Just 216.239.37.99 It
 

Google died at the weekend. Well, google.com did anyway, as did co.uk, .fr, and seemingly all the other regional variants of the world's most popular search engine. As Neowin reported at the time, the site was down for less than an hour for most users - but responses posted here and at other tech sites to the news showed just how lost users felt without a search engine which has become part of their lives.

Google's blaming a DNS problem for its sudden disappearance of the web. But what happens when such a site goes down - something so many web users have come to rely on? Not only Google was affected; Gmail, its free webmail service, disappeared off the face of the net at the same time. Users who had bookmarked the IP address for the site were still able to access it - but for everyone else, there was no Google. Yahoo!, once again, became the search engine of choice for many - after, of course, they tried to use Google to find out what was wrong with, erm, Google.

This shows just how dangerous it can become to rely on one source. OK, so it's not likely that Google will suddenly have massive debts, go into liquidation and disappear altogether tomorrow. However, it's always a possibility that things could change very rapidly on the net - remember, there was one time Netscape was seen as the browser of choice, a situation many envisaged lasting forever. The sheer volume of the outcry from surfers trying to use the site - which, depending on your own DNS, was down for as little as 15 minutes - shows the affect one collapse or disappearance can have. This instance wasn't related to DNS poisoning; however, if such a situation happened in the future, it's clear that many users would, quite simply, be lost.

One of the issues thrown up by the sudden collapse, however, was the problem of auto-URL checkers built into many browsers. In particular, Safari is going to draw criticism here; Mac fanatics, please put away your flames.



The problem emerges when a popular .com disappears. Many browsers try other variants of an address until they find one that exists - in this case, google.com.com google.com.org and google.com.net. The first problem is that they do this at all, without asking permission; the second is that they simply append an extra TLD to the end of the existing address, as opposed to replacing the existing one (surely google.net would be a more likely replacement?). The third, much more serious issue is that - in Safari's case - there's no mention that users are now visiting a site other than the one they requested. The address bar continues to say http://www.google.com. But visitors are faced with a page called "SoGo Search" - the .com.net variant.

This added confusion to the despair, with many believing (and understandably so) that Google had fallen victim to a DNS attack. After all, if google.com is now pointing to something called SoGo search, without description, and with undoctored screenshots showing exactly that behaviour, it's the logical conclusion. It also has security implications; what if Citibank's site had problems and visitors ended up at citibank.com.net or some nefarious equivalent - a site which looked identical and enticed them to enter their details, and which appeared to be citibank.com, but which was in fact run by some malicious pharmer out to pick up bank account info?

Before this weekend, that might not have seemed so far-fetched. After all, DNS poisoning is possible, but despite the scare stories it's not exactly common. Now, though, it seems something much simpler could lead to this sort of situation. It's not exactly tough for a site to be taken offline - be it with a DDoS attack, physically pulling the plug, or indeed the site simply falling over itself and someone being in the right place at the right time.

So, lessons to be learned from this:
1/ Browsers need to show exactly what site they're visiting; and this frankly bizarre behaviour of redirecting to a page with a double-TLD because the first site doesn't exist is pointless;
2/ The appearance in a Whois check of something like GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM - used by many to prove DNS poisoning - is nothing of the kind, it's simply someone adding a rogue DNS record for their site (the last part before the TLD);
3/ Gmail is a free service. The number of people screaming about not being able to access mission-critical e-mails because it was down was scary. Sure, it's normally very reliable; but if something is that important, shouldn't you have a backup? Or - and I know this goes against the grain in the internet climate - maybe consider paying for professional hosting, as opposed to using a free service just because it sounds cool?; and
4/ Either remember, Yahoo! is still around; or bookmark http://216.239.37.99/. After all, you never know when you might need it...

View: Google | Gmail

News source: Neowin
Full story: View Here