David, I have no gripe with OpenDNS and I have been an
OpenDNS.org user for the last 2 years. HOWEVER, you cannot say that you
do not log or sell user data “or anything like that”. OpenDNS
collects IP addresses according to their own privacy policy http://www.opendns.com/privacy/
which IMO is a fair exchange for the free DNS service. This is what your
privacy policy states: “For example, when a website visitor searches on
OpenDNS, the IP address and query are shared with OpenDNS's advertising
partners”. Again, I believe that is a fair exchange for free DNS
service and I choose to use the service, but other people may not choose the
service. But it is inaccurate to say that OpenDNS doesn’t log or
sell any user data.
George Ou
From:
nnsquad-bounces+george_ou=lanarchitect.net@nnsquad.org
[mailto:nnsquad-bounces+george_ou=lanarchitect.net@nnsquad.org] On Behalf Of
David Ulevitch
Sent: Friday, July 10, 2009 8:50 AM
To: David P. Reed
Cc: 'NNSquad'
Subject: [ NNSquad ] Re: Comcast files "recommended practices"
draft RFC with IETF for DNS Redirection
Despite what appears to be a troll, I'll reply:
1. We're the safest DNS option around. We're the only
DNS service in existence blocking the 0-day MS vulnerability ( http://voices.washingtonpost.com/securityfix/2009/07/microsoft_internet_explorer_ex.html?wprss=securityfix
) and we were the only DNS service that protected users with the Conficker A/B
worms from having their infected computers phone home the botnet C&C.
This is in addition to all the other security measures we've placed in
the DNS. It's also worth nothing that outside of DJBDNS (DNS software for
workstations) and PowerDNS (a niche DNS software) we were the only major DNS
provider on the entire Internet, including ALL major ISPs, that was never
vulnerable to the Kaminsky attack of last year. Unlike any other DNS
service or provider in the world, we let our users twiddle the knobs and
buttons to get the DNS experience they want. We don't log and sell their
data, or anything like that.
2. Of course people Opt-In to use OpenDNS. We
deliberately don't work with ISPs. I suggest you try us out for yourself
and see. Or if you're too lazy, just use google to see what folks say
about us. The benefit of having so many users is that a large percentage
of them blog and tweet about us. You'll see the positive reviews dramatically
outweigh the negative reviews.
As an aside, some of our users do turn of the nxdomain
redirection service, and still use us; and that's completely fine. It's
my goal to give users the ability to control their DNS experience as they see
fit. I'm not sure how you missed that as you seem like a fairly smart
dude.
But like I said at the top, I think this was a troll, so
this is my one and only "bite." :-)
On Jul 9, 2009, at 6:05 PM, David P. Reed wrote:
Mr.
Ulevitch - I suspect "spin":
1. Please explain the odd meaning of the word "safer" implied by your
statement. If the FTC were to explore whether there is a true
"safety" benefit for people, please explain the risk. implied by
getting an error message from a browser that the site named does not exist?
2. And for that matter, I am not aware of 12 million people opting
"in" to OpenDNS via a legally meaningful customer choice selection
where the "benefit" of having names resolved to non-existent sites is
explained. It would be misleading to make the statement you make below if
they were "slammed" by ISPs or other companies without their explicit
consent beforehand. Your case would be reasonable if indeed you have
records of 12 million individual names who will indeed agree that they chose to
use OpenDNS as a matter of free positive action. I doubt you can produce
an auditable list of such names that one can contact to verify your claim, but
feel free to produce one.
On 07/09/2009 07:12 PM, David Ulevitch wrote:
I can't speak for the ISPs motivations, but you're right
that they are probably driven by profits (though I'd argue they are going to be
getting short-term profits and the expense of long-term unhappy customers) but
I will point out that there are lots of legitimate reasons people want to do
DNS error redirection. 12 million + people have opted to use the services
of my company, OpenDNS, to make their internet safer and more reliable.
That's why I was willing to lend a few thoughts to the IETF document.
On Jul 9, 2009, at 2:06 PM, David P. Reed wrote:
http://tools.ietf.org/html/draft-livingood-dns-redirect-00
I note that this draft RFC proposes practices that routinely return
*valid* responses to erroneous DNS lookups, and encourage an opt-out
policy rather than an opt-in policy.
The sole justification is that the default way that a browser such as
Firefox or IE would present an error message is inadequate for users,
thus an ISP should take matters into its own hands to fix that cosmetic
problem, rather than asking the browser vendors to do a better job!
And the side effects identified do not include the impact on http
requests not generated by typing into web browsers, but instead used as
part of "web 2.0" service apis and other uses of port 80 that do not
arise from end users typing into the url bar of their browser.
One might ask why the sole justification given for this misuse of DNS
to patch an application weakness is the only one?
And even more so, why this is such an urgent problem that ISPs must fix
it via a flawed and risky solution, rather than the makers of browsers
fixing it in the most logical place?
The potential to disrupt non web-browser features is noted in the "draft
RFC", but instead of a balanced analysis of benefits and costs to other
uses, the draft is silent. In fact, the draft refers to this as
"enhanced" functionality.
I expect the wiser heads at the IETF to prevail.... This is a solution
to a non-existent "problem", with bad side effects.
While this is not exactly the same as directing a misdialed phone call
to call a Caribbean phone company number with the consequent and
unavoidable billing charge to the user, it seems very close to that sort
of thing - a surprise to all application developers, and a modification
to the expected semantics of directory lookup.
[ I agree with David. If IETF goes along with this proposal,
there
is something very rotten in Denmark. What's
really amusing about
the referenced document though is that for all its
verbiage in
which it tries to establish a "need" for such
DNS redirect
services -- mostly focused on highly questionable
assumptions
about malware protection and legal mandates -- it fails
to
mention the primary reason that ISPs implement DNS
redirects.
This is of course use of such DNS diversion services to
create
profit centers, by shunting users to ISP-affiliated
search
engines and affililated ad delivery services, attemping
to
monetize users' interactions with the broader Internet
by
capturing low-level transactional communications to
which the ISP
has privileged access.
-- Lauren Weinstein
NNSquad
Moderator ]
|