full-disclosure - Verisign abusing .COM/.NET monopoly, BIND releases new

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: peter at trusteddebian.org (Peter Busser)
Subject: Verisign abusing .COM/.NET monopoly, BIND releases new

Hi!

> At least a BIND patch could be useful for ISP's running BIND or even be
> reused in DJBDNS and similar.

This page: http://www.imperialviolet.org/dnsfix.html has a patch for DjBDNS.

> For now, it is returning the same IP address, but I have no trouble
> imagining Verisign evading DNS filters by changing the A records every
> now and then. Any solution to prevent Verisigns greed should keep this
> in mind.

You could try to do a second query for a wildcard record in the domain and then
match the IP address in the first reply with the IP address given in the
wildcard record reply. That result could be cached for future use. That way
you don't have to hardcode the IP address in the code and it could work for
other domains as well.

Groetjes,
Peter Busser
-- 
The Adamantix Project
Taking trustworthy software out of the labs, and into the real world
http://www.adamantix.org/