Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

Post reply on HN
Print view View original

691–700 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#691

Post by corobo »

conatico wrote: post #408
davidu wrote: post #255

Earlier quoted context omitted.

OpenDNS does this: https://support.opendns.com/hc/en-us/articles/227987767-Dyna... It's called SmartCache.

A shame OpenDNS used to redirect me to some spam webpage every time I tried to resolve a domain that didn't exist--they earned a spot on my black list forever. :(

This attitude only promotes the idea that "well we might as well just continue like this then". If you can never forgive a company for doing wrong when they've corrected themselves years ago and now have a track record of doing nothing else that's irked you then what's the point in them ever bothering to make the change?

If what they do is useful to you but have a feature or bug or something else you don't like then you absolutely should forgive them if they then fix that feature or bug to work in a way you like. They may as well never bother fixing things if they can never be forgiven after repenting their internet sins.

If you've since found something that does do what you want then fair play, fill your boots. Otherwise you're being petty for the sake of being petty.

Re: DDoS Attack Against Dyn Managed DNS

#692

Post by oneeyedpigeon »

Zancarius wrote: post #252
omni wrote: post #202

Earlier quoted context omitted.

> wouldn't hesitate to take down dns to the entire internet to avoid another similar data leak to the Snowden dump. I don't understand how this would change anything unless you're assuming they would take down the Internet permanently

I'm probably wrong, but this is how I see it (not sure about the OP). News cycles happen fairly rapidly, so if you could take down a number of sites that might be friendly to the dissemination of potentially damaging information just long enough such that it's forgotten about, or the attack is so large the media talks about the attack instead, then you might be able to successfully avoid widespread public knowledge o…

What kind of information would be so sensitive as to risk crashing the economy over, yet so trivial that people would forget about it because they couldn't access Twitter for a day? I get that it's more nuanced than that, but I'm really struggling with this scenario; sensitive information tends to get out if it's important enough, even if you're willing to kill a bunch of people.

Re: DDoS Attack Against Dyn Managed DNS

#693

Post by conatico »

corobo wrote: post #691
conatico wrote: post #408

Earlier quoted context omitted.

A shame OpenDNS used to redirect me to some spam webpage every time I tried to resolve a domain that didn't exist--they earned a spot on my black list forever. :(

This attitude only promotes the idea that "well we might as well just continue like this then". If you can never forgive a company for doing wrong when they've corrected themselves years ago and now have a track record of doing nothing else that's irked you then what's the point in them ever bothering to make the change? If what they do is useful to you but have a feature or bug or something else you don't like then…

I remember trying OpenDNS in 2008 and seeing that, and yes, I found it such a shady tactic that, taking into account Google DNS exists, I will probably never give a second chance to OpenDNS.

Re: DDoS Attack Against Dyn Managed DNS

#695

Post by oneeyedpigeon »

masukomi wrote: post #94
toxican wrote: post #47

Earlier quoted context omitted.

Because America is an Orwellian hellhole, gawd, haven't you read animal house 84?!

um. if you are basing your logic on orwelianness then the England should be your your top candidate. massive monitoring of the populace, severe restrictions on the ability to carry anything that is vaguely pointy or goes bang, poor freedom of speech rules (relative to the US).... I love England but as far as orwellian societies go, you can do notably worse than the US.

As someone living in England, I can confirm that a) we are an extreme surveillance society, which the general population neither really understands, nor cares about b) the vast majority of us are very grateful we don't have (legalised) guns on the streets, and we suffer from a much lower homicide rate as a result

Re: DDoS Attack Against Dyn Managed DNS

#696

Post by davidu »

nly wrote: post #651
davidu wrote: post #566

Earlier quoted context omitted.

It's been years since we did that, and they were not spam pages, and easily able to opt-out.

Well, the fact that people still remember goes to show what a truly terrible idea it really was and that it probably did permanent damage to your brand.

I'm not sure what metric you use to judge it as terrible.

I thought it was great. 10,000 companies pay for my service today. 65 million people use my infrastructure today. Cisco bought the company for more than $650m. It continues to innovate on the decades old DNS in secure and useful ways.

So let me know what part is terrible.

Re: DDoS Attack Against Dyn Managed DNS

#697

Post by deno »

drinchev wrote: post #303
bhauer wrote: post #243

Earlier quoted context omitted.

I'm not sure I understand what you're saying. The scenario is that my local network's caching DNS resolver retains resolutions beyond the authority-provided TTL in the event that a TTL-specified refresh at expiration fails. Therefore, my web browser may—in the very rare situation where this arises—make an HTTP request to an IP address of a server that has been intentionally moved by a service provider (let's assume t…

I think you understood me. Maybe I can explain more. If you have a service `log.io` with it's own DNS servers ( running named or djbdns ). And one day you decide to shut them down and rename the service to `loggy.io`. What will happen is that any DNS trying to query the `log.io` DNS will reach unreachable server, which will lead to serving the last-known IP from the proposed DNS Cache on your machine. If you don't us…

This is the equivalent of retiring the domain name itself. If you stop renewing it anyone can hijack it and serve whatever they like. Not to forget, they will also get email intended for that domain.

Anyone sane will keep the domain name and ns infrastructure and serve a 301 HTTP redirect.

All anyone is proposing here is to override the TTL to something longer (like 48h) if the nameserver is unreachable.

Of course the perfect solution would be to have the recursive nameserver fetch the correct record from a blockchain.

Re: DDoS Attack Against Dyn Managed DNS

#698

Post by Damogran6 »

imglorp wrote: post #304
bhauer wrote: post #272

Earlier quoted context omitted.

Awesome! Is this available as software I can install on my network? Sorry, probably a dumb question.

Nope, just point your machine or router's DNS to use opendns resolvers instead of your regular ones: 208.67.222.222 and 208.67.220.220

Be aware that some things (Netflix, Comcast, Youtube) expect you to use your local DNS server so that they can route you to the nearest media server. Using a central IP Address like what is mentioned here can result in unsatisfactory video streaming....at least that's what I found with our Apple TV.

Re: DDoS Attack Against Dyn Managed DNS

#699

Post by zhengyi13 »

davidu wrote: post #696
nly wrote: post #651

Earlier quoted context omitted.

Well, the fact that people still remember goes to show what a truly terrible idea it really was and that it probably did permanent damage to your brand.

I'm not sure what metric you use to judge it as terrible. I thought it was great. 10,000 companies pay for my service today. 65 million people use my infrastructure today. Cisco bought the company for more than $650m. It continues to innovate on the decades old DNS in secure and useful ways. So let me know what part is terrible.

The part where you repeated Verisign's mistake in breaking a fundamental protocol.

NXDOMAIN. Kind of a thing, and important to protocols other than HTTP.

Re: DDoS Attack Against Dyn Managed DNS

#700

Post by SquareWheel »

scoot wrote: post #689
Xorlev wrote: post #645

Earlier quoted context omitted.

They stopped that. https://www.opendns.com/no-more-ads/

That's good to know - the ads are the reason I reluctantly switched from OpenDNS to google. (Reluctantly in that Google already has enough of my data, thanks, through gmail, search, maps, docs and other services, not because it doesn't work well.)

Google DNS doesn't store any identifiable/private data, as far as I understand?

https://developers.google.com/speed/public-dns/privacy

Post reply on HN