Pro-SOPA Comcast just implemented SOPA-incompatible DNSSEC

http://www.itworld.com/security/240789/sopa-might-force-choice-stop-cyberspies-bank-robbers-and-id-thieves-or-stop-illegal-

by frooboy • 15 years ago

64 31 15 years ago

itworld.com

pjscott• 15 years ago

DNSSEC prevents spoofing (as does HTTPS), but that's about all it does that's relevant to SOPA. This may prevent a particular mechanism of SOPA enforcement, but that's easy enough for the government to work around, in theory.

wmf3• 15 years ago

Exactly. If an ISP simply returns an error for lookups of a blacklisted domain, DNSSEC shouldn't complain; it will just think there's a DNS outage.

Since no one has read it, here's the relevant text: "A service provider shall take technically feasible and reasonable measures designed to prevent access by its subscribers located within the United States to the foreign infringing site (or portion thereof) that is subject to the order, including measures designed to prevent the domain name of the foreign infringing site (or portion thereof) from resolving to that domain name's Internet Protocol address." (I wonder if I am now cursed.)

newhouseb2• 15 years ago

Right, I don't know know how most DNS client implementations handle time-outs but this could range from not mattering at all to degrading the performance of everything - imagine if twitter was taken down, then half the world's websites (I'm exaggerating a bit) that reference Twitter buttons would grind to a standstill (try browsing things like TechCrunch in China and you'll see this).

If ISPs wanted to avoid this scenario, it would essentially require fracturing DNS[SEC] into something the US Govt has the authority to sign properly without effecting the rest of the world - in other words a completely divided national internet.

Or we could just all switch to using DNSSEC servers on the Barbados Islands or something in the future.

DarkShikari• 15 years ago

Even if DNSSEC and SOPA were mutually exclusive in all aspects (which they are not), being pro-SOPA does not mean Comcast cannot also prepare for the case where SOPA fails to pass.

simcop2387• 15 years ago

I find this more interesting not from a SOPA standpoint but because comcast has in the past given me false responses instead of NXDOMAIN. Anyone happen to know if this could prevent such a thing, or at least provide a mechanism of testing for it other than blacklisting an IP?

sp332• 15 years ago

They would have to give some kind of error code that indicates that the DNS server isn't working. Any false assertion about DNS results, including false NXDOMAIN responses, will break DNSSEC (your computer would notice that the response has been forged).

tedunangst2• 15 years ago

And what do you do after detecting a forged NXDOMAIN response? You still don't have the IP address you wanted.

modeless• 15 years ago

Wow, Comcast voluntarily switched to DNSSEC even though it required them to shut off their DNS-hijacking ad servers? They just went up a few notches in my eyes. (http://blog.comcast.com/2012/01/comcast-domain-helper-shuts-...)

whichdan• 15 years ago

I use Comcast (I'm in Boston) and I once called their phone support to see if I could get the "Domain Helper" disabled, and the tech had no idea what I was talking about. Switching to Google's DNS servers helped.

pdubs• 15 years ago

In "My Account", go to "Users & Settings". There's an option for "Domain Helper" right there. I was on Google's DNS servers until I saw Comcast was implementing DNSSEC, so I disabled the "service" and switched back.

blutonium• 15 years ago

I had the same experience. Bumped to a manager that had me log in and disable it. A month later, it was on again.

pudquick2• 15 years ago

For anyone reading this and not knowing about the service / how to make changes, Comcast did set up a nice simple site for it:

http://dns-opt-out.comcast.net/help-index.php

The only requirement that you need is your Comcast account information that was created when you signed up with them. If you don't know the username, to avoid the issues whichdan ran into just call them on the phone (or if you're on your home internet connection you can start a webchat with them at https://www.comcastsupport.com/ChatEntry/ and tell them you forgot the account, then once you know it, ask if they can reset the password for you).

This will reprovision your cable modem(s) with alternate DNS settings (which are actually the same DNS server settings as their DNSSEC servers: 75.75.75.75 and 75.75.76.76). If you don't want to mess with turning it on/off and you've got a router connected to the cable modem (or a computer directly connected - please never do this!), you can just manually change your DNS server settings to these values and get the same effect (effectively ignoring the ones provided through the cable modem connection).

It should trigger a reboot/update on your cable modem, which will then cause it to pull down the alternate DNS server settings. Per the documentation on their help page, you may need to reboot any attached routers so that they pull down updated DNS information (though loss of link with the cable modem should trigger that when the cable modem comes back up).

And though the parent commenter used Google DNS (which I really do like) - users that make use of the iOS App Store for their iPhones / iPods / iPads may want to consider using the Comcast DNS server settings - if not for all devices in their house, then at least manually enter them for WiFi networks served by Comcast cable modems.

In my personal experience, using the 8.8.8.8 / 8.8.4.4 Google DNS server settings resulted in rather slow downloads compared to using the Comcast DNS server settings, as I believe Apple's App Store CDN server addresses were resolving to geographically incorrect / distant servers.

CDNs can use DNS trickery to speed up delivery. When a domain server (your ISP's) looks up the IP address for a server name that's hosting content you want, the name server can return tailored IP addresses based on where in the world it thinks the request is coming from.

Google's DNS servers do their own trickery to attempt to connect you to a DNS server close to where you're at (or at least provide results quickly for where you're at), but Comcast's DNS servers are hosted on their core networks which can reach their customer base quickly. A CDN IP address result tailored for where the Comcast DNS servers are hosted will result in an IP address that your home connection will likely be able to pull down from very quickly as well.

Results may vary, and I do trust Google to do less evil with their DNS results than Comcast - but damn it, I wasn't willing to wait 20 minutes to download an app that should have taken only 2.

ars2• 15 years ago

Whoever runs the comcast network really knows his stuff.

They are one of the first large ISPs to actually start real work on deploying IPv6.

And I remember calling during an outage and speaking to someone on the front lines (not second tier) who was actually very technically knowledgeable.

Whatever you may think of their business department (silly things like internet + cable costs less than internet by itself), the network side is really good.

seanp2k22• 15 years ago

I know a guy who knows the regional network manager for Comcast here in the Midwest. I hear he's actually great. Their business and management is the worst of the worst, but the poor saps who actually work on their infrastructure know what's up. It's why I was getting 10 mbit speeds back in the early 2000s.

count• 15 years ago

I might be misremembering, and some of those folks may have moved on, but Comcast inherited a large portion of the '@home' cable modem network, which was, as far as I know, the first network to run out of RFC1918 space due to size and not horrible management.

You can't grow a network that large without knowing your stuff inside and out. The netops folks at comcast are fairly active in NANOG, etc. as well.

snowwrestler• 15 years ago

It's actually not incompatible with SOPA. The bill demands that ISPs block DNS routing for certain domains. Returning no response to a DNS request would not break DNSSEC. It would just look like that site did not exist.

Some people have proposed that instead of blocking DNS, ISPs should redirect a DNS request. That would be incompatible with DNSSEC--but that requirement is not in the bill.

msredmond• 15 years ago

Does this link actually work for anyone? I'm just getting the sites home page (and don't see that story in quick scroll)

privacyguru• 15 years ago

Props to Comcast and NOT to Congress if they pass either of these.

http://www.securityweek.com/dnssecs-time-here-sopa-presents-...

Pro-SOPA Comcast just implemented SOPA-incompatible DNSSEC

Related Stories