Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My Chromecast Ultra would not start until I began answering 8.8.8.8

mailarchive.ietf.org

Post reply on HN
Print view View original

101–110 of 519 posts

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#101

Post by CivBase »

mankyd wrote: post #95
CivBase wrote: post #94

Earlier quoted context omitted.

> You know what would be an actual story though? If Google used Google DNS to spy on people. What constitutes "spying" to you? Do you honestly believe Google isn't mapping your IP address to your account and monitoring your DNS requests to influence the ads they serve to you?

https://developers.google.com/speed/public-dns/privacy > We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services.

Fair enough.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#102

Post by vetinari »

yardstick wrote: post #89
vetinari wrote: post #83

Earlier quoted context omitted.

If you have a machine joined into a domain (Active Directory, FreeIPA, others), it already has a custom CA certificate installed into its store. So this domain CA will just sign the certificate for the local DNS server, like it does for other local TLS services. If you don't, just make up a local CA and install the cert on your machines or devices. No need to drag letsencrypt and co into the game, that's only for pub…

What about PiHoles as well as consumer devices like Chromecast? Once CC uses DNS over TLS etc it’s game over for local consumer DNS servers. No way to configure a custom CA within CC. (I’m a fan of local DNS for many reasons and so I think DoT is two steps forward for privacy and 3 steps backward for everything else)

DNS over TLS is easy to block (it is separate port), that's why browsers are pushing for DNS over HTTPS, so you cannot make them fall back on local DNS so easily.

With DoH, it will be more difficult, but still possible - you will have to run your own proxy. I imagine, that folks that came up pihole, will package something similar that includes proxy.

On such networks, devices that won't allow to enroll custom certificates won't get onto Internet. It is then up to the user, what he or she prefers, privacy and control or that specific product.

I actually like DoT a DoH as protocols, from the privacy point of view. However, I don't like their implementations and the lockdown they are used for, where they try to establish the tunnel out of the local networks, taking control out of their owners.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#103

Post by pdkl95 »

fixermark wrote: post #46
sofaofthedamned wrote: post #29

Earlier quoted context omitted.

Not just Google - when you cast you handoff a URL to the CC to stream from - this could be from Netflix, or anywhere really. 8.8.8.8 as a brute-force backup I can understand, but by default it should be taking the network DHCP settings.

That default, sadly, would basically guarantee the thing doesn't work for all too many users. And as a consumer electronics product (especially in the sub-$50 price-range), the market-smart thing to do is configure the defaults to work in the saddle-point of worst-case and common scenario (i.e. badly-configured local router talking to a standards-hostile ISP's DHCP configurations).

The proper thing to do is to use the DNS settings the DHCP server provided and testing those settings by providing a server the device can lookup and connect to (with TLS). If the server proved it's authenticity, the DNS settings work. (some devices might cache this result, others might do this during startup)

If an error occurs or a reasonably short timeout expires, the device can: if it has UI the user will see, it can report the problem to the user and ask if it's ok to try a common fix (which can be explained in detail in an optional "[technical details]" popup). If the user approves, then retry with the hardcoded DNS server (or any other workaround). If the device doesn't have a UI that could realistically ask this type of question, automatically trying the fix when the DNS test fails might be appropriate.

TL;DR - don't make assumptions about the user's situation, even if you think it is "market-smart". Test for the required behavior and fail-safely by enabling the common workarounds.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#104

Post by dang »

scrollaway wrote: post #18
anilakar wrote: post #17

Earlier quoted context omitted.

It's being upvoted because the issue was raised by none other than the father of DNS.

Given the ratio of people who upvote stories based on their title without clicking through, I highly doubt that.

We don't know what that ratio is, as we don't track it, and I'm skeptical that anyone does.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#105

Post by josteink »

adsadadsad wrote: post #98
josteink wrote: post #93

Earlier quoted context omitted.

> bind it to it's own local dnsmasq or whatever and then send DNS onward to DHCP DNS servers supplied by your ISP... There's a reason for the push for DNS over HTTPS. This is looking at things and totally backwards. You have a local problem, a broken router and you suggest we fix this by changing how all edge nodes on the internet works. In the age of ever increasing, untrustworthy IOT-devices, you don’t solve this p…

I'm not sure Im following why is HTTPS going to cause a shitload more problems?

Not HTTPS. DNS over HTTPS.

If we create internet infrastructure (like DNS over HTTPS) which prevents network operators from actually operating their networks, I’m 100% confident we will find it has bad, unintended and irreversible consequences.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#108

Post by IncRnd »

scrollaway wrote: post #14

I'm always shocked at how easy it is for people to fall into the "Google is evil!!1" trap on such trivial stuff (and funnily enough, much more serious privacy issues related to Google are ignored/downvoted). Hardcoded DNS servers are common. Extremely common in a bunch of IOT devices, given how broken some ISPs are. This is a non-story and the only reason it's being upvoted is because Google is doing it, and they als…

The author of that email, Paul Vixie, is not some random person saying, "Google is evil!!!" He is eminently qualified to speak about DNS, since he designed it.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#109

Post by SmellyGeekBoy »

adsadadsad wrote: post #84
pexaizix wrote: post #62

Earlier quoted context omitted.

>My Chromecast went through massive amount of trouble to use Google's DNS servers No it didn't, it just queried 8.8.8.8 instead of whatever DNS server your DHCP configuration told it to use. Putting "nameserver 8.8.8.8" in /etc/resolv.conf and marking it read-only would have the same effect. Doesn't look like much trouble does it?

Oh and in the chromecast (non-ultra anyway), chromecast attempts to ignore any DNS servers supplied by your DHCP - hence why the watch-TV VPN's smartdns fails. Good luck rooting your Chromecast and chattr +i it's /etc/resolv.conf

How does a device "attempt to ignore" DNS servers supplied by DHCP? Like all devices connected to a network it must either use DHCP to get your DNS server or use a hardcoded value, it's not some kind of conspiracy.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#110

Post by tatoalo »

scrollaway wrote: post #14

I'm always shocked at how easy it is for people to fall into the "Google is evil!!1" trap on such trivial stuff (and funnily enough, much more serious privacy issues related to Google are ignored/downvoted). Hardcoded DNS servers are common. Extremely common in a bunch of IOT devices, given how broken some ISPs are. This is a non-story and the only reason it's being upvoted is because Google is doing it, and they als…

I agree with you on the "G is evil" and so on, I've used Google WiFi and used Cloudflare DNS(as a test) with no problem...(the serious discussion would be why people blindly trust Cloudflare over x or y or z, out of scope now :D)
Post reply on HN