OpenDNS safer or not?

OpenDNS safer or not?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
OpenDNS safer or not? peter 06-19-2007
Posted by Sebastian G. on June 23, 2007, 11:47 am
If you were  Registered and logged in, you could reply and use other advanced thread options
davidu wrote:


>>> And if you use OpenDNS because you *want* this type of
>>> protection, then it's with your consent.
>> It is within your consent if they add sites on their censorship list which
>> are not related to phishing at all, and this without your knowledge?
>
> You have no idea what OpenDNS does.


I'd rather say this applies to you.

> You have no idea that we give you full control over your DNS in a way you
> never have before.

And you seem to have no idea how utterly bullshit this is. Not just wrt. to
what OpenDNS does (censorship that is not just limited to proclaimed
phishing hosts), but also how I'm running my very own DNS server (recent
BIND9 with some patches and a well-understood configuration).

>>> Your comment is like claiming that a firewall is a security risk because
>>> it causes Denial of Service when it prevents you from accessing certain
>>> sites or using some applications.
>> It is. A firewall shouldn't do such a thing.
>
> Wow. That's exactly what a firewall does.


No, this is not even remotely what a firewall does.

> It presents a barrier based on specified rules.

And the rules are supposed to implement to filter out everything you don't
want to work. If it blocks something that is supposed to work, the firewall
is obviously misconfigured.

> And firewalls can and often do work at all layers of the OSI stack.

You may or may not notice that there are various differences between the
internet protocol stack and the OSI model.

Posted by davidu on June 23, 2007, 7:24 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> davidu wrote:
> >>> And if you use OpenDNS because you *want* this type of
> >>> protection, then it's with your consent.
> >> It is within your consent if they add sites on their censorship list which
> >> are not related to phishing at all, and this without your knowledge?
>
> > You have no idea what OpenDNS does.
>
> I'd rather say this applies to you.

Sebastian,

Let's be crystal clear right now. You can, with OpenDNS, get standard
RFC compliant DNS with NXDOMAIN's being returned, no phishing
protection, no adult blocking, and nothing else. I understand that
you have ZERO clue what the service does, but I figured you would at
least try and see.

Every administrator that configures OpenDNS decides what functionality
they want. Guess what? Admins love being able to have a simple place
to say "Hey, I want to block myspace.com" and when they do that, it
doesn't affect you in any way. That's the entire point. The DNS
results on the recursive nameserver are modified based on the src_addr
making the requests.

>
> > You have no idea that we give you full control over your DNS in a way you
> > never have before.
>
> And you seem to have no idea how utterly bullshit this is. Not just wrt. to
> what OpenDNS does (censorship that is not just limited to proclaimed
> phishing hosts), but also how I'm running my very own DNS server (recent
> BIND9 with some patches and a well-understood configuration).

What censorship are we imposing? Nobody makes you block a domain.
It's about giving you power and control, not to mention a more
reliable and faster service.

>
> >>> Your comment is like claiming that a firewall is a security risk because
> >>> it causes Denial of Service when it prevents you from accessing certain
> >>> sites or using some applications.
> >> It is. A firewall shouldn't do such a thing.
>
> > Wow. That's exactly what a firewall does.
>
> No, this is not even remotely what a firewall does.

What does it do then?

>
> > It presents a barrier based on specified rules.
>
> And the rules are supposed to implement to filter out everything you don't
> want to work. If it blocks something that is supposed to work, the firewall
> is obviously misconfigured.

What's that have to do anything I said? That statement is a strawman.

>
> > And firewalls can and often do work at all layers of the OSI stack.
>
> You may or may not notice that there are various differences between the
> internet protocol stack and the OSI model.

Again, a strawman. Before replying, check out what OpenDNS offers and
educate yourself.

Thanks,
David Ulevitch




Posted by Sebastian G. on June 24, 2007, 1:39 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
davidu wrote:


> Let's be crystal clear right now. You can, with OpenDNS, get standard
> RFC compliant DNS with NXDOMAIN's being returned, no phishing
> protection, no adult blocking, and nothing else.


I didn't manage to get such a behaviour. Can you enlighten me a bit?

> The DNS results on the recursive nameserver are modified based on the src_addr
> making the requests.


Which is even more stupid.

>>> You have no idea that we give you full control over your DNS in a way you
>>> never have before.
>> And you seem to have no idea how utterly bullshit this is. Not just wrt. to
>> what OpenDNS does (censorship that is not just limited to proclaimed
>> phishing hosts), but also how I'm running my very own DNS server (recent
>> BIND9 with some patches and a well-understood configuration).
>
> What censorship are we imposing?


"we"? Anyway, I already mentioned some well-known examples (which might also
be related to OpenDNS's peering partners which filter various DNS requests).

> It's about giving you power and control, not to mention a more
> reliable and faster service.


It's doing what? Excuse me, but how should this work?

>>> It presents a barrier based on specified rules.
>> And the rules are supposed to implement to filter out everything you don't
>> want to work. If it blocks something that is supposed to work, the firewall
>> is obviously misconfigured.
>
> What's that have to do anything I said? That statement is a strawman.


And it's precisely a counter-argument to the BS you're writing.

>>> And firewalls can and often do work at all layers of the OSI stack.
>> You may or may not notice that there are various differences between the
>> internet protocol stack and the OSI model.
>
> Again, a strawman.


And a counter-argument. Now, how exactly do you block Skype with a firewall?

Posted by Barry Margolin on June 23, 2007, 4:07 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> Barry Margolin wrote:
>
>
> > It's only a security risk if it's doing so without your knowledge,
> > consent, or control. IIUC, this is a user-configurable option, so you
> > have control.
>
>
> AFAICS this is without your control.
>
> > And if you use OpenDNS because you *want* this type of
> > protection, then it's with your consent.
>
>
> It is within your consent if they add sites on their censorship list which
> are not related to phishing at all, and this without your knowledge?
>
> > Your comment is like claiming that a firewall is a security risk because
> > it causes Denial of Service when it prevents you from accessing certain
> > sites or using some applications.
>
> It is. A firewall shouldn't do such a thing.

I was using the term to refer to security software in general. How
about the options in many browsers to block phishing sites?

The point is that most users don't want to keep track of malware,
phishing, etc. -- they WANT to delegate that responsibility to someone
else. This implies that they trust that third party to act responsibly.

It's like hiring a security guard. This presumably makes things MORE
secure. You have to assume, though, that the security guard isn't
buddies with thiefs who he's going to allow into the building. Most of
the time this assumption is warranted. And you're pretty much forced
into assuming this -- you can't watch the front door yourself and also
get your real work done.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***

Posted by Sebastian G. on June 23, 2007, 7:03 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Barry Margolin wrote:


> I was using the term to refer to security software in general. How
> about the options in many browsers to block phishing sites?


This is, of course, bullshit as well.

> The point is that most users don't want to keep track of malware,
> phishing, etc.


Then tell'em don't install any, and to simply not fall for phishing. Now
that's really easy...

> -- they WANT to delegate that responsibility to someone else.


And why should we care? The fact is that, how much they might want it
either, they simply can't delegate responsibility, especially not for if the
cause is their utter idiocy.

> This implies that they trust that third party to act responsibly.

So, and has OpenDNS claimed to be responsible or even reliable?

> It's like hiring a security guard. This presumably makes things MORE
> secure.


A security guard is competent on his field and is getting paid to do the job
as you intend it. And a security guard doesn't require you to remove other
security measures like the front door. Now so much to your failed analogy.

> you can't watch the front door yourself and also get your real work done.


That's why we LOCK the front door. Now will you please stop trying to kid
me? Nothing of this will change that OpenDNS deliberately introduces wrong
DNS replies for whatsoever reasons, adds non-ICANN TLDs, create a new
incomptabile root zone without any authority, breaks any authority chains
anyway (no chance for root-delegation), and much more.

It's a wonder that this POS even works, but it's no wonder that some people
actually like this POS, becaus eit shows their lack of competence, knowledge
and probably sanity.

At any rate, you're even worse off than with your ISP's caching DNS server
or the ICANN root.

Similar ThreadsPosted
Re: OT: TRUTH: MACS ARE SAFER THANS WINDOWS May 30, 2007, 5:51 pm

The site map in XML format XML site map

Contact Us | Privacy Policy