411–420 of 721 posts
Earlier quoted context omitted.
Awesome! Is this available as software I can install on my network? Sorry, probably a dumb question.
Nope, just point your machine or router's DNS to use opendns resolvers instead of your regular ones: 208.67.222.222 and 208.67.220.220
Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a la…
I can guarantee you that popular DNS resolvers (think 500b+ transactions a day) do have this feature! Don't want to say much more due to it being my job, and I don't want to give away too much. EDIT: https://www.google.com/patents/US8583801
In addition you can reach out to our customer support team at support@pagerduty.com or +1 (844) 700-3889.
Tim Armandpour, SVP of Product Development, PagerDuty
Earlier quoted context omitted.
No. What we need are new techniques for creating back-pressure to all the routers which are forwarding on this type of attack. The issue is that our Routing technology does not give downstream nodes any way to push back on the flood of packets. Cisco could step up to the plate here. And no, I'm not talking about firewalls. We need newer ICMP type packets to create this back-pressure, so that we can stop floods like t…
It looks like we used to have something similar but it got deprecated. https://tools.ietf.org/html/rfc6633
Relevant (or at least a-propos) post by Bruce Schneier, from a month ago: "Someone Is Learning How to Take Down the Internet" https://www.schneier.com/blog/archives/2016/09/someone_is_le... Edit: And to be clear: I don't mean to imply there's any connection :)
prediction: in some time they will probe Google. That will be fascinating.
Earlier quoted context omitted.
You seem to be continuing to warn against a proposal that isn't the one that was made. What specifically is dangerous about using cached records only in the case of the upstream servers failing to reply?
It doesn't take much of an imagination to attack this. The older I get in tech the more I realize we just go in circles re-implementing every bad idea over again for the same exact reasons each "generation". Ah well. TTL is TTL for a reason. It's simple. The publisher is in control, they set their TTL for 60 seconds so obviously they have robust DNS infrastructure they are confident in. They are also signaling with s…
Here's the attack:
- Compromise IP (maybe facebook.com)
- DDoS nameservers
- facebook removes IP from rotation
- Users still connect to bad actor even though TTL expired
"We have standards for a reason" is absolutely correct, and we can't start ignoring the standards because someone can't imagine why we need them _at this moment_
Relevant (or at least a-propos) post by Bruce Schneier, from a month ago: "Someone Is Learning How to Take Down the Internet" https://www.schneier.com/blog/archives/2016/09/someone_is_le... Edit: And to be clear: I don't mean to imply there's any connection :)
Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…
Thank you for these links. I'm trying not to get wrapped up in conspiracies but am increasingly worried by the mounting conflict. I'd love to hear a calm, reasoned response from someone more knowledgable than me on these topics.
Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a la…
I can guarantee you that popular DNS resolvers (think 500b+ transactions a day) do have this feature! Don't want to say much more due to it being my job, and I don't want to give away too much. EDIT: https://www.google.com/patents/US8583801
Earlier quoted context omitted.
I'm seeing "connection timed out; no servers could be reached". Anyone else seeing that when trying to run the above command?
did you switch your computer's dns servers to openDNS? 208.67.222.222 208.67.220.220 (or specify dns server in the command)
; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION: ;.herokussl.com. IN CNAME
;; Query time: 1226 msec ;; SERVER: #53() ;; WHEN: Fri Oct 21 12:27:55 2016 ;; MSG SIZE rcvd: 44
Earlier quoted context omitted.
> i seem to remember that dns has generally been reliable (until recently, i guess) Probably because people used to use long TTLs (1 hour, 4 hours, whatever) and now the default behavior in services like Amazon Route 53 is to use 5 minutes.
Try Akamai managed CDN content. 20 seconds !!