Gentoo Archives: gentoo-user

From: Paul Hartman <paul.hartman+gentoo@×××××.com>
To: gentoo-user@l.g.o
Subject: Re: [gentoo-user] How to prevent a dns amplification attack
Date: Thu, 28 Mar 2013 20:54:24
Message-Id: CAEH5T2MbXsm5Gy=QJ1W=kWioV+bKRRxuC7RRyhzESc+=9fgLQQ@mail.gmail.com
In Reply to: Re: [gentoo-user] How to prevent a dns amplification attack by Alan McKinnon
1 On Thu, Mar 28, 2013 at 3:02 PM, Alan McKinnon <alan.mckinnon@×××××.com> wrote:
2 >>> Or just use the ISP's DNS caches. In the vast majority of cases, the ISP
3 >>> knows how to do it right and the user does not.
4 >>
5 >> Generally true, though I've known people to choose not to use ISP caches
6 >> owing to the ISP's implementation of things like '*' records, ISPs
7 >> applying safety filters against some hostnames, and concerns about the
8 >> persistence of ISP request logs.
9 >
10 > I get a few of those too every now and again. I know for sure in my case
11 > their fears are unfounded, but can't prove it. Those few (and they are
12 > few) can go ahead and deploy their own cache. I can't stop them, they
13 > are free to do it, they are also free to ignore my advice of they choose.
14
15 In my case, my ISP's DNS servers are slow (several seconds to reply),
16 fail randomly when they should resolve, return an IP (which goes to
17 their ad-laden "helper" website if you are using a web browser) when
18 they should instead return nxdomain, and they have openly admitted to
19 selling customer DNS lookup history to marketers for targeted
20 advertising.
21
22 Thanks for being one of the good guys. :)

Replies

Subject Author
Re: [gentoo-user] How to prevent a dns amplification attack Michael Mol <mikemol@×××××.com>
Re: [gentoo-user] How to prevent a dns amplification attack Peter Humphrey <peter@××××××××××××××.org>
Re: [gentoo-user] How to prevent a dns amplification attack Alan McKinnon <alan.mckinnon@×××××.com>