72% of smart TVs and 46% of game consoles hardcode DNS settings • Hacker News Board

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#471

Post by [deleted] » Sat, Dec 05, 2020, 8:56 PM UTC

pickledcods wrote: post #192

EvanAnderson wrote: post #19

Earlier quoted context omitted.

You're right to be suspicious. The DNS-over-HTTPS model favors those who run the servers (because they get exclusive access to monetizable end user name resolution data) and those who control the resolvers. You might control the resolver on your personal computer (for now). You probably don't control it on your phone. You most likely won't control it on your embedded devices.

I believe that Google pushed DoH to track your cross-site browsing. TLS hides your URL, and blockers can break adsense tracking and/or any other call-home backlinks. Using DoH, especially one served by an advert company is just signing up to be their open book.

[deleted]

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#472

Post by xxpor » Sat, Dec 05, 2020, 8:58 PM UTC

zxcvbn4038 wrote: post #469

I bought a new TV for the first time in fourty years and never considered the “smart” TV aspects - I was just focused on image quality and number of inputs. In the end I picked out an LG tv which had a great picture - but it’s app support really sucks if you want something more then Netflix and Hulu. I ended up getting a Fire stick and an Apple TV to go with it so I can access content. If I did it all again I wouldn’…

LG and Samsung both have nasty habits of hosting their downloads in South Korea, where while their internet connectivity within the country is amazing, their access to the outside leaves a lot to be desired. They're in a tough spot to serve geographically since they're effectively an island and the closest big country (China) isn't somewhere you'd want to have your cables going though. My understanding is IIRC they largely connect to Japan and perhaps Singapore.

But yeah, if they just used a CDN this wouldn't be an issue.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#473

Post by ouid » Sat, Dec 05, 2020, 9:00 PM UTC

onion2k wrote: post #292

Bud wrote: post #261

This isn't difficult: TVs should not be "smart". TVs should be incredibly dumb. They should be screens for displaying stuff. That's it. Nothing else. No network connection of any kind, no apps, no software beyond that necessary to do basic setup of how that screen works: brightness, input selection, etc.

That would essentially force people to buy two devices - one for receiving content to display and a second to display it. All your solution does is shift the problem on to the receiving device. It wouldn't fix anything, and at the same time it'd increase the cost and complexity for the user (by a very small amount admittedly).

OK, here's how you make a smart TV, essentially. Take a dumb tv with some ports attached to it, plug a chromecast into one of the ports, and then pour epoxy over the whole thing.

Your argument is that this adds value to the chromecast dumb tv pair, despite being a fundamentally destructive operation.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#474

Post by y1zhou » Sat, Dec 05, 2020, 9:01 PM UTC

jon-wood wrote: post #10

I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. While sure there are companies explicitly doing this to avoid filtering, at least in my case it’s because a significant proportion of DHCP servers are configured to send DNS to your ISP, and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN r…

I've recently setup AdGuard Home on my Raspberry Pi, and noted that requests made from an Android phone weren't going through the DNS server at all. Turns out it uses a default IPv6 DNS first (which I found no method to modify) and then falls back to the manually entered IPv4 DNS server.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#475

Post by egeozcan » Sat, Dec 05, 2020, 9:03 PM UTC

joombaga wrote: post #412

smileysteve wrote: post #394

Earlier quoted context omitted.

The magic pointer ROCKS

Except you can't shut the thing off, which means I can't have the remote anywhere near me or I'll bump it and make the pointer pop up.

Yeah a physical button to turn it on-off would be amazing. Maybe I can sacrifice a remote and see if I can just add a switch to the sensor. Not my worst idea.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#476

Post by wang_li » Sat, Dec 05, 2020, 9:04 PM UTC

Spivak wrote: post #214

wang_li wrote: post #47

Earlier quoted context omitted.

> Yes, support is supremely expensive. I agree. I have support costs too. Which is why every company that sells a product with a hard coded DNS server configured but doesn't advertise said aspect prominently in all advertising, so I can know to avoid their intentionally defective product, should pay me $10000 for the time I wasted buying their product, discovering their product is secretly and intentionally broken, a…

Why would they advertise this feature? The device isn’t broken, it’s not violating any standards, devices aren’t required to accept DNS servers offered by DHCP — my laptop doesn’t for any network that isn’t my home. This is done because the manufacturer’s and public DNS servers are more of a known quantity then you ISPs router and DNS servers. Using pihole is super rare and wouldn’t be worth the effort if it weren’t…

Devices that don't use the DNS servers specified by the DHCP server I have configured on my network most certainly are broken. I'm not talking some kind of principle here, I mean they literally will not resolve addresses correctly as I have configured a split horizon DNS environment for DNS names that I control. I have no interest in exposing many of the names on my network to the public so that 8.8.8.8 can resolve them.

Saying that a device is not violating any standards as they "aren't required to accept DNS servers offered by DHCP" is like saying a device is not broken and not violating any standards because "they aren't required to accept IP addresses offered by DHCP." It's a silly to say devices are not required to accept the parameters sent by my DHCP server as such a statement is only correct in the most abstract sense that there is no law that requires a device to adhere to the relevant RFCs for DHCP. On the other hand there are laws, federally and in many states, that only allow you to connect to and use other people's network with their permission and only use their networks within the bounds that they allow.

I don't care about the device manufacturer's opinion of DNS server quality. I own the device and I own the network that the device is connected to and I pay for the uplink between that network and the rest of the internet. There is only one person who can correctly make an assessment as to the correct DNS server for my network and that is me. If a device manufacturer chooses to hard code a different DNS server they are wrong and it is broken and they should tell me so I don't waste my time buying their product and returning it.

Additionally they should advertise this behavior because it is a security vulnerability for my network for their shitty device to be sending my internal names to outside servers to resolve. The names of the devices on my network that I choose not to expose to the internet are no business of anyone else.

E: And I didn't even get into the mess that it would be to try and expose the DNS zones for the RFC 1918 address spaces that everyone is using.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#477

Post by milofeynman » Sat, Dec 05, 2020, 9:05 PM UTC

Fiahil wrote: post #452

I wish I could set a DNS redirect, however I have a Netgear router and the only option I know would be to install a custom router firmware. That's not something I have already done. Does someone have a good walkthrough and recommendations on the choice of firmware ?

I have the masquerade and other rules setup on a ubiquiti edgerouter that eats anything trying to go out on port 53 and sends it to pihole. My experience has been one of annoyance when the DNS server breaks randomly or after a power outage it can be a pain of resetting VMs occasionally. But 99% of the time it works well and I'm glad I did it. However DNS over HTTPS is going to kill this method.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#478

Post by 1vuio0pswjnm7 » Sat, Dec 05, 2020, 9:06 PM UTC

"Nearly 70% of smart TVs and 46% of game consoles were found to contain hardcoded DNS settings - allowing them to simply ignore your local network's DNS server entirely. "

To be fair, Pi-Hole hardcodes "default" (suggested) DNS settings, too. While the user can change defaults, it is well-known that in most cases, the majority of users do not change them.

    curl -s  https://raw.githubusercontent.com/pi-hole/pi-hole/master/automated%20install/basic-install.sh |grep -C3 8\.8\.[48]\.[48]

IMO, the best DNS-based solution for controlling the HTTP requests that applications can successfully make, e.g., to ad servers/trackers, is not to point them (directly or indirectly) at third party DNS caches.

Sending the user's DNS queries to an online ad services company (Google) is a interesting default for a project whose raison d'etre is the existence online ads. Perhaps if the online ads industry began to fade, so too would the need for Pi-Hole.

After decades of running own root and other authoritative servers on localhost, I would still do it even if online ads were not a problem. I like the speed, reliability and control.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#479

Post by rconti » Sat, Dec 05, 2020, 9:11 PM UTC

jon-wood wrote: post #10

I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. While sure there are companies explicitly doing this to avoid filtering, at least in my case it’s because a significant proportion of DHCP servers are configured to send DNS to your ISP, and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN r…

Where do you want them to send it to?

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#480

Post by zxcvasdf » Sat, Dec 05, 2020, 9:15 PM UTC

jon-wood wrote: post #10

I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. While sure there are companies explicitly doing this to avoid filtering, at least in my case it’s because a significant proportion of DHCP servers are configured to send DNS to your ISP, and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN r…

It's not perfect, but I find blocking all traffic in/out to global dns servers with pfBlockerNG to be an okay way to limit the DoH bypass of simple port 53 blocking. There are still ways around it, but it has caught a lot of other interesting traffic (snmp, ntp, etc.) leaving my network and that a simple port 53 block misses.

This is the list I use: https://public-dns.info/nameservers-all.txt