Schneier on Security

argv • August 5, 2009 5:24 AM

I think once one becomes aware of how much income this practice generates (I for one am amazed- it is huge), then this all makes sense.

It has been going on for many years (see Net Sol reference above). Everyone is in the game- they are only human and I suspect the temptation for financial gain is too great- from registrars to browser companies to search engine companies to ISP's to DNS alternative providers to all types of crafty individuals. They are all taking part.

The problem (if there is one) is twofold:
1. DNS (vs /etc/hosts) is not needed; the conditions of 30 yrs ago have changed; GB's for under $1; see above local cache suggestion- /etc/hosts is a digital 'phonebook' and it could easily be centrally distributed as a single file in a secure way); IP addresses do not have to be like shifting sands, updated by the minute- imagine if phone numbers were like that. Imagine if everytime you dialled a wrong number it was redirected to a call center where someone was waiting to try to sell you something to point you to other sellers.

2. Users are too 'dumb' (i.e., unwilling to take an interest in learning about this; they can't stop impulse clicking on screen areas and typing mindlessly into their browser address bars; they fail to see that the internet is similar to telephony: it operates by numbers- IP addresses are no longer than phone numbers, and no more difficult to remember, if typing them out). I still am amazed that users type directly in their address bars (and of course make mistakes) to find sites. Firefox and Google certainly are not trying to stop this.

The money is steadily coming in from the advertisers. It's 99% of Google's income. And from that income comes the imcome of many of the above parties mentioned. All dependent on each other- trickle down. Having 'dumb' users just encourages this to continue. There is no reason anyone (except consumers perhaps) might want to change the situation. It is a cash cow.

Maybe it's unfortunate that we have to endure more DNS follies because by being faulty the system brings in even more ad income. But I doubt those profiting from it would think so.

There's a reason I put 'dumb' in quotes. Users are not dumb; they are actually smarter than we are: what they don't know won't bother them. And they certainly don't concern themselves with DNS. The more one knows about DNS the more annoying it is.

argv • August 7, 2009 2:22 AM

In short:
- do your own lookups
- on your own local cache

Every home user can do this.

There are speed and reliability gains, and all 'problems' identified here would be solved. And there's another 'problem' that has not been mentioned which would be eliminated, relating to privacy. That is, the infamous "DNS leaks" problem.

Using an external DNS provider is like dialling 'directory assistance' every time one wants to make a 'call', despite that one can easily obtain a copy of the 'telephone directory' and keep it near the phone. And in this case, thanks to technology, the later method is actually faster, and no more less convenient.

Key to telepony metaphor:
'directory assistance' = a DNS service
'call' = access a resource via HTTP
'telephone directory' = a DNS cache

There is software to do this (run a local cache) that is simple, open source and free. All you have to do is open your mind, stop thinking in terms of the anti-/etc/hosts, DNS paradigm and have a look. It's been right there all along.

For PC users, here no need to argue the merits of DNS. Sending UDP packets to some foreign server's DNS port 53 every time one wants to 'make a call' is not necessary. All one needs is a copy of the 'telephone directory' (=all hostnames and corresponding IP's, i.e. a modern-day /etc/hosts). The only reason all PC users do not have this already is because we were sold on an alternative that was deemed necessary due in part to hadware constraints, and the usual obsessive compulsiveness about staying 'updated' things almost in realtime. For the non-tecnical user, the 'telephone directory' does not need to be updated every 5min. And having a searchable copy of the directory might encourage users to stick to 'trustworthy' sites, not some dodgy ones that hide their locations using a variety of tricks.

Well, that concludes my pitch for simplicity. I reckon this is a high traffic blog; I hope that maybe my comments get some people thinking outside the box (where 'the box' = the anti-/etc/hosts, DNS paradigm).