No more ads
blog.opendns.com
blog.opendns.com
Translation: "We tried to serve ads in a way that broke basic functionality for many people. But we didn't make that much money, so we are going to stop being malicious actors, and we're going to start following the protocols we're supposed to follow."
It's ridiculous to say we broke things for many people. Our growth numbers tell a different story. Doesn't mean DNS nerds didn't like creating an account to re-enable standard nxdomain behavior, but it didn't cause issues for most people.
We made real money from ads, enough to be profitable with a decent-sized (20+) team. But we never saw a way to go from 5m to 50m or 500m with ads though. And we never loved the ads. I just never thought it aligned our interests with our customers in the right way. I get that Google has figured it out, and Facebook and Twitter sort of have, but we couldn't, and didn't want to.
Plus, at the time, you have to recall the browser landscape was wildly different. In fact, it's very possible that we may have created the eventuality of today by doing what we did. Chrome didn't even exist when we started. There was no omnibus. I demo'ed our service to Sundar Pichai back in 2007.
In the era before the omnibox, I personally can't see much in the way of "breaking things" on account of OpenDNS. Doesn't mean you and others can't disagree with that, but it's not as cut and dried as your statement seems to imply.
how about notDNS? though notDNS implies they don't serve domain names. How about, openDNS?
Actually, I don't like that one either, that implies they are open source.
How about, gimpDNS. There, I can get behind that one.
Does that sound like a harmless service? OpenDNS knowingly and deliberately broke the Internet for its customers. I have actually spent time debugging issues it caused just to find that the client was using their resolvers. They were not a free service, they were actively harmful. I am glad the profits are no longer there for them to keep up this malicious practice.
As jblow said the whole "no more ads" post reads as PR spin, same goes for your reply to him:
- growth numbers don't tell any story apart maybe from «many people read the "Open" part of the OpenDNS name and turn their brains off» [2].
- DNS nerds run their own DNS and keep away from openDNS for breaking DNS and invading privacy.
- not causing issues for most people doesn't disprove that it did cause issue for many people.
I do remember the browser landscape before openDNS and I'm quite happy to debunk your boasting attempt at being significant. The "search from the address bar" functionality has been around long before google chrome came to existence, actually it was in opera before openDNS existed and even better it allows to choose the search engine and use several with the use of a keyword. This was then added to firefox back in firefox 3. Again don't take my word for it and look a this 2008 post[3].
[1]: http://www.bortzmeyer.org/opendns-non-merci.html
[2]: http://beta.slashdot.org/comments.pl?sid=1297613&cid=2864072...
[3]: http://googlesystem.blogspot.fr/2008/06/searching-from-addre...
Two weeks ago, I had to swap my company's network over to OpenDNS because Google DNS was having an outage. And then a day later, I spent 2 hours trying to chase down a problem running something that turned out was a result of OpenDNS feeding a page full of ads to something that was expecting JSON.
You might not have broken things for all the people that continued to use your service, but you broke things for people like me. And this is a place where people like me hang out....
However robust an application is it can't handle being fed html ads instead if application spesific json.
When you are finished rethinking this you can go on to think a second time about censoring your wifes Internet access. Do onto others etc....
I also don't think OpenDNS is a tool of censorship, as it is so easily circumvented. I hope my children learn how to circumvent tools of censorship and this can be their first practice... Until then it reduces the risk of accidentally going to phishing websites.
Was the first version of Great Firewall also no censorship since it was easily circumventable?
> I hope my children learn how to circumvent tools of censorship and this can be their first practice.
Children, yes. I didn't comment on them.
I'm only pointing out that in this spesific case it had nothing to do with the robustness of the application.
More specifically: A better application might have warned you about the failing part so that you won't have to go looking for it. Fixing the problem would still include either replacing OpenDNS or working around it.
Well, now I think I'll switch over to OpenDNS as soon as they prove to deliver un-manipulated DNS service. One way less for Google to track me.
edit: does anyone know if Cloudflare is also in the DNS business, from the resolver side? I know they and Amazon (Route53) do DNS server hosting, but does Cloudflare also provide public resolvers?
Google says that they don't use Google DNS for tracking.
From the Google DNS privacy page: "We built Google Public DNS to make the web faster and to retain as little information about usage as we could, while still being able to detect and fix problems. Google Public DNS does not permanently store personally identifiable information."
They go on in some detail to say how and what they log.
More distributed resolvers (like with Cloudflare/Amazon datacenters directly linked to ISPs) would make this type of spying orders of magnitude harder (they must actively infiltrate the ISPs network instead of just tapping the DECIX/exchange switches, which e.g. German BND is ALLOWED to do!).
Shit, I'd pay for Cloudflare or any other service to build robust, interception-secured DNS servers. Or my provider, but providers have a shameful track record of building fast and reliable DNS servers.
It is a shame that the Internet has descended from a place where everyone could implicitly trust everyone into a hellhole of spammers, hackers, spooks and other retards. One cannot even trust that private two-way communication STAYS private because our own fucking governments have done everything to erode that trust.
It is bad times that one can trust Google to keep your data half-way safe, but your government not. It should be just the other way around!
Practically, a good start is to recognize that not all valuable communication mechanisms benefit all that much from minimizing latency of packet delivery. IOW, not all, in fact not even most, means of communication really need the kind of "apparently real time" performance that telephony requires.
Moving services that don't, to a protocol where the focus is on making mixing and anonymizing simple, reliable and robust; rather than simply max throughput and min latency, would make end user security and anonymity guarantees much easier to make. And, for many types of channels, this can be done without much at all in the way of negative side effects, given how fast the underlying switching infrastructure has gotten.
Current protocols were necessary for any kind of usability when hardware was slow and expensive. And good enough privacy and security vise, when even the NSA didn't really have the means to do much wide net spying at the network level. But neither of those realities of the original internet is true anymore. Instead, sorry for the pompousness, the new environment is so different as to require, or at least recommend, something almost akin to a "new internet." Built with the "new" threats to communication in mind.
I'm not working anywhere, at a startup nor anywhere else, that could conceivably "profit" from any of the above ramble. If what I'm saying makes no sense, it's because I'm a moron (or at least misinformed), not because I'm a scumbag.
Virtually all governments spy on their and other countries' citizens these days, not just the US. We Germans spy, the Brits and the rest of Five Eyes spy, the Russians spy, the Chinese spy, the Iranians spy and I bet that even North Korea has quite some good hackers.
And for the rest of your comments: indeed, a "new internet" would be required. But as you can see on the adoption rate of IPv6, we're stuck with this mess unless quantum computing forces us to switch.
Virtually all governments have ever done so, these days it's just easier.
I'm imagining a protocol for less tightly coupled endpoints could be written to, while the "switches" merely translate traffic to route it on current infrastructure. A more application agnostic version of mixmaster or TOR, so to speak. The important part, is really to get enough of a variety of end user apps written to it, to prevent anyone from knowing much about the traffic simply due to the protocol spoken. Then, over time, to optimize away more and more crud, until we've got dedicated hardware. It may still be a bit utopian, but the current mess isn't really serving people all that well anymore, either.
"Next to"? Google serves 130B queries per day on average[0]. OpenDNS only serves about 50B[1].
[0] http://googleonlinesecurity.blogspot.com/2013/03/google-publ...
Myself, I'm still wary of providing data to any third party. Maybe it isn't the case any more, but at least recently, OpenDNS stored identifiable logs forever and potentially resold that data.
Cloudflare has 24 datacenters[0]. Google Public DNS is deployed in 45 peering points over at least 16 metros[1]. I would be very surprised if Cloudflare/Amazon were more distributed than Google in this regard.
[0] https://www.cloudflare.com/network-map
[1] https://developers.google.com/speed/public-dns/faq#locations
It's unverifiable and they don't exactly have a clean record. I wouldn't take their word for it, specifically for something privacy related.
That being said I started using encrypted DNSChain servers, or OpenNIC ones when the former don't work, because of privacy concerns.
« They also keep permanent logs of all queries, which could be subpoenaed by a government entity. Their joke of a privacy policy allows them to sell your logs to "Affiliated Businesses", which pretty much means anybody. Not that it really matters - they could amend their privacy policy tomorrow morning and be selling your info by the afternoon.» http://beta.slashdot.org/comments.pl?sid=1297613&cid=2864072...
As much as I'd like to diversify the entities tracking me, I don't think I'll ever return to openDNS which is not to be trusted in my book, reading the spin that the "no more ads " is just comforts me with this idea.
http://www.privacyfoundation.ch/de/service/server.html
77.109.138.45
77.109.139.29
That's an excellent argument pro-ad blockers. Typically ad-blocker users are berated because they're 'stealing from the publishers' or something to that effect, but it makes good sense from a security point of view too. And it rationalizes so much better than 'the web is faster this way' (assuming that's even the case).
http://blog.fox-it.com/2012/03/16/post-mortem-report-on-the-...
It's hard to even tell who is serving up your ads sometimes without pulling out wireshark or some kind of HTTP proxy to look at the request chain.
It's true there are bad actors taking advantage of ad networks. There are bad actors hacking Wordpress installs too.
But I'd argue it's one less vector for infection, and an important one at that.
One of the top links is titled "OpenDNS vs. Google Public DNS" and points to : http://www.opendns.com/about/global-dns-infrastructure
There's no mention of Google on that page. How do I trust a company that's tricking users with misleading titles?
Did chrome or Firefox recently change the way they handle nonexistent DNS answers so that opendns '404 pages' would no longer work? If the writing was on the wall it might make sense for opendns to get ahead of it, since there wouldn't be much they could do to combat browser level changes.
Or:
Did google/yahoo not renew their search feed agreement with them to be the search provider and/or significantly change the rates? I know google has been coming down very hard on toolbar makers so perhaps this is googles way of getting out of that biz (And forcing opendns's hand)
Agreed. I can't imagine that the average person types in a bad domain name very frequently (compared to, lets say, the number of times they view a Facebook page each day). So you can't really sell a lot of ads this way. Also, if someone makes a mistake with a URL, they're not going to stick around very long to read an ad, since they're already impatient to be somewhere else.
Sometimes a cigar is just a cigar...
(By the way I think this change is awesome. Now if I could only get my cell phone provider -Tmobile cough- to stop hijacking my nonexistent-domain dns queries)
However, their lack of transparency on the business justification is a bit worrying.
A possible positive interpretation is that they hope to drive adoption and use this to make more money selling their other services.
Part of it was the browsers, and part of it was us not wanting to do lame techniques like pop-ups, flash ads, and other obnoxious things.
It was an arms race we weren't interested in participating in, and one we ultimately expected to lose. Who wants to fight a battle for a cause they don't even believe in?
I could think of so many things I'd rather focus our engineering talents on than maximizing how many nickels we could shake out of each user. So we decide to do make the change and focus on creating things of value instead.
PS: I would suggest you get additional DNS addresses that are easier. I mean, google's are so conveniently easy: 8.8.8.8 and 8.8.4.4. I can readily add them without giving them much thought after any installation.
Google's resources to get that > My resources to get that. :-(
The decision very well was probably made because they love their users. You just have to think about why they love their users (even free ones). The vast size of their userbase is what enables them to sell security services. Without a significant userbase overall, the ability to detect anomolies and security threats diminishes which in turn devalues their security offerings. By making the experience better for their free users, they retain users better and potentially grow their userbase, which improves the capabilities of their paid security services.
I find it hard to be too cynical when OpenDNS were one of the few companies to give DNSCurve a whirl.
The problem was our QA never caught it, since OpenDNS 'fixed' the request during testing. 24,000 emails later, we were instantly alerted to the bad link.
Are you hiring?
>This experience is one of the only reasons people cite to not use OpenDNS.
Yep, because people care about their privacy. I'm surprised OpenDNS didn't notice this before. I will probably start recommending them again now; after all, almost anyone is better to trust with something like DNS than google.
http://www.chaz6.com/files/resolv.conf
WARNING: Not to be used as is, be smart and only activate a handful of those DNS servers.
I wonder if there isn't a business case for highly QA'd ads? Or is there too little visibility into that for the average consumer to appreciate the value?
I only know I thought it was a malware and the first thing I did when I learned it was a DNS server was to change it.
Lots of people not using adblocking there.