I fought my ISP's bad behavior and won • Hacker News Board

Re: I fought my ISP's bad behavior and won

#11

Post by lambda » Tue, Dec 31, 2013, 10:19 PM UTC

  This also shows a weakness in DNS. There is currently no 
  way to validate the DNS record you’re being served is what 
  the person hosting the website intended.

That's what DNSSEC is for, but it hasn't become pervasive enough yet to be able to depend on it.

Re: I fought my ISP's bad behavior and won

#12

Post by helfire » Tue, Dec 31, 2013, 10:20 PM UTC

philip1209 wrote: post #10

This is why you should encrypt your DNS.

Do you have a link to a usable encrypted DNS solution? I searched but didn't find anything actively used, but a lot of proposals.

Re: I fought my ISP's bad behavior and won

#13

Post by rcfox » Tue, Dec 31, 2013, 10:22 PM UTC

One a slightly related note, in Chrome extensions, it's possible to redirect DNS requests on a per-URL basis. This is how Media Hint works to allow non-US Netflix users access the US version of the site.

I'm surprised we haven't seen similar behaviour from Chrome extensions. I'm sure it would be caught eventually, but this isn't exactly something that people tend to look for, so it would take a while for people to catch it.

Re: I fought my ISP's bad behavior and won

#14

Post by rcfox » Tue, Dec 31, 2013, 10:24 PM UTC

philip1209 wrote: post #10

This is why you should encrypt your DNS.

Could you elaborate on this? How would encryption help? The DNS server would need to decrypt the request in order to service it.

Re: I fought my ISP's bad behavior and won

#15

Post by rwg » Tue, Dec 31, 2013, 10:30 PM UTC

lambda wrote: post #11

This also shows a weakness in DNS. There is currently no way to validate the DNS record you’re being served is what the person hosting the website intended. That's what DNSSEC is for, but it hasn't become pervasive enough yet to be able to depend on it.

Strangely enough, the largest deployment of DNSSEC-enabled, customer-facing, recursive/caching nameservers in the United States is... Comcast. That's right, the same Comcast that, back in 2009, hijacked NXDOMAIN responses by default and returned A records pointing to servers that served up advertisement-laden search pages over http.

Re: I fought my ISP's bad behavior and won

#16

Post by ozh » Tue, Dec 31, 2013, 10:31 PM UTC

+1 to OP, and +2 to companies who responded positively (and -3 to ISP, obviously)

Re: I fought my ISP's bad behavior and won

#17

Post by jasoncartwright » Tue, Dec 31, 2013, 10:34 PM UTC

rwg wrote: post #15

lambda wrote: post #11

This also shows a weakness in DNS. There is currently no way to validate the DNS record you’re being served is what the person hosting the website intended. That's what DNSSEC is for, but it hasn't become pervasive enough yet to be able to depend on it.

Strangely enough, the largest deployment of DNSSEC-enabled, customer-facing, recursive/caching nameservers in the United States is... Comcast. That's right, the same Comcast that, back in 2009, hijacked NXDOMAIN responses by default and returned A records pointing to servers that served up advertisement-laden search pages over http.

I was also impressed to see that my Comcast connection uses IPv6. Turns out they have (or will have) one of the the largest IPv6 network in the world - http://gigaom.com/2013/11/27/comcast-xfinity-broadband-is-no...

Re: I fought my ISP's bad behavior and won

#18

Post by dmourati » Tue, Dec 31, 2013, 10:37 PM UTC

Super shady stuff. I never rely on any ISP provided DNS servers. I'm glad you talked to the the etailers to let them know what was going on. These business practices do introduce latency, regardless of what he told you. Not to mention, they are highly unethical and dishonest.

Re: I fought my ISP's bad behavior and won

#19

Post by sloop » Tue, Dec 31, 2013, 10:38 PM UTC

If your ISP and/or Aspira were making any significant amount of affiliate commissions, I would be surprised if the merchants do not take action against them for fraud.

This sounds like the same behaviour that Shawn Hogan got in trouble for with cookie stuffing http://en.wikipedia.org/wiki/Shawn_Hogan

Re: I fought my ISP's bad behavior and won

#20

Post by X-Istence » Tue, Dec 31, 2013, 10:39 PM UTC

jasoncartwright wrote: post #17

rwg wrote: post #15

Earlier quoted context omitted.

Strangely enough, the largest deployment of DNSSEC-enabled, customer-facing, recursive/caching nameservers in the United States is... Comcast. That's right, the same Comcast that, back in 2009, hijacked NXDOMAIN responses by default and returned A records pointing to servers that served up advertisement-laden search pages over http.

I was also impressed to see that my Comcast connection uses IPv6. Turns out they have (or will have) one of the the largest IPv6 network in the world - http://gigaom.com/2013/11/27/comcast-xfinity-broadband-is-no...

Comcast's IPv6 network for content from Netflix or YouTube is actually better than using IPv4. A while back I set up an IPv6 only machine just to see the difference, and it is night and day.

That being said, their network still leaves something to be desired, the IPv6 routes taken to get to the same IPv6/IPv4 host can sometimes be circuitous and I have noticed that they have a higher latency too. So there are upsides and downsides, but I hope it can only get better with time!