No more ads

http://blog.opendns.com/2014/05/29/no-more-ads/

by philip1209 • 12 years ago

188 106 12 years ago

blog.opendns.com

nly• 12 years ago

So I guess an analogy for this move would be like if Google announced Gmail was going ad-free for freeloaders because their Google Apps platform was now their sole money-spinner. Though, I imagine, vastly different cost structure and conversion rates.

I find it hard to be too cynical when OpenDNS were one of the few companies to give DNSCurve a whirl.

davidu12• 12 years ago

Your analogy is right. Thanks for the note on DNSCurve. Expect more work here and with DNSCrypt in the future.

DanBlake• 12 years ago

Its nice to say "we stopped doing it because we love our users" but I always feel like there is something more behind the scenes that makes these things happen.

Did chrome or Firefox recently change the way they handle nonexistent DNS answers so that opendns '404 pages' would no longer work? If the writing was on the wall it might make sense for opendns to get ahead of it, since there wouldn't be much they could do to combat browser level changes.

Or:

Did google/yahoo not renew their search feed agreement with them to be the search provider and/or significantly change the rates? I know google has been coming down very hard on toolbar makers so perhaps this is googles way of getting out of that biz (And forcing opendns's hand)

ChuckMcM• 12 years ago

My guess is that a) the ads on the page don't monetize well, b) the ad networks willing to pay to advertise there are sketchy, and c) users complain.

greenyoda• 12 years ago

"the ads on the page don't monetize well"

Agreed. I can't imagine that the average person types in a bad domain name very frequently (compared to, lets say, the number of times they view a Facebook page each day). So you can't really sell a lot of ads this way. Also, if someone makes a mistake with a URL, they're not going to stick around very long to read an ad, since they're already impatient to be somewhere else.

davidu12• 12 years ago

You should see my other response in this thread. Maximizing ad revenue put us in an arms race for a cause we don't even believe in. So why continue it? Our time is far better spent elsewhere.

pzxc• 12 years ago

Or maybe the truth is just as they explained it? That people don't like ads, that this fact is the most-cited reason people don't use OpenDNS, that they have an even better revenue model now (security analysis), and that by dropping their old way of doing things they will be able to attract vastly more people to use their service which will make their "security big data" even bigger and thus more useful/profitable?

Sometimes a cigar is just a cigar...

(By the way I think this change is awesome. Now if I could only get my cell phone provider -Tmobile cough- to stop hijacking my nonexistent-domain dns queries)

ronaldx• 12 years ago

I'm very glad that OpenDNS have done this, as I think it makes them a worthwhile service. I was not prepared to use or recommend them with ads.

However, their lack of transparency on the business justification is a bit worrying.

A possible positive interpretation is that they hope to drive adoption and use this to make more money selling their other services.

davidu12• 12 years ago

We hope users will consider our enterprise security services, naturally. As more than 10,000 businesses already have. That business far eclipses the money we were making from ad revenue and has the nice side effect of directly aligning user-experience with the people paying us the dollars.

davidu12• 12 years ago

We said browser changes over the years ate into that revenue stream. In other words, as our traffic volume quadrupled, we were essentially making similar amounts of money, rowing four times as hard for each dollar.

Part of it was the browsers, and part of it was us not wanting to do lame techniques like pop-ups, flash ads, and other obnoxious things.

It was an arms race we weren't interested in participating in, and one we ultimately expected to lose. Who wants to fight a battle for a cause they don't even believe in?

I could think of so many things I'd rather focus our engineering talents on than maximizing how many nickels we could shake out of each user. So we decide to do make the change and focus on creating things of value instead.

rpgmaker• 12 years ago

He apparently didn't read your post. I don't understand why the hate. Your post was very clear on why you did what you did.

PS: I would suggest you get additional DNS addresses that are easier. I mean, google's are so conveniently easy: 8.8.8.8 and 8.8.4.4. I can readily add them without giving them much thought after any installation.

cosmie• 12 years ago

Its nice to say "we stopped doing it because we love our users" but I always feel like there is something more behind the scenes that makes these things happen.

The decision very well was probably made because they love their users. You just have to think about why they love their users (even free ones). The vast size of their userbase is what enables them to sell security services. Without a significant userbase overall, the ability to detect anomolies and security threats diminishes which in turn devalues their security offerings. By making the experience better for their free users, they retain users better and potentially grow their userbase, which improves the capabilities of their paid security services.

mahouse• 12 years ago

The amount of users they have lost to Google and other DNS providers without ads and that follow the standards (i.e. NXDOMAIN, etc.) must be big.

jacquesm2• 12 years ago

Text ads and banners alike, they’re all vectors for the spread of malware.

That's an excellent argument pro-ad blockers. Typically ad-blocker users are berated because they're 'stealing from the publishers' or something to that effect, but it makes good sense from a security point of view too. And it rationalizes so much better than 'the web is faster this way' (assuming that's even the case).

eli3• 12 years ago

I guess it's good for security... but if your computer can be hijacked by loading a website, you're going to have a bad day even if you're blocking ads. For example, I would bet hacked websites are a much more common malware vector than ads.

jacquesm2• 12 years ago

Yes, but that does not mean it does not happen and when a very large website gets used to deliver malware through advertising it can be very effective. Such as this top10 dutch website:

http://blog.fox-it.com/2012/03/16/post-mortem-report-on-the-...

davidu12• 12 years ago

With the proliferation of real-time auction and backfill ad networks, the ability for a bad user to inject javascript or malicious Flash ads into the ad creative space carried on major sites has grown dramatically over the last few years.

It's hard to even tell who is serving up your ads sometimes without pulling out wireshark or some kind of HTTP proxy to look at the request chain.

mschuster916• 12 years ago

iirc flash ads with malicious payloads were the vector used to infiltrate the networks of NYC and other newspapers by Syrian Electronic Army, Anonymous and other public scale hacks.

bigbugbag8• 12 years ago

I would bet that malicious websites advertised in google ads are more common because they require less efforts and because I had to deal several times the aftermath of people clicking the first link in a google search for the flash plugin which turned out to be a google ad for a malicious website serving malware infected flash installer.

ben0x539• 12 years ago

It's also a good argument for certain security-focused DNS providers to block domains that are used to serve ads, at least on an opt-in basis if not by default for settings like public wifi.

fataliss• 12 years ago

I've always hated ads. Because most of the time products use it without embracing it and integrating it fully. Anywhoo, I'm happy to see OpenDNS getting out of this revenue model, I hope it's gonna work so other might be inspired! Who knows.

mschuster916• 12 years ago

Looks like Google's 8.8.8.8/8.8.4.4 stole them quite a bunch of traffic, simply due to it being (often) faster and ad-free. It was e.g. impossible to use OpenDNS on a server doing mail stuff because OpenDNS would resolve everything and their dead mother instead of returning NXDOMAIN.

Well, now I think I'll switch over to OpenDNS as soon as they prove to deliver un-manipulated DNS service. One way less for Google to track me.

edit: does anyone know if Cloudflare is also in the DNS business, from the resolver side? I know they and Amazon (Route53) do DNS server hosting, but does Cloudflare also provide public resolvers?

opendais• 12 years ago

I wish they would but they aren't as far as I am aware.

alec• 12 years ago

re: "One way less for Google to track me."

Google says that they don't use Google DNS for tracking.

From the Google DNS privacy page: "We built Google Public DNS to make the web faster and to retain as little information about usage as we could, while still being able to detect and fix problems. Google Public DNS does not permanently store personally identifiable information."

They go on in some detail to say how and what they log.

https://developers.google.com/speed/public-dns/privacy

mschuster916• 12 years ago

But you can bet that at least the NSA and 3-letter-agencies around the world do monitor anything going to or coming from these two IPs. It's just a too convenient target.

More distributed resolvers (like with Cloudflare/Amazon datacenters directly linked to ISPs) would make this type of spying orders of magnitude harder (they must actively infiltrate the ISPs network instead of just tapping the DECIX/exchange switches, which e.g. German BND is ALLOWED to do!).

Shit, I'd pay for Cloudflare or any other service to build robust, interception-secured DNS servers. Or my provider, but providers have a shameful track record of building fast and reliable DNS servers.

nilved• 12 years ago

They go on to contradict themselves. Google Public DNS does not permanently store personally identifiable information except for there 20 things:

bigbugbag8• 12 years ago

Why exactly should we believe anything google says ?

It's unverifiable and they don't exactly have a clean record. I wouldn't take their word for it, specifically for something privacy related.

blueskin_3• 12 years ago

Google say a lot of things. If you believe them, I have a bridge I can sell you.

higherpurpose2• 12 years ago

I think a big reason why Google's DNS became popular is because of the easy to remember DNS, too. I only had to try and remember it once.

That being said I started using encrypted DNSChain servers, or OpenNIC ones when the former don't work, because of privacy concerns.

https://github.com/okTurtles/dnschain

http://www.opennicproject.org/

bigbugbag8• 12 years ago

I'm also concerned with google's tracking and would be happy to use an alternative to 8.8.8.8 but openDNS is not exactly shining on the privacy side as pointed out in 2009:

« They also keep permanent logs of all queries, which could be subpoenaed by a government entity. Their joke of a privacy policy allows them to sell your logs to "Affiliated Businesses", which pretty much means anybody. Not that it really matters - they could amend their privacy policy tomorrow morning and be selling your info by the afternoon.» http://beta.slashdot.org/comments.pl?sid=1297613&cid=2864072...

As much as I'd like to diversify the entities tracking me, I don't think I'll ever return to openDNS which is not to be trusted in my book, reading the spin that the "no more ads " is just comforts me with this idea.

ing33k• 12 years ago

just trying to figure out this, won't the people who bother changing their DNS also use an Ad-blocker ?

mcpherrinm• 12 years ago

OpenDNS is used in a lot of places like coffee shop wifi where your users aren't the same as the savvier people who set up the internet. At least that's the only place I encounter (and then curse) their "guide".

Lots of people not using adblocking there.

wtallis• 12 years ago

I wonder if they're planning on implementing DNSSEC, given that this change is a prerequisite for full DNSSEC support. They would also have to be willing to use a less user-friendly method of blocking phishing domains (like return an unsigned NXDOMAIN that doesn't validate).

jblow• 12 years ago

The attempt to put a positive spin on the ad-version is kind of absurd.

Translation: "We tried to serve ads in a way that broke basic functionality for many people. But we didn't make that much money, so we are going to stop being malicious actors, and we're going to start following the protocols we're supposed to follow."

davidu12• 12 years ago

Except that isn't accurate. I get that's how you see it, but that's just not true.

It's ridiculous to say we broke things for many people. Our growth numbers tell a different story. Doesn't mean DNS nerds didn't like creating an account to re-enable standard nxdomain behavior, but it didn't cause issues for most people.

We made real money from ads, enough to be profitable with a decent-sized (20+) team. But we never saw a way to go from 5m to 50m or 500m with ads though. And we never loved the ads. I just never thought it aligned our interests with our customers in the right way. I get that Google has figured it out, and Facebook and Twitter sort of have, but we couldn't, and didn't want to.

Plus, at the time, you have to recall the browser landscape was wildly different. In fact, it's very possible that we may have created the eventuality of today by doing what we did. Chrome didn't even exist when we started. There was no omnibus. I demo'ed our service to Sundar Pichai back in 2007.

wdr1• 12 years ago

Hijacking NXDOMAIN for non-existent domains does not follow standards & is definitely breaking things.

IgorPartola2• 12 years ago

You hijacked NXDOMAIN breaking many applications in my personal experience. Over the past 4 years I have cautioned hundreds of people not to use this service because of that. It is not an issue that affects "DNS nerds", it affects everyone.

randunel• 12 years ago

You are no different from ISPs hijacking all the unresolved names, breaking default web functionalities. I wonder how naive can your remaining users be, to still use your ad-bloated service...

bigbugbag8• 12 years ago

Turns out jblow's right. I banished OpenDNS because it was breaking basic DNS functionality to serve its ads (and is terrible privacy wise), this is the exact bad behaviour from ISP openDNS was supposed to help with. But don't take my word for it and read this 2009 post from Stephane Bortzmeyer working at AFNIC in R&D in DNS security[1].

As jblow said the whole "no more ads" post reads as PR spin, same goes for your reply to him:

- growth numbers don't tell any story apart maybe from «many people read the "Open" part of the OpenDNS name and turn their brains off» [2].

- DNS nerds run their own DNS and keep away from openDNS for breaking DNS and invading privacy.

- not causing issues for most people doesn't disprove that it did cause issue for many people.

I do remember the browser landscape before openDNS and I'm quite happy to debunk your boasting attempt at being significant. The "search from the address bar" functionality has been around long before google chrome came to existence, actually it was in opera before openDNS existed and even better it allows to choose the search engine and use several with the use of a keyword. This was then added to firefox back in firefox 3. Again don't take my word for it and look a this 2008 post[3].

[1] http://www.bortzmeyer.org/opendns-non-merci.html

[2] http://beta.slashdot.org/comments.pl?sid=1297613&cid=2864072...

[3] http://googlesystem.blogspot.fr/2008/06/searching-from-addre...

mdellabitta• 12 years ago

It's ridiculous to say we broke things for many people.

Two weeks ago, I had to swap my company's network over to OpenDNS because Google DNS was having an outage. And then a day later, I spent 2 hours trying to chase down a problem running something that turned out was a result of OpenDNS feeding a page full of ads to something that was expecting JSON.

You might not have broken things for all the people that continued to use your service, but you broke things for people like me. And this is a place where people like me hang out....

brokentone• 12 years ago

This is only partially related, but ad quality is just so bad, that it's becoming nearly a moral issue (as essentially is here) making ads the business model.

I wonder if there isn't a business case for highly QA'd ads? Or is there too little visibility into that for the average consumer to appreciate the value?

joshfraser• 12 years ago

Props to davidu for skating to where the puck is going and not where it's been.

zobzu• 12 years ago

I stopped using opendns when they added ads. I might use it again then.

bluedino2• 12 years ago

We used OpenDNS until we sent out an email that linked to SurveyMonkey - the URL was wrong, it said surveymonkye.com

The problem was our QA never caught it, since OpenDNS 'fixed' the request during testing. 24,000 emails later, we were instantly alerted to the bad link.

mjolk2• 12 years ago

You pay a QA to read outgoing emails to customers and they don't even click links?

Are you hiring?

bluedino2• 12 years ago

They clicked the links. But OpenDNS 'fixes' the request from the browser, sending you to the right URL even if you enter the wrong one. That's why QA didn't catch it.

kolev• 12 years ago

I either use Google Public DNS or DNSCrypt with one of these here (https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscr...). Some providers even support Namecoin and DNSSEC validation.

melville_X• 12 years ago

A good free alternative is Comodo (8.26.56.26), I trust them slightly more than Google and they have security features such as malware detection.

http://www.comodo.com/secure-dns/

higherpurpose2• 12 years ago

Comodo? This Comodo?

https://www.schneier.com/blog/archives/2011/03/comodo_group_...

http://youtu.be/pDmj_xe7EIQ?t=4m59s

fiatjaf• 12 years ago

Well, I remember not even knowing what was DNS, and having the bad luck of having a computer with OpenDNS set as its primary DNS, I don't know why.

I only know I thought it was a malware and the first thing I did when I learned it was a DNS server was to change it.

enscr2• 12 years ago

Search "opendns vs google dns" https://www.google.com/webhp?q=opendns+vs+google+dns#q=opend...

One of the top links is titled "OpenDNS vs. Google Public DNS" and points to : http://www.opendns.com/about/global-dns-infrastructure

There's no mention of Google on that page. How do I trust a company that's tricking users with misleading titles?

sumedh• 12 years ago

That is actually a good point, not sure why you got downvoted.

davidu12• 12 years ago

We removed that page when we updated our website. Google is surprisingly slow in this case to update their results. No idea. Nothing we're doing on our end I don't think.

enscr2• 12 years ago

I don't see Google's fault here. The title of this page (still live) http://www.opendns.com/about/global-dns-infrastructure/ is <title>OpenDNS vs. Google Public DNS</title>

blueskin_3• 12 years ago

Very nice, I might give OpenDNs another try as my backup DNS server now. I hate NXDOMAIN hijacking with a passion.

This experience is one of the only reasons people cite to not use OpenDNS.

Yep, because people care about their privacy. I'm surprised OpenDNS didn't notice this before. I will probably start recommending them again now; after all, almost anyone is better to trust with something like DNS than google.

bigbugbag8• 12 years ago

They obviously noticed and knew but did not care, as stated in the post OpenDNS is a revenue oriented company as such they're going after the money which for a service nobody's going to pay money for means going the "make them pay with their privacy " way a.k.a. ads.

tty• 12 years ago

An alternative to all these popular DNS servers is the Swiss Privacy Foundation

http://www.privacyfoundation.ch/de/service/server.html

  77.109.138.45
  77.109.139.29

No blocking, no logging except for errors (the IP is not logged).

marquis2• 12 years ago

I've been using this for about 6 months in various parts of the globe and have been very happy. If there is a donate button on their site (my Deutsch language is lacking) I would like to know.

grmarcil• 12 years ago

It seems you could become a member for 35 Swiss Francs (~40 USD) per year. http://www.privacyfoundation.ch/en/association/membership.ht...

unreal37• 12 years ago

Congrats davidu and opendns on making bold choices and thinking about users despite millions in revenue you could have made.

bigbugbag8• 12 years ago

For those of you who prefer to use a different DNS server from of the one provided by your ISP, thanks to the work of Chris Hill you can make good use of this resolv.conf:

http://www.chaz6.com/files/resolv.conf

WARNING: Not to be used as is, be smart and only activate a handful of those DNS servers.

No more ads

Related Stories