Subject: Re: [ietf] DNS spoofing at captive portals

From: Rich Kulawiec <[email-masked]>
Date: Tue, 5 Oct 2010 13:00:26 -0400

On Sat, Sep 25, 2010 at 10:34:15PM -0400, John R. Levine wrote:
> >Hmm.  Are you talking about SiteFinder-like services?
> 
> Not really.  There turn out to be a significant number of domains,
> in the hundreds of thousands at least, that are purely evil. 

IMHO, "tens of millions" is closer to reality.

(This of course depends on what one's definition of "purely evil" is,
but mine includes "anything set up solely for spam, attacks, malware,
or resource exploitation".)

But your [larger] point remains: while you and I and others are skilled
at spotting such domains and at handling them appropriately, we're
a tiny fraction of "all Internet users", so it's arguably a service
to prevent all of those from blithely accessing the web sites/mail
servers/DNS servers/etc. associated with those domains.

---rsk