Topics


Blogs


Forums


Samples


Media


Labs


Resources

 




DevCentral > Weblogs > Lori MacVittie - Two Different Socks
 If you don't know the difference between HTTP and DNS, don't blog about it
posted on Tuesday, September 30, 2008 8:19 AM

Pet peeve time: screaming technical inaccuracies in blog posts do a huge disservice to the root problem being discussed. If you're going to discuss hijacking DNS errors for the purposes of advertising, then please do so - don't call them DNS "error pages" (there are no such things) or refer to them as "404 errors".

angryman 404 is an HTTP status code indicating that the requested resource cannot be found. It is in no way related to DNS and, in fact, such an error code cannot be returned without a successful DNS lookup, which means there's no hijacking going on.

A DNS error indicating that no IP address could be found to be associated with a FQDN (Fully Qualified Domain Name) is just that, a DNS error. The "pages" displayed by popular browsers when a DNS error occurs are not even truly "pages" in the sense that a page lives on the web. They are generated by the browser and appear to be a page, but honestly a modal dialog box would work as well.

The reason I've got myself all worked up about this is that there is a serious underlying security problem with DNS "hijacking". It's a real issue that should be discussed and brought to light. The author tries, he really does. But a blog post littered with technical inaccuracies merely obfuscates the underlying problem because it's difficult to give the post any credibility because it is so technically inaccurate it leads the reader to question whether there really is a problem or not.

Either the aforementioned poorly written post is purposefully inaccurate in order to garner attention (possible), or it's just technically inaccurate because the author doesn't know or care about the underlying technical details (also possible).

Either way, such posts do a great disservice to those attempting to raise awareness of security issues on the Internet, because it's hard to take anyone seriously who can't (or won't) differentiate between DNS and HTTP. 

Follow me on Twitter View Lori's profile on SlideShare AddThis Feed Button Bookmark and Share



 
      

Feedback


10/1/2008 3:00 PM
Gravatar > don't call them DNS "error pages" (there are no such things)
> The "pages" displayed by popular browsers when a DNS error occurs are not even truly "pages" in the sense that a page lives on the web. They are generated by the browser and appear to be a page, but honestly a modal dialog box would work as well.

How can you expect normal users to determine the difference between a page that is an error and a "real" document? Remember, IE by default shows its own "friendly" error messages for 404 pages instead of showing what the server provided.

Too many already fall for banner ads that look like Windows dialogs...
Charles

10/2/2008 12:11 AM
Gravatar Well, FYI, if the original post contained the phrase "404 error" it is now gone. If it is the case, it is a bit sad that the author didn't acknowledge the original error by adding an errata section to his post.

However, be it as it may, he still has a point and Cablevision is just showing the same level of greed that got Network Solutions in hot waters a few years back. And that greed entirely relies on exploiting people's lack of technical savvy, even perpetuating it, which is a dangerous proposition.
Chris Ravenscroft
 Leave Feedback
Title  
Name  
Email
Url
Comments   
Please add 8 and 8 and type the answer here: