Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

72% of smart TVs and 46% of game consoles hardcode DNS settings

labzilla.io

Post reply on HN
Print view View original

221–230 of 673 posts

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#221

Post by acdha »

fiddlerwoaroof wrote: post #183
acdha wrote: post #172

Earlier quoted context omitted.

> At this point Mozilla is just the Non-profit Arm of Google, They do what google tells them You can just say you don’t follow this closely. Mozilla is not perfect but they do push for privacy, with an increasingly limited amount of negotiating power. > DoH is absolutely designed to get around network based security and filtering, both for Ad's and other reasons. This is similarly reflecting a poor understanding of t…

DoH absolutely can get network filtering: if I block port 53 outbound to control DNS queries within my network, DoH (and other tunneling technologies) is bypassing my network filtering of DNS.

Network filtering means blocking traffic at the network level. Trying to use DNS for this leaves you trusting the client - and there are decades of precedent for clients bypassing that for various reasons, such as this post shows.

The solution is to start doing network filtering: if you block packets to unapproved servers, you can actually stop this. You’ll need to run your own proxy, of course, but that’s always been the only way to actually accomplish that goal.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#222

Post by fiddlerwoaroof »

acdha wrote: post #221
fiddlerwoaroof wrote: post #183

Earlier quoted context omitted.

DoH absolutely can get network filtering: if I block port 53 outbound to control DNS queries within my network, DoH (and other tunneling technologies) is bypassing my network filtering of DNS.

Network filtering means blocking traffic at the network level. Trying to use DNS for this leaves you trusting the client - and there are decades of precedent for clients bypassing that for various reasons, such as this post shows. The solution is to start doing network filtering: if you block packets to unapproved servers, you can actually stop this. You’ll need to run your own proxy, of course, but that’s always bee…

That isn’t really possible, though: CDNs mean that blocking by IP just doesn’t work. The most effective method I’ve found is transparently redirecting all traffic on port 53 to a DNS server I control. DoH means that I might as well setup a transparent HTTPS proxy.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#223

Post by post_break »

stiltzkin wrote: post #186
CraneWorm wrote: post #22

Just don't buy smart TV, or any of that IoT crap. It is possible to buy 58 inch dumb TV, connect that to a machine you own.

Seems like an easy suggestion to write, i find more difficult to find a good dumb TV nowadays.

Aren’t all tv dumb TVs if you don’t connect them to the internet?

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#224

Post by encom »

shawnz wrote: post #196
encom wrote: post #86

Earlier quoted context omitted.

I've hated DoH from the beginning, and not just because shoehorning everything into http is a silly idea, but as I suspected, we now live in a reality where you have to keep an adblock-esque list of DoH servers. Now you have yet another internet arms race.

DNS based blocking was already trivially bypassable before DoH was ever conceived so I don't see how DoH or its use by browsers is at fault for that problem.

As mentioned in TFA, configuring a firewall to redirect DNS traffic from broken or malicious software is also trivial. Or are you talking about hardcoding IP addresses?

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#225

Post by scrps »

xurukefi wrote: post #212

I always found it puzzling that DNS blacklisting for adblocking purposes works at all . I mean I'm not a webdev or anything like that, so what I'm saying might be a bit native, but couldn't you simply serve your ads using the same domain you use for your content? This immediately defeats things like PiHole completely.

Sadly that is already happening, luckily there are ways to defeat cname cloaking.

https://blog.apnic.net/2020/08/04/characterizing-cname-cloak...

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#226

Post by stiltzkin »

post_break wrote: post #223
stiltzkin wrote: post #186

Earlier quoted context omitted.

Seems like an easy suggestion to write, i find more difficult to find a good dumb TV nowadays.

Aren’t all tv dumb TVs if you don’t connect them to the internet?

That's a good point, i still consider dumb when no smart os is installed.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#227

Post by WarOnPrivacy »

>Fortunately, with a few simple firewall rules, you can intercept these hardcoded DNS queries and redirect them to your PiHole. These instructions are for pfSense

I can see running pihole instead of a pfSense+pfBlocker rig.

But if you've already got pfSesne at the edge, why not just polish it off with pfBlocker/DNSBL instead of erecting a separate pihole machine?

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#228

Post by remote_phone »

syshum wrote: post #154
jon-wood wrote: post #31

Earlier quoted context omitted.

Currently we’re using both Google and Cloudflare’s DNS, providing resiliency against one or the other being unavailable, but I’m looking at potentially using our own resolvers just to reduce the amount of data being exposed to third parties.

So if I have a firewall level block to both 8.8.8.8 and 1.1.1.1 your devices will not work for me at all?

If you can block those ip addresses, you can also redirect those ip addresses to other ip addresses.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#229

Post by mik3y »

grawlinson wrote: post #218
stiltzkin wrote: post #189

Is PiHole the best all around solution for network filtering?, last i tried to setup one i did not find it user friendly.

A few years ago, I tried using ansible to automate setup of PiHole. That did not go well because it's essentially a poorly coded hobby-level project. I've since switched to BIND (named) & it's fantastic implementation of DNZ RPZ[0]. [0]: https://dnsrpz.info/

One of my incomplete-but-functional quarantine projects tries to tackle this "raspberry pi project" problem: How to reproducibly set up these community-maintained projects, with homebrew-like simplicity.

https://github.com/berrypatch/berrypatch

(I guess I've reached the inevitable "build your own package manager" stage of one's hacking career..)

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#230

Post by shawnz »

encom wrote: post #224
shawnz wrote: post #196

Earlier quoted context omitted.

DNS based blocking was already trivially bypassable before DoH was ever conceived so I don't see how DoH or its use by browsers is at fault for that problem.

As mentioned in TFA, configuring a firewall to redirect DNS traffic from broken or malicious software is also trivial. Or are you talking about hardcoding IP addresses?

There are plenty of other alternatives. The simplest (but least flexible) would be hardcoding an IP of the final server.

Somewhat more sophisticated would be hardcoding an IP to a server with a REST endpoint that returns the real final IP. (Basically just like what DoH does, but without calling it DoH).

Even more sophisticated would be hiding the final IP on some kind of public web service like Twitter or Github.

Post reply on HN