You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Ben Hyde <bh...@gensym.com> on 1998/03/22 19:46:51 UTC
www.apache.org.com
One can't guard against all the risks the paranoid mind can
invent, but one does have to guard against the dangers
actually demonstrated to occur nearby.
So, I needed to guard against naughty DNS. That of course
broke the build for a few days.
> nslookup dev.apache.org. 1.0.2.6
...
Address: 204.62.130.147
> nslookup 204.62.130.147 1.0.2.6
...
Name: taz.hyperreal.org
Address: 204.62.130.147
I fixed my fetch script to use that to be sure things seem ok.
But on the machine I actually run the script on it immediately
complained:
> rsh tha nslookup dev.apache.org 1.0.2.6
...
Address: 209.54.94.60
> nslookup 209.54.94.60 1.0.2.6
...
Name: okdirect.com
Address: 209.54.94.60
Which I didn't notice for a few days.
I failed to realize that I should assume the worse:
> nslookup my.pid.is.a.float.dev.apache.org.com 1.0.2.6
...
Address: 209.54.94.60
I.e. nslookup is very different between sunos and solarius.
Why bother with URI, just use huge virtual hosts.
- ben
Re: www.apache.org.com
Posted by Marc Slemko <ma...@worldgate.com>.
They registered org.com. They put a wildcard A record or something in.
No hijacking, just a broken resolver or resolver config appending .com to
domains it tries to resolve.
I was sure that, in the past, most <tld>.<tld> domains were reserved, but
they sure don't appear to be now.
On Sun, 22 Mar 1998, Martin Kraemer wrote:
> This kind of DNS highjacking is absolutely incredible. How can it be
> legal to register a domain
> www.apache.org.com (_and_ other *.apache.org.com domains)
>
> when there is an officially registered .org domain
> www.apache.org
> ? I am speechless at this kind of wild-west-highjacking.
> Ben is right: nslookup www.apache.org.com really exists, and leads
> to..:
> ProDomains has partnered with innovative companies to provide a
> variety of internet solutions.
>
> Martin
> --who hopes that there are ways to stop similar registrations in the
> future.
>
> On Sun, Mar 22, 1998 at 01:46:51PM -0500, Ben Hyde wrote:
> >
> > One can't guard against all the risks the paranoid mind can
> > invent, but one does have to guard against the dangers
> > actually demonstrated to occur nearby.
> >
> > So, I needed to guard against naughty DNS. That of course
> > broke the build for a few days.
> >
> > > nslookup dev.apache.org. 1.0.2.6
> > ...
> > Address: 204.62.130.147
> > > nslookup 204.62.130.147 1.0.2.6
> > ...
> > Name: taz.hyperreal.org
> > Address: 204.62.130.147
> >
> > I fixed my fetch script to use that to be sure things seem ok.
> >
> >
> > But on the machine I actually run the script on it immediately
> > complained:
> >
> > > rsh tha nslookup dev.apache.org 1.0.2.6
> > ...
> > Address: 209.54.94.60
> > > nslookup 209.54.94.60 1.0.2.6
> > ...
> > Name: okdirect.com
> > Address: 209.54.94.60
> >
> > Which I didn't notice for a few days.
> >
> > I failed to realize that I should assume the worse:
> > > nslookup my.pid.is.a.float.dev.apache.org.com 1.0.2.6
> > ...
> > Address: 209.54.94.60
> >
> > I.e. nslookup is very different between sunos and solarius.
> >
> > Why bother with URI, just use huge virtual hosts.
> >
> > - ben
> --
> | S I E M E N S | <Ma...@mch.sni.de> | Siemens Nixdorf
> | ------------- | Voice: +49-89-636-46021 | Informationssysteme AG
> | N I X D O R F | FAX: +49-89-636-44994 | 81730 Munich, Germany
> ~~~~~~~~~~~~~~~~My opinions only, of course; pgp key available on request
>
Re: www.apache.org.com
Posted by Martin Kraemer <Ma...@mch.sni.de>.
This kind of DNS highjacking is absolutely incredible. How can it be
legal to register a domain
www.apache.org.com (_and_ other *.apache.org.com domains)
when there is an officially registered .org domain
www.apache.org
? I am speechless at this kind of wild-west-highjacking.
Ben is right: nslookup www.apache.org.com really exists, and leads
to..:
ProDomains has partnered with innovative companies to provide a
variety of internet solutions.
Martin
--who hopes that there are ways to stop similar registrations in the
future.
On Sun, Mar 22, 1998 at 01:46:51PM -0500, Ben Hyde wrote:
>
> One can't guard against all the risks the paranoid mind can
> invent, but one does have to guard against the dangers
> actually demonstrated to occur nearby.
>
> So, I needed to guard against naughty DNS. That of course
> broke the build for a few days.
>
> > nslookup dev.apache.org. 1.0.2.6
> ...
> Address: 204.62.130.147
> > nslookup 204.62.130.147 1.0.2.6
> ...
> Name: taz.hyperreal.org
> Address: 204.62.130.147
>
> I fixed my fetch script to use that to be sure things seem ok.
>
>
> But on the machine I actually run the script on it immediately
> complained:
>
> > rsh tha nslookup dev.apache.org 1.0.2.6
> ...
> Address: 209.54.94.60
> > nslookup 209.54.94.60 1.0.2.6
> ...
> Name: okdirect.com
> Address: 209.54.94.60
>
> Which I didn't notice for a few days.
>
> I failed to realize that I should assume the worse:
> > nslookup my.pid.is.a.float.dev.apache.org.com 1.0.2.6
> ...
> Address: 209.54.94.60
>
> I.e. nslookup is very different between sunos and solarius.
>
> Why bother with URI, just use huge virtual hosts.
>
> - ben
--
| S I E M E N S | <Ma...@mch.sni.de> | Siemens Nixdorf
| ------------- | Voice: +49-89-636-46021 | Informationssysteme AG
| N I X D O R F | FAX: +49-89-636-44994 | 81730 Munich, Germany
~~~~~~~~~~~~~~~~My opinions only, of course; pgp key available on request