Interesting, not unexpected.

Well lets start with getting rid of Email. Just rip it out, it's a total mess.  IM is pretty
good at avoiding spam. Being fairly realtime means that it's difficult to hide the origins and
such and authentication is stronger.

And FTP. That's a good one to get rid of. What you'll do to replace it is anybody's guess.
Unfortunately.

So that's about, what, half the Internet? A big job to be sure.

And then there is some issues with TCP/IP that would be lovely to have resolved. Oh well.

Still I've always hated Email. I would applaud it's demise. I mean it was great when it was
new, but it's time has moved on. Just like Gopher's.

The exact numbers are probably not accurate. It's in the interests of people running such
tests to find problems to overstate, just as it's in the interests of corporations and
networking companies to understate. The distribution of unpatched/insecure machines will also
be non-uniform and non-random, making an overall statistic hard to interpret. The truth is
rarely out there, in any objective sense, but a subjective feel for the scale of the problem
is probably good enough and an order of magnitude error won't change that nearly as much as
it'll change the number itself.

I believe the idea is that open resolvers can be utilized as traffic boosters in a DoS
situation, think spoofed source address and the fact that replies are much larger than
queries.

I am guilty of this myself but remain unconvinced so far that this attack is actually used in
practice. Over the last five years I have never seen a DNS reply flood, and even if this
becomes a problem traffic limiting may even be more effective. I find it important to keep the
net as open as possible as this is what kept it functioning over the years.

This of course is a separate problem from poisoning DNS caches. The easiest way to completely
avoid those attacks is to separate the resolver and the authoritative DNS in two separate
entities. This is considered best practice by now and something every administrator should do.

> what is the problem with open, recursive resolvers?

As far as I can understand, open recursive resolvers, or "open recursive name servers", are
DNS servers that are incorrectly configured to answer DNS requests recursively for public.
(Normally there are two types of DNS servers: authoritative ones which answers queries using
their own information to the public and never initiates queries themselves, and caching (or
recursive) ones which answer queries from only a limited (reads: trusted) set of computers and
will "recurse", i.e., initiate queries to find answers to queries that they don't know how to
answer themselves.)

The two properties that don't mix are (1) public and (2) initiate requests to get others'
information.  With both of them, an intruder can make a request to that open recursive
resolver, hoping that it will not know the answer right away and thus would initiate a
request, and fake a reply to that anticipated request.  (The DNS mechanisms to disambiguate
different replies from requests are not meant to be secure and thus not strong enough to deter
intruders.)  This causes the cache of the resolver to be "poisoned", i.e., hold information
that is faked and decided by the intruder.  E.g., from then on mail.google.com might be
pointing to their servers instead of yours.

Such incorrectly configured servers are always a problem for the users of these servers.  As
other noticed, if they instead fake entries to point to a web site, that site will suddenly
receive a huge load of traffic.  So they are a problem for those running a server.

But they can be problems for others if intruders can cause somebody to "become" a user of that
server.  E.g., if a worm somehow causes your /etc/resolver.conf to be overwritten and point to
such a misconfigured DNS server, then you become a user.  Admittedly this requires that the
intruder already has access to your computer, but this can provide an easy back-door.

Ah right, thank you for the correction.