us, we could and would have taken immediate action."? Surely at some point legal proceedings would have initiated some contact?
- nitrogen 12y ago
  This comment (and its siblings in the thread) suggest that Microsoft got this order without prior notification to NoIP: https://news.ycombinator.com/item?id=7968762 https://news.ycombinator.com/item?id=7968762

jpgvm 12y ago

This smells like BS, this also isn't the first time that other entities have had to step in to cleanup their crap. Especially this quote: "Apparently, the Microsoft infrastructure is not able to handle the billions of queries from our customers." Azure DNS, Microsoft.com, Bing. Yeah, all of those already require billions of DNS queries. I don't doubt things are not working correctly, but insinuating Microsoft can't handle the load just makes their case smell even worse.

norswap 12y ago
I think what is insinuated is that they botched the job, not that they're not technically capable of doing it.
- jpgvm 12y ago
  I can agree with the fact they probably botched it (potentially on purpose), but the way it's articulated in the No-IP reply leaves little ambiguity that it was intended as an attack on their technical capability. I am not in love with what Microsoft did here but No-IP is not doing the best job of defending their position.
hrrsn 12y ago
Not really. It looks like these domains are hosted on a different platform. $ host ns1.microsoftinternetsafety.net ns1.microsoftinternetsafety.net has address 199.2.137.250 $ host ns1.msft.net ns1.msft.net has address 65.55.37.62 ns1.msft.net has IPv6 address 2a01:111:2005::1:1 $
mb0 12y ago
Try and query anything.no-ip.biz. At the moment, I'm getting regular timeouts on queries to both ns7.microsoftinternetsafety.net and ns8.microsoftinternetsafety.net. It shouldn't take much for microsoft to log all incoming dns requests and put in an NS record to let traffic continue flowing down to no-ip's actual nameservers. A simple `dig whatever.no-ip.biz @a.root-servers.net +trace` will show you this.
chmars 12y ago

norswap 12y ago

Wait, how can a company seize the domains of another?

rdl 12y ago
I agree, it's a bit troublesome that one private company can do this to another, vs. the government doing so.
- ggchappell 12y ago
  It is the government. Specifically, the order was issued (it appears) by the U.S. District Court of Nevada. See also my root-level comment: https://news.ycombinator.com/item?id=7968365 https://news.ycombinator.com/item?id=7968365
nimish 12y ago
By convincing a judge that it was necessary? Actual detail here: http://www.noticeoflawsuit.com/index.htm http://www.noticeoflawsuit.com/index.htm
- jevinskie 12y ago
  The legal team got a domain just for the notice?
notsoMicrosoft 12y ago
This is America. With enough money, you can do whatever you want.
- threeseed 12y ago
  You can see it that way. Others will see it as Microsoft proactively removing bots and spam.
  - notsoMicrosoft 12y ago
    It is the FBI's job to enforce cyber criminal law and execute takedowns of malicious domains. Not Microsoft's[or any other NGO].

ddod 12y ago

The comments here are surprisingly pro-Microsoft. I'd personally rather deal with spam and botnets over a corporation legally being able to take over the DNS of other companies due to the actions of users of a service. Despite pretty clear slippery-slope arguments, I recognize this isn't a universal opinion. There are many people who would like to curb cyber-bullying at the expense of freedom of speech or curb terrorism at the expense of privacy and civil liberties. It takes all kinds, I guess.

jpgvm 12y ago
I don't agree with the precedent set here but it does seem No-IP was doing a pretty bad job of responding to mass abuse. While I do take issue to the actions of Microsoft and the courts I also think No-IP hasn't done themselves any favours and are at least partially to blame for this coming to pass. It stands to reason that it's close to impossible to create a free service that is impervious to abuse however it's still their responsibility to avoid mass abuse of their platform to orchestrate botnets.
- ddod 12y ago
  That responsibility is not absolute, and could be interpreted differently in the frameworks of ethicality, legality, economics, and liberty. Ethically, I think you're correct that it's their responsibility to do what they can. Legally, the court in this situation thought it was somehow Microsoft's responsibility to fix it. Economically, I'd say being held liable to what users do on your platform will hurt innovation and competition. In terms of liberty, botnets and spam don't seem like they compare to an attack on someone's business, their users, and their freedom to operate independently. I guess you can choose which perspective makes the most sense to you, personally.
  - threeseed 12y ago
    You believe in terms of liberty that botnets who compromise machines in order to steal data, spam and many other nefarious activities doesn't compare to one business being temporarily affected ? That is a strange perspective I have to say.

ggchappell 12y ago

If this action is troubling, then we need to stop putting the blame in the wrong place. Microsoft does not have the power to seize domains. A federal court order made that happen. This order is (apparently) the responsibility of the U.S. District Court of Nevada. If you want to blame someone, then blame the court. Obnoxious people ask courts to do obnoxious things every day. Good courts do not comply.

higherpurpose 12y ago
So why not blame the "obnoxious people" in this case, too? It's like the patent system abusers (which perhaps not by coincidence, Microsoft is one, too) excuse: "don't hate the player, hate the game". Yeah, right. Nobody held a gun to their head to do this. It was a premeditated action by Microsoft.
- ggchappell 12y ago
  You are correct that Microsoft would deserve some of the blame, if there is to be blame. However, user pessimizer put it very well: > Microsoft has no obligation to you. Your judicial system does. In any case, there is no "hating the game" here. The fault -- if one has a problem with this action -- is not with "the system", but with a very specific player: the federal judge who issued the order. (I don't feel like going through the trouble of finding his/her name, but I doubt it would be difficult.)
konstruktor 12y ago
Independent of the ethics of this particular case, I don't think your argument makes sense: The filing was a necessary, while not sufficient, condition for this restraining order, so you can't deny responsibility by denying agency.
yeukhon 12y ago
> Good courts do not comply. Problem is, there is no good court. It's always vary case by case. Is the Supreme Court good court? It did rule in favor of gay married couples entitled to federal benefits but not so on some other issues. Laws are meant to be interpreted differently and handled differently by different judges at different time. What you (and I and everyone is doing) is expressing our own opinion of how the complaint should be handle based on our interpretation of the law, responsibility, and society.

randunel 12y ago

So when will Canonical file an ex-parte TRO against Microsoft for failing to secure Windows XP against malware? It would be nice to see a windows update which upgrades to linux :P Later edit: Isn't this ironic, how most botnet members are running Microsoft's software, yet they get to do this?

mpyne 12y ago
Creating the tools by which anyone might theoretically spawn abuse is not the same as proactively hosting those engaging in the same. E.g. one might reasonably disrupt a farmer's market known to be selling beef infected with salmonella without banning cows of the same breed across the world.
- pbhjpbhj 12y ago
  Would you shut down the printing company that makes the flyers that tell people where the market is though? Oh, and hand over the presses to a local supermarket to keep printing the flyers but with the convert replacement of the address of the supermarket as the place to source your meat.
- pling 12y ago
  Creating a faulty lock mechanism that can be circumvented by anyone, then putting a gate at the end of the street to stop people getting back to their own houses that are now full of crack dealers because of the faulty locks... Yep totally the same...

starik36 12y ago

I was affected. Even though I used NoIP's free service simply to get to my home network, I still can't get in. Thanks Microsoft.

wfjackson 12y ago

Interesting that the claim they didn't get any notice, this is what Microsoft has to say in their complaint. >...United States, including those located in the state of Nevada and the city of Las Vegas. Defendant has a contractual obligation to take reasonable and prompt steps to investigate and respond to reports of Internet or computer abuse, and the company has also made representations to the public that it has an “abuse team” to police and take action against such malicious activity. Yet Defèndant has failed to take sufficient action to stop, prevent, or effectively control this malicious conduct in breach of its contractual obligations and best practices of the industry, causing further harm to Nevada and Las Vegas residents.

Mandatum 12y ago
We assume that this is on-going (No-IP was the go-to since 2004) and Microsoft has finally decided they'd be able to take it over. Unfortunately they didn't plan enough to anticipate the amount of traffic they'd receive. If I was No-IP, I'd be out for blood. Someone sends a court order to essentially handicap your business, putting it at risk for the sake of malevolent users. This was a situation where No-IP's "resolution" process should have been reported (ie they cater to criminals for profit), and not man-handled by a separate law and business body.
- wfjackson 12y ago
  >Someone sends a court order to essentially handicap your business, putting it at risk for the sake of malevolent users. "Someone" in this is case is a federal district court which did that because there was no communication from No-IP. MS does not have the power to send court orders. The court ordered No-IP to send a response and looks like there was no response. >If I was No-IP, I'd be out for blood. Who's blood?
  - Mandatum 12y ago
    Sorry I worded that incorrectly. Someone requests for a court order to essentially handicap your business. It's not that No-IP didn't respond, it's that they don't continuously respond. Arguably No-IP does cater for these types of users who pay using gift cards bought with cash and generally only last a few weeks before signing up under another alias..

legutierr 12y ago

What I don't understand is the legal basis of Microsoft, a private entity, simply being handed over the property (the domain names) of another private entity. I understand that this is something that was ordered by a court, but under what legal theory was the order issued? I'm not a lawyer, but I think I've got at least a basic idea of the circumstances under which the government can take someone's property. This doesn't seem to coincide with any of those potential circumstances, especially when the seizure transfers the property to another non-governmental entity. What's more, where's the due process? No-IP seems to be saying that they didn't even know about the court case until being served with the order. Did they really not have the opportunity to contest this? EDIT: To summarize some of the documents people have linked to and analyzed below, it looks like Microsoft was granted a temporary restraining order under "Federal Rule of Civil Procedure 65(b)", which allows for such orders to be granted without providing notice as long as certain requirements are met. Microsoft was required to post a $200,000.00 bond, which is supposed to pay for any damages incurred by No-IP, and No-IP will be granted the ability to contest the order in court on July 10, and maybe earlier. However, it is clear that No-IP knew nothing about even the lawsuit until they lost control of their domains, as this was specifically ordered by the court. Also, there is no answer as to whether transferring control over domain names from a defendant to a plaintiff is something that courts should be empowered to do as part of a temporary restraining order. I hope a lawyer with some knowledge in this area can chime in to answer that question.

jevinskie 12y ago
I don't think they had any opportunity to contest. IT IS FURTHER ORDERED that the Registry Operators must: ... d. Shall completely refrain from providing any notice or warning to, or communicating in any way with Defendants or Defendants’ representatives and shall refrain from publicizing this Order until this Order is executed in full, except as necessary to propagate the changes ordered herein to all parts of the Domain Name System; http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order%20-%20flattened.pdf http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order... I haven't yet found Microsoft's justification for the seizure without notice.
- 12y ago

secalex 12y ago

The Microsoft hate here is unfounded and ill informed. Those of us working defense at large organizations have known for a while that No-IP domains are wretched hives of scum and villainy. Any company with a threat model that includes at least one of a diverse set of characters ranging from malware authors to organized crime to nation state teams should be logging all DNS requests and treating any request to a No-IP domain as an indicator of compromise. Microsoft has a successful history of disrupting botnet C&C and distribution channels via domain seizures, which is why this request probably sailed through Federal Court. The only difference in this situation is that there are innocent bystanders affected, which generally doesn't happen since the other domains they have seized have been 100% used for fraud. I feel bad for those folks and the people at No-IP who maybe meant well, but the truth is that the fight to keep normal people safe is bigger than just technological, and needs to include civil legal actions like this.

pbhjpbhj 12y ago
>No-IP domains are wretched hives of scum and villainy // Is that rather like saying "Bing domains are full of malware". You appear to be claiming that No-IP are complicit in the actual hosting of content that gets pointed to with No-IP domains. MS facilitates a ton of illegal activity, I could spin up a Windows box and break 5 laws before bedtime. Of course shutting down MS would harm some innocent bystanders but handing their windowsupdate domains over to Google will lead to less malware, less spam, less successful scamming.
liquidise 12y ago
You seem to miss a key takeaway from this: the analogous comparisons to this in physical services companies is laughable: If, as a car company, i sell cars with potentially lethal flaws, i am required/told to recall and fix those vehicles. Other companies who sell cars are NOT allowed to have a court order the seizure of my phone numbers and have them direct to competitive business, so they can figure out who is driving safe cars and who isn't. Secondly, the idea that private companies can be labeled "wretched hives of scum and villainy" by other private employees and have that permissible as anything other than meaningless hearsay is itself, nonsense. I have read many documents on this today and every HN comment and I have yet to find someone present a case as to why on earth this is a good and sustainable precedent.

davidbanham 12y ago

If anyone needs a replacement for no-ip, I wrote this the other day: https://github.com/davidbanham/cloudflare_dyndns https://github.com/davidbanham/cloudflare_dyndns

stevekemp 12y ago
And I recently setup http://dhcp.io/ http://dhcp.io/ - source also on github.
- andor 12y ago
  Nice! Simple HTTP API, no custom client needed, very easy to include in scripts. Is there any reason why you're not serving via HTTPS? Without encryption, credentials are completely open to the network.
  - stevekemp 12y ago
    Largely because this is a toy-project which has no income behind it. (It was initially going to be commercialized, but in the end I found people pretended they'd pay, rather than actually wanted to do so for extras like more hostnames, MX records, etc. So in the end I went with a different project https://dns-api.com/ https://dns-api.com/) I could pretend I regard DNS data as public, but sniffing the update token could allow malicious users to change things in surprising fashions so it really does deserve SSL, but I'm not going to pay for it. I would hope that if users cared about security they'd deploy their own instance - and pay for the resulting Amazon traffic.

vzhang 12y ago

If I keep getting spam emails from a Hotmail account, should I file a motion to take down the whole Hotmail domain?

McGuffin 12y ago
Sure, you could do that. Personally, I have always had a reply from their abuse department within the hour (usually it's solved by then, too). But indeed, if you feel you have sufficient evidence that MSFT is downright neglectful and turning a blind eye to spam accounts, feel free to file a motion and post a $200k+ bond.