Re: [gentoo-user] How to prevent a dns amplification attack

[Rene Rasmussen]

On Sat, 30 Mar 2013 13:06:16 +0100
Norman Rieß <norman@×××××××××.org> wrote:

>
> Am 29.03.2013 um 23:34 schrieb Paul Hartman
> <paul.hartman+gentoo@×××××.com>:
>
> > On Thu, Mar 28, 2013 at 7:49 PM, Peter Humphrey
> > <peter@××××××××××××××.org> wrote:
> >> On Thursday 28 March 2013 20:53:49 Paul Hartman wrote:
> >>
> >>> In my case, my ISP's DNS servers are slow (several seconds to
> >>> reply), fail randomly when they should resolve, return an IP
> >>> (which goes to their ad-laden "helper" website if you are using a
> >>> web browser) when they should instead return nxdomain, and they
> >>> have openly admitted to selling customer DNS lookup history to
> >>> marketers for targeted advertising.
> >>
> >>
> >>
> >> That is just evil. Have you no alternative to this ISP?
> >
> > Not really.
> >
> > I have a 100 megabit connection through the cable company; my only
> > wired alternative is DSL (1.5 mbit for almost half the price I'm
> > paying for 100mbit). Cellular or satellite are not viable options
> > for me because of comparatively poor value, latency and miniscule
> > data usage caps.
>
> > […]
> >
> > It is no longer legal for local governments to award monopolies, but
> > the damage has been done. What we have is essentially the cable TV
> > infrastructure that was laid out during the decade when local cable
> > monopolies were legal, and the cost of entry for a new player into
> > the market now is so high that nobody ever bothers. End result for
> > consumers is a lack of choice. There are some places where
> > competition exists, but those places are pretty rare, in my
> > experience.
> >
> > There are some other possible alternatives to cable internet and
> > DSL, such as municipal wifi, mesh networks, powerline and FTTx, but
> > none are available where I live.
> >
> > The service I receive from the cable company here is actually
> > excellent, with the exception of the aforementioned DNS woes.
> >
> > Pretty much every major ISP in the US does DNS-hijacking and other
> > shenanigans, so there's no avoiding the evilness. I believe the
> > board members of major cable and telecom companies would sell their
> > own mothers into slavery if it meant a rise in share prices or a
> > larger bonus at the end of the year...
> >
>
> That is pretty much the same as what happened in Germany. The
> telephone network was build by the german postal service in the past
> and was run by the government. As we all know everything works better
> and cheaper when things are privatized, so the Deutsche Telekom was
> created and with it a semi monopoly over night. Regions not dense
> enough are not part of the developing plans of any of the companies.
> So if you are lucky like me, you are stuck with 16mbit DSL provided
> by one company rented by an other company. If people start to build
> their own network or a competitor reaches for a specific
> underdeveloped region, this region gets an upgrade like to DSL 3 Mbit
> or something like that, so the competitors draw of. If you are really
> lucky you live in a region which is really dense or a cable company
> provides you with internet, so you get 100mbit. But this is only a
> fraction of all people. If the government is confronted with this
> they say, the market will regulate that, which it does not. And if
> voices get too loud, the tell the companies to develop the
> underdeveloped regions, they shake hands on TV and nothing happens.
> And as Paul said, most ISP do DNS-hijacking and the like, which
> breaks things in incredible unexpected ways.
>
> So when i wrote this post to the mailing list and got answers like
> "unnecessary crap" and "why make it available for everyone" i thougt,
> this to be answers of some weirdos which should be ignored. Here you
> do not trust your ISP… you use the ISP which sucks less or the only
> one that gives you any internet at all. If you reach a certain level
> of knowledge, you change your DNS settings to free DNS servers and if
> you run a resolver you do it for the other poor souls as well. There
> are lists of unfiltered DNS Servers
> (http://www.ungefiltert-surfen.de/nameserver/de.html), which are
> checked regularly if they provide unfiltered answers an the like. And
> there are howtos for the average user on how to change the dns
> settings and to avoid your isp´s dns servers.
>
> Regards
> Norman
>
There is also the possibility to use opendns.com
I've been using them for years, and have not had any trouble. I started
using them when my ISP decided to block some sites. And their standard
service is free :)

Best regards,
Rene