Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T updates firmware to block access to 1.1.1.1

dslreports.com

Post reply on HN
Print view View original

161–170 of 382 posts

Re: AT&T updates firmware to block access to 1.1.1.1

#161

Post by ocdtrekkie »

sterlind wrote: post #111
jaas wrote: post #71

I'd say there is a 98% chance this is a bug in some firmware and a 2% chance AT&T is intentionally trying to block Cloudflare DNS. I get why people are paranoid about ISPs blocking content and net neutrality, but let's not cry wolf prematurely. The technical details here strongly suggest a bug rather than intentional blocking of 1.1.1.1 DNS traffic.

Anyone work at AT&T who could give us the inside scoop on these firmware changes? Snapping a photo of the blocking code would be a valuable public service. Remember to scrub EXIF data!

More than likely:

- If the action was malicious, the people involved in writing this code are likely okay with it and not likely to leak details of it.

- If the issue is a bug, the people involved in writing this code are probably working to fix it, and not likely to leak details of it.

- People not involved with making it would likely leave an internal access trail (independent of EXIF data) when they access that code.

Which is to say, expecting an Ed Snowden every time a company does something unethical is kinda silly, otherwise we'd have Google's search algorithm by now.

Re: AT&T updates firmware to block access to 1.1.1.1

#162

Post by cottsak »

How is the ISP performing this remote update? Is it TR-069/CWMP or an open SSH port or something? Many routers will allow the user to disable TR-069 even while it's running. Often a hardware reset will also disable it and then the user can put the manufactures update on it and prevent the ISP from managing it in the future. If it's an open SSH port then we all have bigger problems.

Re: AT&T updates firmware to block access to 1.1.1.1

#164

Post by ballenf »

mischov wrote: post #95
jaas wrote: post #71

I'd say there is a 98% chance this is a bug in some firmware and a 2% chance AT&T is intentionally trying to block Cloudflare DNS. I get why people are paranoid about ISPs blocking content and net neutrality, but let's not cry wolf prematurely. The technical details here strongly suggest a bug rather than intentional blocking of 1.1.1.1 DNS traffic.

1.1.1.1 was working for me on AT&T after Cloudflare released 1.1.1.1, then shortly after that it ceased working. Maybe the firmware update has a bug, but it's very suspiciously timed. Notice that the OP is dated April 2, while 1.1.1.1 was released April 1.

A possible explanation is that the traffic from active use of 1.1.1.1 caused some backend service to get overloaded with traffic due to a faulty assumption that the address would never be used by customers. Anyone keep traceroutes while before the patch to see if there were errant stops or delays?

They had the choice of "fix the whole backend" or "block 1.x on the user end".

Guess we know which one was easier. If all this wild speculation is true, maybe they're working on a fix to the root cause and will roll back the patch when complete.

This would make the situation both due to incompetence and intentional.

Re: AT&T updates firmware to block access to 1.1.1.1

#165

Post by [deleted] »

derekp7 wrote: post #156
harshreality wrote: post #108

Earlier quoted context omitted.

In a cluster-in-a-box scenario, you could modify the OS's network scripts to have the cluster-specific private interface start after the general LAN interface is up. Check both 10/8 and 172.16/12 to see if they're used by the public interface, and use whichever one isn't for the cluster network.

That only works if the host is on the conflicting network. But if the conflict is a couple hops away, Docker won't detect it.

[deleted]

Re: AT&T updates firmware to block access to 1.1.1.1

#168

Post by cottsak »

More solid advice regarding home internet/ISP routers: https://www.tomsguide.com/us/home-router-security,news-19245...

Try to avoid the cheap bundled cable/fibre/DSL routers that ISPs "throw in" with their plans/packages.

Disable the remote management/update/TR-069/CWMP/SSH/etc if you can. You don't wanna trust someone else to secure your home.

Post reply on HN