Public DNS Servers

As the stake technology specialist and the local tech in my ward I have had people ask me about options for filtering the internet in their homes. We have had General Authorities and even our local Mission President call for parents to install some filtering and people are asking questions. I have considered the options and have decided that for the basic safety net most of my friends want DNS filtering is a great option for a variety of reasons:
1. No software installation is required on the local PC. This is big as we all know Windows goes down on it's own, no need to add additional software.
2. Protects other devices. Now that the Wii, PS3, Xbox and iPods can access the web, software is not an option.
3. Protects visitors. With schools giving out laptops and some teens getting their own laptops it is nice to know that anyone on your home WiFi network is protected from accidental access.

For those who are not familiar with how this works here is my attempt at simplification. A DNS server is contacted every time you type in a website name to resolve the IP address. Think of it as the operator in the old days; you didn't know the person's phone number so you called the operator and she looked it up and patched you thru. So when you type in www.yahoo.com, your computer contacts the DNS server and asks for the IP address for the Yahoo domain, it then contacts the computer at Yahoo using the IP address the DNS server returned. There are few sites anymore that will work without this lookup process.

A filtering DNS server has a modified list of domain names. If your PC requests a website that is on the block list the server does not give your PC the IP address, it instead forwards you to a page that informs you the page has been blocked. Unless you have another way of getting the IP address you will not get to the site.

The neat thing about this is that you can choose your DNS server. Yes, you get a DNS server free with your internet service but you don't have to use it! If you have a home router for high speed internet you can simply open the settings and change the DNS server you want to use so you use one that is filtered. If you don't then you simply have to change the DNS server setting in Windows, Wii or whatever device you are using.

Currently I only know of one free service that enables you to use this method of filtering and it is OpenDNS. They currently require you to create an account, setup your filter levels and either configure your router to update them with your IP address as it changes or install a small utility to do this on one of the PCs in your house.

My hope in posting this is two-fold; first I want to let people know about this simple safety net that is available. I would also like to encourage The Church to consider setting up a pair of these servers up to make it even easier for parents to setup simple filtering. I have used the PCs at our FHC and the filtering seems to be setup similar to OpenDNS so they may already have the servers, they just need to publish the IP addresses. If The Church would make these available then the account setup process currently used with OpenDNS could be skipped and people would simply have to change the IP address of their DNS server in their router.

This is not a bullet proof solution but then again what is. It is just an idea that I think could use some attention.

rogerscr wrote:This is not a bullet proof solution but then again what is.

Welcome to the forum.

As you say, not bullet proof. It's probably one of the simplest systems to defeat. Just look up the IP on a website or ahead of time and use the IP address instead of the site name.

I'm not sure what the church uses, but I think it's more sophisticated then that. I don't think that trick will work on it.

You make a good point about other computer devices in the home. So a good solution would be to filter at the router.

Actually using a lookup site to get the IP is less effective than one might think. I just did a lookup of LDS.org and got 216.49.176.33, yet when I type it into my browser I get an error. As a result of shared IP addresses in datacenters most servers also request data on the domain name in your browser and when they get an IP address they quite often fail.

There are work arounds for this but I would like to avoid going into details so this thread doesn't become a 'how to avoid filtering' discussion.

rogerscr wrote:Actually using a lookup site to get the IP is less effective than one might think. I just did a lookup of LDS.org and got 216.49.176.33, yet when I type it into my browser I get an error. As a result of shared IP addresses in datacenters most servers also request data on the domain name in your browser and when they get an IP address they quite often fail.

There are work arounds for this but I would like to avoid going into details so this thread doesn't become a 'how to avoid filtering' discussion.

The work around to bypass this isn't that complicated. Russell is right when he says "it's probably one of the simplest systems to defeat." I'm using the technique that would bypass this filtering right now to manage development of a web site that is being ported from one hosting company to another.

When you consider the fact that the users most likely to want to bypass the filtering are often the most technically adept users in the home, it creates a Bad Situation where you've got a non-technical user who installs a "security solution" that is ineffective and then becomes complacent because they feel they are now protected.

The Church system most likely filters all traffic to known Bad Places. I haven't tested it and I'm not interested in doing any penetration testing from my stake center, so I'm just going to make some educated guesses on what they put in place.

The difference is putting up a barricade so you can't get to the red light district vs. refusing to tell you where the red light district is located.

On the LDSTech wiki, we have created a whole section on Internet safety which includes Internet filtering, etc. I would encourage everyone to review the information and add additional information for the benefit of others.

Read about it here.

Tom

I find the WIKI interesting and we may be able to transfer some of the knowledge here to the Wiki. I would have preferred to post to the prior filtering thread but it is locked.

I think it is important to recognize that there are levels of filtering and each level has a cost.

Obviously software as posted on the WIKI is the most robust but it is also generally most expensive, especially if you have multiple PCs. It will also not work with new internet devices such as the OXO OLPC and game devices. At the same time if you have someone who is actively looking this is the most effective option as some software actually scans each image before displaying it.

I like the idea of filtering at the router level as it is cheaper if not free. I have looked around and all I can find at this level is either a DNS filter as mentioned above or an enterprise level device that is cost prohibitive for home users.

We have discussed the limits of a DNS filter, though I think it is better than you think, give it a try. Most of the people I have talked to want a basic filter to prevent the <12 crowd from having an oops moment. Maybe this would work for pre-teens and then you can buy software for the teen years to minimize the cost?

As far as routers with actual software in them to do the filtering anyone know of anything affordable? I would guess that in reality they are actually the 3rd type mentioned in the wiki, a proxy server but I can't be sure.

The down side to this is that a proxy server can only work for unsecure sites. If the site offers HTTPS then the proxy can't filter unless you install a certificate on the PC/Internet device. The thing to remember is that if you install a certificate then they can look at all your secure internet traffic, i.e. banking, purchases etc so make sure you trust them. Again here there is likely a cost associated with this type of filtering but may not be at the per device cost level of software. Can anyone think of workarounds for this as well? Again don't post how to work around this we just want to generally know of there are faults in a technique.

One down side to all of these is you have to trust that the people who setup the filter have the same definition of what is offensive that you have. There will always be sites the slip thru and there will always be sites that are blocked in error. If someone has problems then it is best to limit internet access to times that other people are around and the PC is in a public space. They should also get help as instructed in this last conference. I think it is the prevention of oops moments that can lead further that we want to avoid here.

Lets discuss it here and get the info over to the wiki!

rogerscr wrote:One down side to all of these is you have to trust that the people who setup the filter have the same definition of what is offensive that you have.

That brings up a good point. What's appropriate filtering for a youngster may not be appropriate for a teen that needs to do some research for school. You may also have a teen that has proven trustworthy and may have access rights like the adults and you may have a teen that has proven to have issues and needs more restrictions. And all three may live in the same house.

Not only does OpenDNS filter content, but it can actually speeds up your web access (as opposed to slowing it down like client based solutions).

Also, if you have someone in your household that you think may try to deliberatly bypass the filter (as opposed to casually happening upon inappropraite content), I would recomend more drastic measures- such as useing the built in parental controls that come wioth most Operateing Systems to limit what can be accessed and when (and even provide reports on activity). I would recomend that such users be supervised closely when useing the Internet.

As far as filtering goes in general, I recommend always having a way to disable overzelous filters and whitelist good sites. I usually use the least restrictive settings possible, so as to avoid censoring quality communication (as opposed to the goal of preventing the casual happening upon obscenity).

I am not personally familiar with opendns though I have heard of it...I am most familiar with software based filtering. For what it's worth I have used K9 web protection to be a great free software tool.

I noticed on the wiki that there is not much content...what is the best way to submit information for consideration?

cvacanti wrote:I noticed on the wiki that there is not much content...what is the best way to submit information for consideration?

You can go to the LDSTech:Community Portal to find out how to contribute. Before you can contribute you will need to create an account by clicking the create account link on the top right of any wiki page.

jdlessley wrote:Before you can contribute you will need to create an account by clicking the create account link on the top right of any wiki page.

The "create account" link doesn't seem to be very helpful with the actual task of creating an account, as it only takes you to the Wiki login page.

Here is a link to where account creation is made: http://ldsaccount.lds.org/

It's helpful to note that this is also the new online account credential system for your Local Unit Web Site (LUWS) and many other official Church web sites.

I'd like to take OpenDNS out for a spin, is there anything I need to know beyond the info at their site?

For opendns.org you need to know the IP address of your router from your ISP. I personally pay the $5 extra from my ISP for a dedicated IP address. You will enter this as the IP address you want to manage. Then go the settings page and mouse over some of the multiple filters you can manage. You are also given the option to manage a separate white or blacklist. If a website is blocked, it lets you personalize the "Websense" message. I have a picture me uploaded with a message to see me if you have any questions...

For faster internet, use their DNS settings for your router rather than your ISP. Once you set your settings, it only takes about 3 minutes for them to take effect.

BrentC wrote:For opendns.org you need to know the IP address of your router from your ISP. I personally pay the $5 extra from my ISP for a dedicated IP address. You will enter this as the IP address you want to manage. Then go the settings page and mouse over some of the multiple filters you can manage. You are also given the option to manage a separate white or blacklist. If a website is blocked, it lets you personalize the "Websense" message. I have a picture me uploaded with a message to see me if you have any questions...

For faster internet, use their DNS settings for your router rather than your ISP. Once you set your settings, it only takes about 3 minutes for them to take effect.

If you don't have the option of (or don't want to pay for) a dedicated IP address, you can use a service like DynDNS. I have a dynamicly updated domain name in the format like whateverYouWantHere.getmyip.com. My Linksys router actually has the ability to built-in to keep the dynamic domain name updated with whatever IP my ISP provides my router.

mkmurray wrote:If you don't have the option of (or don't want to pay for) a dedicated IP address, you can use a service like DynDNS.

But does that play well with OpenDNS filtering? I'm guessing the filtering works by looking at what IP address the request comes from.

RussellHltn wrote:But does that play well with OpenDNS filtering? I'm guessing the filtering works by looking at what IP address the request comes from.

Perhaps not...BrentC said you enter the "IP address you want to manage." If it really does only take an IP address (and not a domain name), then perhaps it isn't compatible.

The IP address you manage is the Internet Service Providers' IP address assigned to your cable modem or DSL modem. Of course, no one plugs their cable modem directly into their computer right?

Go ahead and create an account on Opendns and look around at the settings, filtering etc. It is awesome, works great and did I mention, free? It is the first layer of control I have on top of the other Intenet/content filter I use on the desktop, my virus/malware subscription software.

BrentC wrote:The IP address you manage is the Internet Service Providers' IP address assigned to your cable modem or DSL modem.

Which in turn is the public IP address that OpenDNS sees the request coming from. I'm thinking that might be what OpenDNS is using to know what filters to apply to any given request coming in.

BrentC wrote:Of course, no one plugs their cable modem directly into their computer right?

People without routers would.

RussellHltn wrote:Which in turn is the public IP address that OpenDNS sees the request coming from. I'm thinking that might be what OpenDNS is using to know what filters to apply to any given request coming in.

Yeah I'm really not sure how my IP address shows up to the world. I assumed it was the one my cable modem gets, which my router would get, which my router would keep updated with DynDNS.

Ok, I just did a test using this site: http://www.whatismyip.com/

It showed my IP address. Then I pinged my DynDNS dynamically updated domain name and it resolved to the same address.

So I think I've confirmed what you just said. But it appeared you said using my custom DynDNS domain name would not resolve correctly. The only potential issue I can think of would be that the interface wouldn't let me type in a domain name rather than a straight numerical IP address. If it does let me type in the domain name, then I don't know why it wouldn't work.

Yes, a DynDNS domain will resolve into an IP, but an IP won't correctly resolve to a DynDNS domain unless you specifically ask DynDNS. When I use the same site, http://www.whatismyip.com/, to do a reverse lookup on my IP, I get a RoadRunner domain name, not my DynDNS domain.

Now, the question is what's passed to OpenDNS? I know the IP address is passed - that's how you get your reply. But is the Domain passed? Not unless you fill in the DNS Suffix field. The problem there is that my LinkSys router doesn't have any place for me to enter that in. So I can't pass that to all the clients via DHCP. So I'd have to manually enter that for all devices on my network - a major pain.

Doing some poking around, I can see where this is an issue.

This link makes it clear that content filtering is based on the public IP.

This makes clear the non-relationship between OpenDNS and DynDNS.

So in practical terms for the home users, there seems to be two choices: Use a static IP address or run OpenDNS program to keep OpenDNS informed on your current public IP address.

Hmmmmm, I'm seeing things that suggest the "tomato" firmware may support OpenDNS - among other features. Since I have a older Linksys, that may well solve things for me.

scgallafent wrote:The work around to bypass this isn't that complicated. Russell is right when he says "it's probably one of the simplest systems to defeat." I'm using the technique that would bypass this filtering right now to manage development of a web site that is being ported from one hosting company to another.

When you consider the fact that the users most likely to want to bypass the filtering are often the most technically adept users in the home, it creates a Bad Situation where you've got a non-technical user who installs a "security solution" that is ineffective and then becomes complacent because they feel they are now protected.

The Church system most likely filters all traffic to known Bad Places. I haven't tested it and I'm not interested in doing any penetration testing from my stake center, so I'm just going to make some educated guesses on what they put in place.

The difference is putting up a barricade so you can't get to the red light district vs. refusing to tell you where the red light district is located.

On the LDSTech wiki, we have created a whole section on Internet safety which includes Internet filtering, etc. I would encourage everyone to review the information and add additional information for the benefit of others.

OpenDNS uses the same protocol for updating your IP address that DynDNS uses. Any tool that can update DynDNS can also update OpenDNS if you can manually configure the server for the tool (I've seen many that can only update pre-programed services). OpenDNS has fairly recently come up with their own client for updating on the Mac (I imagine that they also have a client for Windows - perhaps have for a while). My OpenDNS account has multiple dynamic networks (OpenDNS uses the term network for any set of addresses that are configured with custom settings - dynamic networks can only contain a single address). One network is for my home broadband account, the other is for my notebook when visiting other networks. If I am visiting a network that already has custom OpenDNS settings, I cannot override those settings with my own.

I originally decided to try open DNS when I learned about "Drive By Pharming" - the vulnerability of many routers to changes in their settings using cross site request forgery to make the setting request come from within the router's network. I knew that I could secure my router against such attacks, but I could not trust every network that I might use to serve trusted DNS servers. The domain filtering options were just a bonus to me. I have my home page set to check to see that my network settings are active (by accessing a shortcut I created).

OPEN DNS
For what it's worth, I've been using OpenDNS for a couple months now and it works GREAT! In the testing I've done, entering an IP Address of a nefarious site results in a redirect to the OpenDNS denial page. I'm assuming that is a by-product of how web pages work:
1. the browser requests the page (getting the IP address from the DNS server) - if you enter the IP address in the URL, you will get the HTML page (text-only)
2. the browser parses the page and for each linked resource sends a request (images, javascript, css, etc.)
3. if the links on the page have fully-qualified URLs, the browser will contact the DNS server to resolve the domain name in the URL (myspace.com) to an IP address

CURSORY TESTING
I'm assuming that the domain name resolution always results in a redirect to the OpenDNS error page. My testing was cursory, but I was quite pleased with the fact that I couldn't circumvent the security. Should I have done more testing?

My concerns about family internet security went away after applying OpenDNS (simply pointing our router to the static OpenDNS servers, rather than the ones our ISP operates). After some initial testing, I was satisfied that the solution was working great. We apply the minimal amount of blocking (pornography only) and expect the kids to govern themselves.

If someone can tell me how to break OpenDNS, I'd be willing to try. But so far, it's not worked. If anyone is convinced that OpenDNS is breakable, I'll do some testing - but I need some ideas on what to test. Entering the IP Address of a URL did not work... the browser (on any device) redirects to the OpenDNS denial page.

FAMILY POLICY
Our family has operated under the assumption that the kids will eventually leave the nest and must learn self-governance while they're with us. So we've traditionally had computers in common areas, clear instructions on what's permitted and what's not, and no filtering. However, with the introduction of the iPod Touch and DSi this last Christmas, we were increasingly concerned about internet access in bedrooms.

OPEN DNS DOWNSIDE
When your IP address expires and the ISP gives you a new one, you have to enter that IP address in OpenDNS. That means checking occasionally and then going to OpenDNS to update your IP address and settings.

OPEN DNS UPSIDES
It protects ALL devices. NetNanny and other solutions give you a false sense of security because they only protect the single PC on which they're installed. Also, there is granular control over filtering with OpenDNS and there is logging (so you can see what site requests were denied, what sites were hit, etc.). Lastly, it's free (unless you want more robust logging).

STAKE CENTER - USE OPEN DNS?
I'm wondering if we should update the router at the Stake to point to OpenDNS - since the church firewall fails open (it's my understanding that if the blacklist server the church uses is unavailable, the internet is wide open with no filtering applied). Open DNS would shore up that problem.

CELL NETWORK
I think it's worth pointing out that all this filtering and control will NOT protect CELL NETWORKS which are governed by the wireless provider. I don't know if there's a way to set the DNS server that a cell phone uses.

I realize this is harsh, but here is my opinion: Promoting OpenDNS as a primary filtering method is IT malpractice. It has its place as part of an overall strategy, but it provides absolutely no protection against bypass in a typical home network.

<soapbox>When we make a recommendation in a church situation, there are going to be people who take it as gospel truth because we've got computer skillz. If someone makes a recommendation in Relief Society or a combined meeting on how to protect your family from nefarious things, someone in that room is going to go home and implement that suggestion. They will then promptly let down their guard, because they've implemented Suggestion X that they heard at church from The Guy With Skillz and their family is protected.</soapbox>

Because it is trivial to break, actively promoting OpenDNS as the solution makes me shudder.

Here are a couple of ways to break it:

Method 1 or "Server? We don't need no steenking server!"

Step 1 - Determine for yourself the IP address of a nefarious site
If you have access to an unfiltered machine, type ping nefarioussite.com and look for the response address. If your machine is filtered, open a command prompt and run nslookup. On a Windows box, you would type the following:

nslookup
server 8.8.8.8
nefarioussite.com
exit

Step 2 - Put the IP address of the nefarious site in the hosts file
Modify the hosts file and add a line with the IP address and name of the nefarious site. Something like this:

12.34.56.78 nefarioussite.com

Step 3 - Do nefarious things
Pick your favorite browser and use its private browsing mode or use a portable browser installation (Firefox Portable or something similar) that doesn't leave much of a detectable trace on the operating system.

Step 4 - Undo the hosts file change
If you've gone this far, you're probably thinking far enough ahead to undo the change to the hosts file. If you were really thinking far ahead, you made a copy of the hosts file and now you can put the copy back in place. That way the timestamp on the file doesn't change.

Method 2 or "Bring Your Own Server"

Step 1 - Change the DNS server in networking settings
Open the appropriate dialog, change the DNS server to 8.8.8.8.

Step 2 - Do nefarious things
'Nuff said.

Step 3 - Change the DNS server back
Undo change from step 1.

I realize that you can do things to make either of these methods more difficult on a PC (remove administrator access, etc.), but that just provides a little more of a challenge. You don't have physical control of the iPod Touch, so you're in trouble with that one.

Borrow your child's iPod Touch and try method #2. I believe the settings are under Settings > Wi-Fi > Choose network > Select blue arrow > DNS. The IP address I gave (8.8.8.8) is one of Google's public DNS servers. I just tested on my Android phone and was able to bypass OpenDNS without a hitch.

scgallafent wrote:Step 1 - Determine for yourself the IP address of a nefarious site

You can probably Google the web to find a site that would allow you to do that from the filtered machine.

While I think protecting the DNS lookup is useful for filtering against accidentally stumbling across things, I don't think it's useful against deliberate attempts to bypass it.

rhusted wrote:OPEN DNS DOWNSIDE
When your IP address expires and the ISP gives you a new one, you have to enter that IP address in OpenDNS. That means checking occasionally and then going to OpenDNS to update your IP address and settings.

I think there's other ways of doing that, such as running a client on a machine that's running much of the time.

rhusted wrote:STAKE CENTER - USE OPEN DNS?
I'm wondering if we should update the router at the Stake to point to OpenDNS - since the church firewall fails open (it's my understanding that if the blacklist server the church uses is unavailable, the internet is wide open with no filtering applied). Open DNS would shore up that problem.

I'm not sure how the church's filtering works. It may create problems with their filtering. It may also create problems in trying access church sites. The church-provided firewall places the stake network inside the church's network. This is necessary for some things like the FHC portal. OpenDNS will return the external IP for these services.

scgallafent wrote:
Method 2 or "Bring Your Own Server"

Step 1 - Change the DNS server in networking settings
Open the appropriate dialog, change the DNS server to 8.8.8.8.

Step 2 - Do nefarious things
'Nuff said.

Step 3 - Change the DNS server back
Undo change from step 1.

I realize that you can do things to make either of these methods more difficult on a PC (remove administrator access, etc.), but that just provides a little more of a challenge. You don't have physical control of the iPod Touch, so you're in trouble with that one.

Borrow your child's iPod Touch and try method #2. I believe the settings are under Settings > Wi-Fi > Choose network > Select blue arrow > DNS. The IP address I gave (8.8.8.8) is one of Google's public DNS servers. I just tested on my Android phone and was able to bypass OpenDNS without a hitch.

I have had success in combating Method#2. Sure, this is a tad more "techy" than most people's ability, but it works nonetheless.

If you happen to be running a router with the tomato firmware, it's super easy to block DNS requests through port 53.

If you have a router than can run dd-wrt, you can get good information from THIS THREAD

I'm sure there are other options for other routers, but not all consumer routers will help you block port 53. There are other 3rd party firmware solutions also. The two I've had success with are Tomato and dd-wrt

RussellHltn wrote: It may also create problems in trying access church sites.

My OpenDNS use on my notebook has given me some experience with this problem: at the public library, I was not able to access the library's website while using OpenDNS; at my university, I was not able to access certain university servers while using OpenDNS; at the institute I experienced no difficulty accessing public church websites while using OpenDNS.

scgallafent wrote:I realize this is harsh, but here is my opinion: Promoting OpenDNS as a primary filtering method is IT malpractice. It has its place as part of an overall strategy, but it provides absolutely no protection against bypass in a typical home network.

<soapbox>When we make a recommendation in a church situation, there are going to be people who take it as gospel truth because we've got computer skillz. If someone makes a recommendation in Relief Society or a combined meeting on how to protect your family from nefarious things, someone in that room is going to go home and implement that suggestion. They will then promptly let down their guard, because they've implemented Suggestion X that they heard at church from The Guy With Skillz and their family is protected.</soapbox>

Because it is trivial to break, actively promoting OpenDNS as the solution makes me shudder.

Here are a couple of ways to break it:

Method 1 or "Server? We don't need no steenking server!"

Step 1 - Determine for yourself the IP address of a nefarious site
If you have access to an unfiltered machine, type ping nefarioussite.com and look for the response address. If your machine is filtered, open a command prompt and run nslookup. On a Windows box, you would type the following:

nslookup
server 8.8.8.8
nefarioussite.com
exit

Step 2 - Put the IP address of the nefarious site in the hosts file
Modify the hosts file and add a line with the IP address and name of the nefarious site. Something like this:

12.34.56.78 nefarioussite.com

Step 3 - Do nefarious things
Pick your favorite browser and use its private browsing mode or use a portable browser installation (Firefox Portable or something similar) that doesn't leave much of a detectable trace on the operating system.

Step 4 - Undo the hosts file change
If you've gone this far, you're probably thinking far enough ahead to undo the change to the hosts file. If you were really thinking far ahead, you made a copy of the hosts file and now you can put the copy back in place. That way the timestamp on the file doesn't change.

Method 2 or "Bring Your Own Server"

Step 1 - Change the DNS server in networking settings
Open the appropriate dialog, change the DNS server to 8.8.8.8.

Step 2 - Do nefarious things
'Nuff said.

Step 3 - Change the DNS server back
Undo change from step 1.

I realize that you can do things to make either of these methods more difficult on a PC (remove administrator access, etc.), but that just provides a little more of a challenge. You don't have physical control of the iPod Touch, so you're in trouble with that one.

Borrow your child's iPod Touch and try method #2. I believe the settings are under Settings > Wi-Fi > Choose network > Select blue arrow > DNS. The IP address I gave (8.8.8.8) is one of Google's public DNS servers. I just tested on my Android phone and was able to bypass OpenDNS without a hitch.

Anyone with both physical access to the box and the know how is going to be able to bypass any filter. Thanks for just providing the how-to.

In seriousness, the intent the vast majority of cases is going to be to limit casual use. A 10 year old kid isn't going to understand what you just explained. The 15 year old brother might, but he will already have easier ways to go about it. Chillax.

To help resolve the comments about dynamic IPs and OpenDNS, remember they have an applet that will sync to your account and update your IP periodicly. Most ISPs are goign to be changing it willynilly anyway. Just install the app on one of the computers in the network, doesn't matter which one, and it will handle it for you.