OpenDNS safer or not?

OpenDNS safer or not?

Secure Home | Search | About
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
OpenDNS safer or not? peter 06-19-2007
Posted by Sebastian G. on June 27, 2007, 9:50 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Barry Margolin wrote:


> Without the AV software, you're hosed forever.


Utter bullshit.

>> Well, do I have to mention that the real solution against viruses is a
>> no-exec policy, thus only running applications from a whitelist? Trivial,
>> practicable, reliable, secure.
>
> But since the OS doesn't do that,


It does. Yours does as well.

> you need other protection.

You mean Windows 2000? Yes, such a functionality can be added by third-party
software.

> As an end user you can't change the OS policy,

Even more bullshit.

> you're stuck with it. You need a solution that works within its limits.

"Solution" and "works" are quite wide terms. Now, virus scanners are neither
- they're measures to limit the damage that stupid users are doing to us. It
doesn't limit the damage they're doing to themselves.

> Should we stop trying to develop cures and vaccines for STDs because the
> real solution is to not have sex with people with STDs?


No, because these cures and vaccines don't hinder the real solution and
don't increase the spread of STD.

> And the "no-exec" policy will only protect you from malware based on
> executing applications. It does nothing to protect you from phishing
> sites.


Nothing protects from phishing sites. It's a PEBKAC.

> And a whitelist only works if you know what programs to allow.
> What about a trojan that looks like a desirable program?


Nothing can protect from trojan horses, however a concept of trust relation
can limit their effect. If this fails, well, then you're hosed, even with
virus scanners.

Posted by Barry Margolin on June 27, 2007, 7:05 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> Nothing can protect from trojan horses

If the AV software has its signature, it will.

Nothing can prevent you from unknown trojan horses, though.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***

Posted by Sebastian G. on June 27, 2007, 8:16 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Barry Margolin wrote:


>> Nothing can protect from trojan horses
>
> If the AV software has its signature, it will.


That's a really big if.

> Nothing can prevent you from unknown trojan horses, though.

Nothing can protect you from known trojan horses which simply don't have any
signature, because they're modifying themselves in a way that doesn't expose
any scanable patterns.

Thus the real solution is to not run any untrustworthy software, whereas
trust has to apply to the vendor, the quality of the implementation and the
quality of the software creation process.

Posted by Barry Margolin on June 26, 2007, 12:06 am
If you were  Registered and logged in, you could reply and use other advanced thread options

> And, whether you like it or not, using the additional crap features
> intentionally makes the protocol violation even worse. But I guess you don't
> understand the technical means of the difference between NXDOMAIN and
> SERVFAIL in terms of a DNS resolver, so better asks the guys who had to
> fiddle with the consequences of VeriSign's SiteFinder attack.

BTW, I *do* understand this. I don't want to boast, but I am recognized
as one of the DNS experts on the Internet -- ask anyone in
comp.protocols.dns.bind.

And the SiteFinder issue wasn't one of NXDOMAIN vs. SERVFAIL. The
problem with SiteFinder was that it couldn't tell the difference between
a query coming from a web browser (which can deal with being redirected
to a search server) and one coming from a mail server (which should get
an error so that it can bounce the message back with an appropriate
error). This is less likely to be a problem for the typical OpenDNS
user, because they're just running applications like web browsers, not
mail servers.

And since OpenDNS allows you to opt out of the rewrite feature, if
you're running a server you should do so.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***

Posted by Sebastian G. on June 26, 2007, 12:39 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Barry Margolin wrote:


> And the SiteFinder issue wasn't one of NXDOMAIN vs. SERVFAIL.


Oh, it was, depending on your DNS resolver.

> The problem with SiteFinder was that it couldn't tell the difference between
> a query coming from a web browser (which can deal with being redirected
> to a search server) and one coming from a mail server (which should get
> an error so that it can bounce the message back with an appropriate
> error). This is less likely to be a problem for the typical OpenDNS
> user, because they're just running applications like web browsers, not
> mail servers.


Ehm... what about P2P applications, VoIP stuff, etc.? It fails for the very
same problem.


Since I'm also missing a little part of the discussion: In which way should
OpenDNS be preferable to a simple stub resolver recursing on a typical
ISP's caching-only DNS server with the ICANN root or the ORSN root?

Similar ThreadsPosted
Re: OT: TRUTH: MACS ARE SAFER THANS WINDOWS May 30, 2007, 5:51 pm

The site map in XML format XML site map

Contact Us | Privacy Policy