Paxfire

» see paxfire.com as it lived, on the wayback machine

~ the obituary ~

Paxfire sold a box. You bought it if you ran an internet service provider and you wanted a second revenue line out of your subscribers without having to ask them for anything. The product was called HotWords, the pitch on the company's own early homepage was five words long, generating new revenue for ISPs, and the mechanism was this: when a subscriber typed a keyword or a mistyped domain into the address bar, the appliance caught the lookup at the network level and returned a page of sponsored links instead of an error. Nothing was installed on the subscriber's machine. That was the selling point.

Mark Lewyn, a former USA Today technology reporter, founded it with Alan Sullivan and ran it from an office on Fountain Drive in Reston, Virginia. The company won a local business plan competition, took state innovation funding, and got itself named one of northern Virginia's up-and-coming firms of 2004. It signed telephone and cable companies under non-disclosure agreements, so for most of its life nobody outside could say who was actually running the box.

Then in 2011 somebody looked. Researchers at Berkeley's International Computer Science Institute, working with the Electronic Frontier Foundation, found the appliances were doing more than typo pages. Searches for plain brand names, apple or dell typed into a search engine, were being pulled out of the stream and pushed through affiliate programs, so the provider and Paxfire collected a commission on a click the user believed was organic. Yahoo and Bing were being proxied. Google had been too, until Google pushed back hard enough to stop it.

~ the case file ~

~ the suit and the countersuit ~

A class action landed within days. Betsy Feist, represented by Milberg LLP, sued Paxfire and RCN in the Southern District of New York on federal wiretap and state law grounds. Paxfire's answer was not a defense, it was an attack: it countersued Milberg and Feist personally for defamation and tortious interference, and asked for fifty million dollars.

The countersuit outlasted the company. Paxfire filed for bankruptcy in the Eastern District of Virginia in December 2012, roughly sixteen months after the EFF post went up. The case kept going anyway. In January 2017 the court granted summary judgment against Paxfire's counterclaims, leaving it nothing, and Feist's own claims were then dismissed as moot because she had already stipulated to cap her recovery at whatever Paxfire recovered. Paxfire recovered zero. An appeal reached the Second Circuit and was still producing opinions in 2019, seven years after the plaintiff had ceased to exist as a going concern.

~ the part that did not die ~

Turning a failed DNS lookup into an ad page was never unique to Paxfire and was never confined to America. If you were online on a consumer connection in the mid 2000s, anywhere, you almost certainly hit a search page you had not asked for after fat-fingering a domain, and you almost certainly blamed your browser for it. The resolver you use is the one your provider hands you. I spent that decade on TTNet and never once chose mine.

There was a security cost sitting on top of the commercial one. Dan Kaminsky found serious vulnerabilities in the way the appliance handled DNS resolution, which is what a box gets for inserting itself into a protocol: it inherits every failure mode in it. The real obituary here is the research paper. Paxfire was measured, and then it was over.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »