Any workarounds for Verisign .com/.net highjacking?

[Seth Kingsley]

On Tue, Sep 16, 2003 at 06:04:17PM -0600, M. Warner Losh wrote:
> Agreed.  but it wouldn't be too hard to determine at boot/hourly doing
> a bogus query to find the address of the moment.  Even they would be
> hard pressed to change things more than hourly.

In the document VeriSign distributes on the *.com spam portal, titled
Site Finder Developer's Guide (an entertaining read):

http://sitefinder.verisign.com/pdf/sitefinderdevguide.pdf

they describe the procedure for applications to determine if a match is
the result of an actual domain record or the wildcard.  This consists of
comparing the returned address to the record for *.com.  If the resolver
could cache this value, it would be easy to keep up with VeriSign's
current canonical spam host:

% host -t a \*.com
*.com has address 64.94.110.11

-- 
|| Seth Kingsley || sethk at meowfishies.com ||
|| http://www.meowfishies.com/ | Meow ^_^ ||
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-hackers/attachments/20030916/fc4a4465/attachment.bin