The forum post referenced in the email was posted on March 14th, meaning that this has been going on for awhile. Have they done anything in the meantime to impr

The forum post referenced in the email was posted on March 14th, meaning that this has been going on for awhile. Have they done anything in the meantime to improve the usability of this or present DNSSEC enabled services that do not have this man in the middle action going on? Done right this can be a really good service- malware that takes advantage of cutting edge exploits (combined with computers that get updated slowly if at all) can be hard to block if it isn't being cut off at it's source, and a company proactively protecting their customers can be a very good thing. However, to do that right requires a few important steps- 1. Notifying the customer of what is happening. This is a huge fail since they give their customers no notice of what company is actually doing it. 2. Instructions to report false positives. They're not even saying who they are, so there's clearly no easy way to report false positives. 3. A commitment to only blocking active exploits. They shouldn't be censors, they should only be blocking things that can actually cause damage. The fact that they're blocking political and financial sites due to social engineering is clearly problematic. 4. Finally, they should add a way to get around the block. This is unfortunately a difficult thing to do with DNS based blocking and I'd be willing to cut them some slack on this if they could make up for it by rigid standards of damage and a fast false positive response. When my team managed the blocklist that mbam uses we had to deal with this kind of stuff, but overall it worked really well and as time went on more features were added to the product to make sure customers had control. This type of service can be done right, but when it's not I feel it can do far more harm than good as people abandon security because of the perceived inconvenience that's really just a shitty product.