OfTheWorldTV is a new type of online television network. Comprising of 7 broadcast channels and 6 on-demand libraries, OfTheWorldTV aims to provide you with the best independent media from around the globe.

The first documentary that I saw was Grocery Store Wars featuring organic vegetables like “Cuke Skywalker” and “Yogha” (tub of yoghurt!) fight back the dark side comprising genetically modified and pesticides-covered foods. A light-hearted way to evangelise an important issue.

No related posts.

The speaker was Mr Liew Mun Leong – President and CEO of CapitaLand. CapitaLand is a one of the largest property companies in Asia and is based in Singapore. Properties are really not my cup of tea – I’m living in sugar coated siliconland where things are built virtually, real estate is tad too real for me. Nonetheless, I’m glad I went. Mr. Liew is a very eloquent speaker who engaged his audience with intriguing figures and inspiring insights. Instead of summarizing what he said in words I decided to podcast it instead.

Listen to it

The opening speech was made by the Permanent Secretary of the Prime Minister’s Office, Mr. Chiang Chie Foo, who also announced the new Overseas Singaporean Portal for those of you who miss home.

Here’s a pic of the speaker so you can put a face to the voice:

No related posts.

The idea is simple – point your DNS resolver to their name servers. What you get in return is faster cached results and phishing site blocking. They make money by advertising on the pages returned when you make a spelling mistake in the domain name. OpenDNS also claims to have “caches at the major intersections of the Internet” though I have not been able to get to anywhere but their California Verio site (tried tracerouting from Australia, US east coast and west coast.) So, I’m not sure if they are using anycast.

Having done some preliminary technical evaluation of the service, here are my thoughts (feel free to disprove me):

1. It would be pretty difficult to scale a service like this and make it resilient to DDoS attacks. In order to support typo-correction, they reply to queries for non-existent domains with an A record to their web server with a 1-second TTL value. This effectively tells the client not to cache the record, and because it is not an NXDOMAIN status no negative caching is possible either. What this means is that their name servers will have to answer the same query multiple times within a short time frame for non-existent domains (even from the same client).

2. They have a preference page that allows users to turn on/off the typo-correction and phishing-blocking features by the user’s IP address. I don’t know how they are going to solve the potential problem of clients behind NAT changing the settings thinking that they’re the only one using it. I tried turning off both the features, waited, and tried again. This time, non-existent domains are replied with an NXDOMAIN answer. However, this differs from the behavior of most modern recursive name servers in that it does not return the SOA record of the parent domain with the TTL set to the SOA “minimum” field value (used for negative caching.)

3. Shifting DNS resolution responsibility from the ISPs to OpenDNS is going to be a big problem. This essentially shifts the point of failure out of the hands of ISPs and into a single vendor. ISPs will no doubt loath them for it because of the possible increase in support calls because people start messing with the DNS settings on their machines and broadband routers. Just imagine a user starts using OpenDNS now and it works fine. Three months down the road, somehow he is not able to connect to OpenDNS’s name servers (maybe because of some routing fault between his ISP and one of OpenDNS’s). He’s not going to remember that he had configured his home router to ues the OpenDNS name servers and may think that his Internet is down. So he rings up his ISP, and the support person on the other line would have to spend at least 30 minutes trying to diagnose a problem that wasn’t even theirs to begin with. If an ISP had enough of it, it might decide to block udp/53 access to OpenDNS’s name servers. Worse, they may even block DNS request to anywhere but their own name servers.

4. OpenDNS’s FAQ has an entry that clarifies why its service is different from Verisign’s SiteFinder. Those statements are true. However, Verisign running SiteFinder affected only the zones that they operate (COM and NET at that point). Now, users of OpenDNS will have the “feature” for ALL TLDs including .GOV, .MIL and .CN, to name a few that would raise controversy.

5. Running an open recursive servers also opens them up to the risk of DNS cache poisoning, and having a large user base would make them an attractive target for the baddies. Instead of poisoning the caches of some small ISP shop, they can target a much larger audience.

6. They are using the same order for the first and second name server IP addresses on their web page. So, users will follow the instructions and configure their system with those IPs in that order. The way I understand most resolvers work is that unlike NS records which sometimes get returned in random order, the first name server is always hit first, and if no response is received only will it consult the next name server. This would mean a much higher load on the first IP than the second IP.

7. At the recent ICANN at Marrakech, I have seen trademark holders getting very defensive over typo-domains that resemble their company / product names going to an ad-laden page (which may eventually brings the user back to the intended site but it could also lead the visitor to a competitor.) At the Domain Name Marketplace Workshop, fellow panelists Sarah Deutsche (Verizon representative) and Paul Stahura from eNom were arguing over some “variations of [their] Verizon and SuperPages trademars” registered by eNom – on stage (transcripts can be found here)!

My point is that – running an ad-sponsored service that intercepts all typos across all TLDs has the word LAWSUIT written all over it. So, good luck to OpenDNS.

Don’t get me wrong, I think it’s a noble and novel idea. If they can address the above concerns and pull it off, I would use it especially if they do deliver the faster response times. To be fair, it is pretty darn fast for me already considering the packets have to travel across the pacific ocean to get to the server and back.

I also have great respect for David Ulevitch for running the excellent EveryDNS service (which hosts the DNS for dready.org.)

Full Disclosure: I work for NeuStar – the registry operator for .BIZ, .US and .TRAVEL. This post is in NO WAY representative of my employer’s position. This is just my personal opinion.

Related posts:

1. Optimizing Autocomplete by Utilizing Browser Cache Say you have a snazzy AJAXified autocomplete field that gives instantaneous feedback to the user as she types — perhaps...