Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

72% of smart TVs and 46% of game consoles hardcode DNS settings

labzilla.io

Post reply on HN
Print view View original

441–450 of 673 posts

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#441

Post by wolco2 »

skinkestek wrote: post #211
syshum wrote: post #148

Earlier quoted context omitted.

At this point Mozilla is just the Non-profit Arm of Google, They do what google tells them.... and DoH is absolutely designed to get around network based security and filtering, both for Ad's and other reasons.

> At this point Mozilla is just the Non-profit Arm of Google, They do what google tells them.... As someone who has used (and still use Firefox) continously since around 2005 it surely feels that way sometimes and some of the decisions I see would make much more sense to me if I knew top management was somehow in Googles pocket. (That said 1. for my workflows I still consider Firefox the best browser. 2. switching wo…

They are in google pockets for 95% of revenue. But I think as a browser with a smaller market they join things and change things to be like everyone else.

There was a recent change to facebook picture albums that lazily loads pictures as you scroll. In large albums this grinds to a halt after a few pages and each scroll takes 30 seconds to load the next set of images. Chrome handles this smoothly. For social media I had to switch to chrome.

Firefox is still better for privacy and I use it when I can even though it feels like it's slowing down after each upgrade.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#442

Post by carstenhag »

the8472 wrote: post #61
jon-wood wrote: post #10

I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. While sure there are companies explicitly doing this to avoid filtering, at least in my case it’s because a significant proportion of DHCP servers are configured to send DNS to your ISP, and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN r…

> and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN responses into the IP address of their ad-laced web search, and occasionally just highjack every single query to send you to a page saying you’re approaching your bandwidth quota Universally? Perhaps in the US? But IoT devices are sold worldwide. While I do run my own recursive resolver I checked my ISP's and they're behaving…

In Germany, Telekom used to hijack nxdomain. A court actually found them guilty and since a half year or so they are no longer doing that.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#443

Post by jlgaddis »

Abishek_Muthian wrote: post #321
idiot900 wrote: post #312

Earlier quoted context omitted.

You're in luck. Buy a commercial TV, or a hospitality TV. For example: https://www.lg.com/us/business/commercial-tvs/lg-65ut640s0ua Other TV manufacturers make similar products.

Thanks for that, I have a standing need gap for 'Make TV dumb again' [1]. [1] https://needgap.com/problems/64-make-tv-dumb-again-privacy-c...

HN'ers: don't bother clicking, it's just some self-promoting bullshit.

  X-Spam-Flag: YES
--

@Abishek_Muthian:

Thanks for your multiple contributions (four, just from your HN profile!) to the NXDOMAIN blacklists!

(On a somewhat related note, I just cannot understand how you're not a gazillionaire from FindDate -- such a unique, novel concept! -- but perhaps the pivot to "startup coaching" will work out. Fake it 'till ya make it, amirite!?)

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#444

Post by jlgaddis »

miked85 wrote: post #423
idiot900 wrote: post #312

Earlier quoted context omitted.

You're in luck. Buy a commercial TV, or a hospitality TV. For example: https://www.lg.com/us/business/commercial-tvs/lg-65ut640s0ua Other TV manufacturers make similar products.

All of the "key features" of this TV are what I want to avoid though. Maybe not as bad a consumer TV, but not that great either: Content Management/Group Management SuperSign Control Simple Network Management Protocol (SNMP) Wake-on-LAN Crestron Connected® (Network Based Control)

The difference is that, with this TV, you are the one in control -- not the manufacturer.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#445

Post by tptacek »

mmglr wrote: post #342

If I understand correctly using "Nat Rule 1" a network can be configured to ignore my choice of dns server while my device is on their network? What is the mitigation of this? DNSSEC or DNS over HTTPS or DNS over TLS?

DNSSEC does nothing to address NAT interception of DNS, but DoH does: your network can't spoof a TLS certificate for your chosen DoH recurser (though, with some effort, they can just block you from the network if you don't comply with their DNS policy).

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#446

Post by mlyle »

kgwxd wrote: post #439
jeffbee wrote: post #344

Earlier quoted context omitted.

Counterpoint: smart TVs are great. My LG has replaced almost every other thing that used to be in my media room. It is my streaming music box (I can target it for casting from my favorite iOS app, and I can use the interface on it for browsing my home network storage if I want). It has Netflix, Amazon, YouTube, Hulu, Disney, Vudu, Google TV, and every other damn thing on it. It has voice search, so I just say the nam…

At some point, most of those things are going to stop working but the screen will still be perfectly fine. What are you going to do with it then?

I don't know-- plug a $30 Chromecast or Roku into the back and keep going?

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#447

Post by syshum »

shawnz wrote: post #203
fiddlerwoaroof wrote: post #197

Earlier quoted context omitted.

I’ve been thinking about installing a proxy with my own root for this reason.

I would not want to use your network if that was the case, and I wonder if you similarly would use someone else's network if it was configured like that. I don't think network operators who provide access to the Internet can realistically expect to control what their users do on the Internet, unless the network operator is also the administrator of those workstations.

The problem here is even the device owner is not the "administrator" of the device as we have lost ownership rights, locked behind EULA's, Patents and copyright

The point of the original story is "your" meaning a device you own, is ignoring your network controls

it is highly unlikely that the TV manufacturer is going to allow me to install my own custom root certs to inspect their traffic to HTTPS, so yes DoH and other things are a threat to network security, because if the TV become compromised I have limited administrative controls to prevent it other the blocking it completely which is a poor response to the problem

DoH is a solution in search of a problem that can be solves in better more user friendly ways

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#448

Post by bitlevel »

Dahoon wrote: post #97
bitlevel wrote: post #89

They appear to not be trustworthy to be on our networks - so we should: 1. Not join them to our networks 2. Stop buying 'Smart TV's' 3. Get panels and a smart box that you can control I'm lucky enough to be able to direct ALL DNS through my router first. Nothing gets out without my say so. Not everyone has that capability, sadly, with home routers. The solution provided by the OP is a solid one - another would be to…

>I'm lucky enough to be able to direct ALL DNS through my router first Even DNS over HTTPS? Do you do packet inspection? Just blocking ports doesn't do much any more. I run an IDS/IPS and it blocks lots of DoH to Google. Apple devices are even worse.

Not DNS over HTTPS currently, although investigating a way to MitM the connections with a proxy.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#449

Post by bitlevel »

low_key wrote: post #167
sbarre wrote: post #106

Earlier quoted context omitted.

Would you mind sharing a bit more detail on your setup?

I'm not sure what the commenter's setup is, but I have one that (at least mostly) achieves the same thing. It is a combination of a few things: 1. Redirect all outbound DNS traffic to your own local DNS server (as described in the link in this post) 2. Return NXDOMAIN for well-known DoH domains [1] (as well as "use-application-dns.net" for well-behaving software like Firefox [2]) 3. Block traffic to well-known DoH pr…

Yep, pretty much the above - I have a combination of rules that control all traffic. Only the router is allowed to use port 53 outbound - all other traffic is redirected using NAT to the router's DNS server.

I mentioned Mikrotik previously - I use them myself.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#450

Post by mindslight »

acdha wrote: post #426
mindslight wrote: post #384

Earlier quoted context omitted.

Well DNS has been a pragmatic measure for quite some time. I've definitely seen jailbreaks of embedded devices that start off by MITMing DNS to proxy all traffic. DoH is changing that, and I can see how that's annoying. > hit Samsung.com if there’s an update you need Why would you need an update? Updates are mainly necessary for security, which you don't need if the device isn't on the Internet. If the device doesn't…

> Why would you need an update? Updates are mainly necessary for security, which you don't need if the device isn't on the Internet. You've never had a problem which was fixed by an update or something which added support for, say, a new model peripheral? I have, which is why I allowed for the possibility of wanting to do this on the schedule of your choosing but not the default case. > I don't see how it's a losing…

> You've never had a problem which was fixed by an update or something which added support for, say, a new model peripheral

For embedded devices? No. I can imagine it happening in general, but I don't think I would ever buy into a proprietary ecosystem so hard that there would be peripherals, and newly released ones at that. Still I would be cautious about doing said updates, lest they ruin the device I already have. Like I've got a newer Marantz receiver that works great and hasn't seen the Internet in several years. Even if they developed some new desirable feature, why would I want to let it reflash itself and possibly break, or even just get slower (software bloat)? I'd rather just continue using it as I bought it.

> there are many other things which legitimately need connectivity and there's no good way to prevent that

I sort things into categories. A TV would be in the category of "wtf would you ever hook that up online" - Internet access can only enable anti-features. A Chromecast is a different category - single purpose disposable device that if it turns into shit you just throw it out. Ads and surveillance are part of its price, and if your goal is to avoid them, you should just setup a Kodi box and call it a day.

Legally I don't really see what you're getting at here. I can see a law for my TV category, but leaving it disconnected or pulling the 5G modem will also solve that. How would you even begin to solve the Chromecast problem with a law? Maybe in the EU you could convince them to mandate unbundling ads from a service, but in the US exploiting consumers by shoving ads at them is one of the most popular business models. I don't see that ever changing via the legal system.

Post reply on HN