GigaOM » OpenDNS

As OpenDNS focuses on security, investors offer a Series B

Stacey Higginbotham — Tue, 26 Mar 2013 14:33:46 +0000

OpenDNS, the domain-name-server-provider-turned-security-company, has raised an undisclosed second round of capital as a Series B, and added Stefan Dyckerhoff from Sutter Hill Ventures to its board. The company, which last year expanded from DNS services to providing security optimized for today’s cloud environment, has seen its user base grow significantly from 3,500 to 7,000 enterprise customers. The funding will help it add staff and data centers to support the Umbrella security offering.

Domain name servers are an integral part of the internet, containing the IP address of domain names you type into a browser. When a user types in a URL, the computer sends the request to a DNS server that then tells your computer the site’s IP address. Control of DNS servers allows OpenDNS to provide a level of security no matter where the person logging into a network sits, because a company can enforce its policies at the domain name server, essentially refusing employees access to questionable or malicious sites before the content ever gets to the device. It also stops attacks way out in the internet as opposed to on the corporate network.

For those who want to know more about security threats facing corporations here’s a video interview with OpenDNS CEO David Ulevitch discussing how the adoption of the cloud and geopolitical instability has led to a new level of security threats:

Watch this video for free on GigaOM

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Deal with poor performers now [video]

Chris Albrecht — Fri, 03 Aug 2012 22:30:10 +0000

OpenDNS is on the verge of crossing over 100 employees. It’s growing is so fast that by the end of 2012, half of the company will have been there for less than a year. But as founder and CEO David Ulevitch discovered, not every employee is suited for the next stage of the company. Through internal satisfaction surveys and his own intuition, he realized OpenDNS was not dealing well with poor performers. Ulevitch points out that poor performance could be a result of a corporate pivot, or managers holding lower standards for their direct reports.

Regardless of why some people are poor performers, on this episode of See Founders Run, Ulevitch talks about the importance of not wasting time on those those who waste time.

Watch this video for free on GigaOM

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Hide DNS requests from friends, foes and the feds

Stacey Higginbotham — Tue, 06 Dec 2011 08:01:29 +0000

TOpenDNS, which provides a domain name system resolution service that aims to be faster and more secure than those provided by your ISP, on Tuesday launched a new product it hopes will make DNS look up more secure. The company launched DNSCrypt, software that users can run which helps prevent man-in-the-middle attacks on domain names and can also help anonymize your web site requests from prying eyes.

Domain name servers are a crucial part of the Internet, containing the IP address of domain names you type into a browser. When a user types in a URL, the computer sends the request to a DNS server that then tells your computer the site’s IP address. But DNS queries are vulnerable to both spying and attacks. From the DNSCrypt release:

Despite DNSSEC, and the global improvements resulting from Dan Kaminsky’s discovery of a critical flaw in the DNS, there remains an inherent insecurity in the DNS protocol itself: it is transported in plaintext, unencrypted and in the open. This insecure connection between the end user and their DNS resolver, which might be described as the “last mile,” is ripe for abuse, and has been abused in the past. The insecure nature of that “last mile” connection enables an array or attacks and privacy violations. In truth, Internet users have very little privacy when accessing the Internet on unsecured wireless networks and as a result, are left highly vulnerable.

OpenDNS CEO David Ulevitch compares the software to secure socket layer encryption for HTTP traffic (it’s what puts the “s” in https), except he notes that it doesn’t require users to route their traffic through a different port. Technical details aside, the software aims to prevent hackers from intercepting your requests for a domain name and taking the opportunity to insert a malicious site. If they succeed, hackers could send a user off to a web site that masquerades as a bank’s portal or a user’s email home page, in hopes of snagging some passwords or financial information.

It also prevents your Internet service provider or your government from seeing what sites you visit, which may become important not just in repressive countries, but even in the U.S., especially if the Stop Online Piracy Act (SOPA) passes. It does this by adding a layer of encryption between the user and OpenDNS. You have to be running OpenDNS for it to work, but Ulevitch says he hopes it won’t remain that way.

Ulevitch says the company will release the source code for DNSCrypt on Github, so developers can build interfaces for other operating systems and create new applications for people who desire a bit more privacy on the web. DNSCrypt is only available for the Mac. Downloads, code and more information can be found here. This is just the latest in efforts from OpenDNS aimed at keeping the web running smoothly, not just for big players, but for everyone.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

(Amazon) Silk or a spider web?

Om Malik — Thu, 29 Sep 2011 00:53:59 +0000

Updated on Sept 29 at 9.20 am PST: Of all the announcements from Amazon today, the most audacious one is the one that involves Silk, a hybrid browser that essentially pre-fetches the web, caches it and then serves it up to Fire owners. I was pretty intrigued by it the moment I read about it. It reminded me of Skyfire. However, it was later when reading this post by Chris Espinosa, I realized the implications of it:

…what this means is that Amazon will capture and control every Web transaction performed by Fire users. Every page they see, every link they follow, every click they make, every ad they see is going to be intermediated by one of the largest server farms on the planet. People who cringe at the privacy and data-mining implications of the Facebook Timeline ought to be just floored by the magnitude of Amazon’s opportunity here. Amazon now has what every storefront lusts for: the knowledge of what other stores your customers are shopping in and what prices they’re being offered there.

Woah! That is a pretty big deal. I tried to get more clarification from Amazon’s spokesperson, who emailed me back that “Usage data is collected anonymously and stored in aggregate, thus protecting user privacy” and pointed me to the FAQ page. I still don’t get it, and I am waiting to chat with Amazon (tomorrow) to get further information.

Updated on Sept 29 at 9.20 am PST: A spokesperson for Amazon just pinged me back:

“Is Amazon able to peer into its customer usage behavior and use that to offer services based on that data. For instance if you see thousands of your customers going to buy SeeVees shoes from say a store like James Perse at a certain price, can you guys use that data to specifically tailor the Amazon store and offer up deals on those very same pair of shoes?” – the answer is no, as you can see in our terms and conditions, URLs are used to troubleshoot and diagnose Amazon Silk technical issues. Moreover, you can also choose to operate Amazon Silk in basic or “off-cloud” mode. Off-cloud mode allows web pages generally to go directly to your computer rather than pass through our servers. As a reminder, usage data is collected anonymously and stored in aggregate, and no personal identifiable information is stored. It’s also possible to completely turn off the split-browsing mode and use Amazon Silk like a conventional Web browser.

I asked David Ulevitch, founder and CEO of OpenDNS, an Internet security and managed DNS service, for his impressions. Here is what he had to say.

I think it’s brilliant. Not sure if people are wary of Amazon doing it since they will see all your traffic but SOMEONE should be doing this. Performance is one reason, but security benefits could be added too. Ultimately I think the idea of decoupled browsing makes a lot of sense. I’d rather a remote exploit run in a VM in the cloud instead of compromising my mobile device and rooting my phone.

But the caveat is that this is Amazon. People hand over all the cards to Google but they feel the exchange of value is worth it. But it took nearly a decade for people to even recognize they were giving something of value to Google. Armed with that savvy that exists now, consumers now know they are giving something to Amazon — so the burden is on Amazon to say how it will use the data or make the benefits so compelling that consumers don’t care just as Google does. It’s worth remembering that Google is open in many areas, but none of their openness is in the areas that matter.

So what do you guys make of Silk? Is the privacy concern for real or overblown? Love to get your thoughts.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

OpenDNS and Google team to speed up the web

Stacey Higginbotham — Tue, 30 Aug 2011 10:00:13 +0000

A few million Americans may find their YouTube requests get delivered faster on Tuesday as Google, OpenDNS, ~~VeriSign~~ and several content delivery networks announce the Global Internet Speed Up effort.

As the web scales and bandwidth demands rise, finding ways to deliver faster content is pushed out to the edge of networks, because the aggregated demand at the core would be too much to support and would add delays in delivering content. The Speed Up effort tries to take this another step further by making sure a user’s request for a content goes to a server near her, making delivery faster and more efficient from a bandwidth perspective.

At the center of the partnership between DNS providers and participating CDNs is the creation of a standard that attached location data to a DNS request so a user’s request for content goes to server nearby. Typically, a CDN or content provider routes a user based on the address of the DNS server, as opposed to the user’s location, but they aren’t always in the same region.

So now a user in Austin, Texas who types in the URL for a YouTube video will share part of his IP address as part of the DNS request. That way, the domain name system server can route the request to a Google data center in Dallas, as opposed to one in Ireland. It’s a simple idea, but it could result in faster access to content for ISPs and CDNs that elect to implement the open source code that makes this possible. David Ulevitch, CEO of Open DNS says the standard has been submitted to the IETF, but has not been ratified. The IETF is a standards body that governs protocols for the Internet.

For now, only users of Google’s Public DNS service, OpenDNS and Verisign will send out DNS information with a snippet of information gleaned from the user’s IP address. That will help the domain name servers that direct traffic around the web to send that traffic the closest provider. As for privacy concerns about attaching IP addresses to a DNS request, Ulevitch says the information only goes to companies that would see the IP address in a typical HTTP web request, so it’s not sharing any more information than is typical.

On Tuesday, when the new code is implemented, the 30 million Open DNS users and Google’s Public DNS service users visiting content hosted on the participating CDNs will immediately benefit. Ulevitch didn’t have a sense of how much improvement users might expect, although he did say it wouldn’t get worse for anyone. He hopes ISPs will also adopt the standard as well as more content delivery networks. Right now, Edgecast, Contendo, BitGravity and a few others are on board, but leaders such as Limelight or Akamai are not.

So perhaps this could be the beginning of an open effort to improve the web, or perhaps it becomes another niche effort that makes web sites a bit faster for a few people when they visit selected sites. With Google on board, however, that’s still a lot of sites.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

The five levels of ISP evil

Dane Jasper — Sat, 13 Aug 2011 00:00:59 +0000

Edit Note: This is a guest post by Dane Jasper, CEO of ISP Sonic.net. The post can also be found on the Sonic.net CEO blog here.

Recently a number of ISPs have been caught improperly redirecting end-user traffic in order to generate affiliate payments, using a system from Paxfire. A class action lawsuit has been filed against Paxfire and one of the ISPs.

This is a serious allegation, but it’s the tip of the iceberg. I’m not sure if everyone understands the levels of sneakiness that service providers can engage in. So, while I’m no expert (as we are an ISP who doesn’t do these things), but as a broad overview, here is my quick guide to the five levels of ISP evil, and the various “opportunities to monetize customers” that we’ve passed on:

5: Improper NXDOMAIN handling, also known as “Domain Helper” applications. When a customer attempts to visit an invalid site, instead of returning the RFC standard “no such domain” response, the servers provide a search result which includes sponsored links. Sometimes the results are not well matched to the mis-typed domain, and they promote ads instead with broad commercial appeal like insurance, which will generate a high payout if the customer clicks. Extra evil points for making it difficult to opt out of this, requiring opt-out via a cookie or browser setting rather than providing “clean” DNS servers. (Paxfire’s system is positioned as a search/helper application, but these systems can be easily converted, even without the ISP’s awareness, to an affiliate pumping system.) Evil score: 2 evil points, somewhat evil, but now every major access provider provides helpful results for address typos.

A diagram showing how Phorm's "Webwise" system creates copies of its tracking cookie in each domain the end-user visits, based on the report published by Richard Clayton. Wikipedia.

4: Clickstream Tracking. An ISP is in the unique position as the point of traffic origination, creating the opportunity for very in-depth analysis of Internet usage behavior. Tracking the user’s Clickstream, the site to site to site movement as they browse using a set of tools like Phorm allows service providers to create cash out of information about private use of the Internet. Clickstream data buyers are generally ad targetting; if you visited Ford.com and looked at F-250 trucks, then CNN.com, it might make sense to place ads for large Chevy trucks on the CNN page rather than an ad for fabric softener. Absent this prior knowledge that you were a potential truck buyer, the ads might be for something of less interest to you, and thus less likely to be clicked, to “monetize”. Over time, analysis of the complete Clickstream can provide lots of insight to advertisers. Extra evil points for selling the Clickstream data without telling customers. Evil score: 5. What you do online is private!

3: Ad Swapping. Transparently proxy all web traffic, and when ad banners are in transit, perform real-time swaps of the ads for other ads for which the ISP is getting a cut of the revenue. Legitimate advertiser ads are sometimes fetched so that no one notices the decline in impressions. The pitch to ISPs from companies like NebuAd sometimes included claims of “partnerships” with content sites to better target ads. Extra evil points for ISPs who provide demographic data to the firm running the ad-swapping system. Evil score: 6.

Our reply: "No, not interested, thanks. -Dane" Email reply to Mark Lewyn, President, Paxfire Inc., Wednesday, October 29, 2008 3:35 PM

2: Affiliate Program Pumping. As alleged in the Paxfire scheme, ISPs or their accomplices take incomplete or incorrect domain entries into the URL bar and direct them to an intermediate page, which redirects transparently to a URL which includes an affiliate tag. So, a consumer types “amazon”, and rather than returning an NXDOMAIN, or even a search result, the ISP DNS server directs them to an IP address which does a content reload toward a URL of the form amazon.com/affiliate-id=XYZ. Purchases made subsequently are compensated as if it was legitimate traffic from an affiliate. Evil score: 8, with a bonus point for poisoning the affiliate ecosystem.

1: Rolling Over. In an attempt to avoid costs or under pressure from government or content creators, ISPs have handed over customer information, and even subjected customer traffic to broad snooping. Allegations range from service providers simply quietly handing over customer info to law firms with improperly filed lawsuits and incorrectly served supoenas, to the physical wire-tapping of major fiber optic lines. We’ve got your back. Evil score: 10. Potential for human rights violation.

I’ve got more to say on this last topic, but there is a clock that must run out before I am permitted to write. Tick-tock, a couple days to go.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Another Wave of Infrastructure Apps

Gary Orenstein — Tue, 05 Oct 2010 19:10:40 +0000

Recently, I took a look at the arrival of infrastructure apps. In the past, application developers often had to build a host of additional supporting functions, many of which required their own physical infrastructure. Today’s cloud computing platforms give rise to a new class of web-accessible application support functions, aka infrastructure apps, that replace costly integrated hardware and software.

For this round, I’ll look at companies that share these common themes:

They market to application and infrastructure developers.
They have a simple sign-up button on their home page.
They integrate through simple web-based mechanisms that turn conventional deployment times of days or weeks into minutes or hours.

Transactional email. Most applications, consumer to enterprise, rely on email as a communications mechanism with users. With a large user base, sending users something as simple as notification emails can be challenging with spam filters, blocked IP addresses and other email hurdles that complicate the process. SendGrid helps improve the chances that the email you send will reach a user’s inbox. SendGrid does this by using its email servers as a proxy, and maintaining the purity of the IP addresses, one of the biggest email management challenges

Compute-intensive cycles. While it’s getting easier to “dial up” virtual machines in the cloud, some applications still need instant access to compute cycles for CPU-intensive functions: for example, in the software development process and with math-centric calculations. Without having to actually spin up your own server, PiCloud allows application developers to send functions to the cloud where they are executed and returned. The company is initially focusing on the Python programming language, but I see no reason why this couldn’t expand later on.

Network services. Network services have been hosted for years, but the integration and simplicity of deployment has dramatically increased with cloud computing. Managed DNS is one area that is seeing rapid innovation. The Domain Naming System (DNS) maps web address domain names to network IP addresses, and companies using a DNS service benefit from improved security. OpenDNS and Zerigo provide ready-to-go DNS services.

Database as a service. Every application needs a data store, and if you know what you need at that level, why not let someone else manage it? That’s the premise behind the service offering of Cloudant, which offers a version of CouchDB in a shared cluster that’s ideal for development and small- to mid-sized applications. Instead of buying and configuring a database server, you can dial one up in the cloud.

Indexing and search. Our real-time world demands up-to-date search, and Solr, the “blazing fast open-source enterprise search platform from the Apache Lucene project” helps companies provide just that. Websolr, a company that provides support for Solr, also offers managed indexes. In this case, they host the index of your content in their shared cluster and can manage and optimize performance.

More segments are adopting the infrastructure apps model every day, and when people think outside the consumer web box, there are significant investment areas. Are there more infrastructure app areas that we’ve missed?

Gary Orenstein is the host of The Cloud Computing Show.

Photo courtesy of Flickr user michaeldbeavers.

Related content from GigaOM Pro (subscription req’d):

Google Says Public DNS Is About Speed, Not Ads

Liz Gannes — Thu, 03 Dec 2009 19:19:53 +0000

Google today launched a product called Google Public DNS that can be installed as an alternative to the DNS systems offered by network providers. If you want to configure your network to use it, go here.

Google says the purpose of Public DNS, which resolves domain names to IP numbers, is to make the web run faster for users, and early reports confirm a noticeable speed increase. The company says it will not block, filter or redirect DNS responses — which is what competitors like the startup OpenDNS provide as a service to prevent users from phishing and other attacks and to monetize domains that aren’t yet resolved. (Personally, I can see the benefit of those redirecting services, but it irks me that they mess with my precious Firefox URL bar “I’m feeling lucky” searches.)

However, Google does say it will step in to combat spoofing and denial-of-service attacks by doing things like checking the validity of nameservers’ responses, making requests more random and removing duplicate queries.

Plenty of people fear Google’s big brotherish tendencies, and this service may not be for them. But the company maintains that this is not some new personalization and ad targeting scheme. Google Public DNS will only store IP info for 24 hours, and will not connect with users’ Google account or the company’s advertising products.

David Ulevitch, Founder of OpenDNS shares his thoughts on Google DNS and the importance of DNS in the internet infrastructure. “When you use Google DNS, you are getting the experience they prescribe. When you use OpenDNS, you get the Dashboard controls to manage your experience the way you want for you, your family or your organization,” he writes.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Vid-Biz: iPlayer, Guitar Hero, Atlanta Braves

Chris Albrecht — Fri, 08 May 2009 17:02:36 +0000

Everything You Wanted to Know About the BBC iPlayer; the web TV service pushes out 12GB of data every second, and people are watching it on their iPhones when they go to bed; more facts in this in-depth story. (CNET U.K.)

Guitar Hero TV? Talks are underway to turn the popular music video game into a reality show. (The Hollywood Reporter)

Atlanta Braves Allow Fans to Create Content; organization partners with FanSection to let select fans create a series of web videos about the team. (MediaWeek)

Atom’s New Web Series Combines Puppets and Police; The Fuzz will also be adapted by Comedy Central into a pilot presentation for TV. (Broadcasting & Cable)

OpenDNS to Blame for Qwest Video Problems? The free service used to speed up downloads could be the culprit in choppy YouTube experiences. (Consumerist)

StupeFlix Uses APIs to Create Video; service can create videos out of pictures by editing XML. (TechCrunch Europe)

MPAA to Teachers: Don’t Rip DVDs, Video the Screen; instructional video shows educators how to camcord movies from a flat-screen monitor. (BoingBoing)

MPAA shows how to videorecord a TV set from timothy vollmer on Vimeo.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.