Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium's Impact on Root DNS Traffic

blog.apnic.net

Post reply on HN
Print view View original

171–180 of 221 posts

Re: Chromium's Impact on Root DNS Traffic

#171

Post by jlg23 »

gnu8 wrote: post #143
AndyMcConachie wrote: post #102

Earlier quoted context omitted.

Not exactly. Chrome doesn't know if you're trying to enter a domain name, hence URL, or are trying to enter a search term. The Omnibar supports both. So Chrome tries to resolve the string you entered and if it gets back an NXDOMAIN it can assume that it's a search term. The problem is that some ISPs have configured their DNS resolvers to lie and not return NXDOMAIN. Instead redirecting you to some website for marketi…

So because Google thinks I am too stupid to handle a separate URL box and search box, and they are so much smarter than me that they can write a simple if-else to discern what I want with a few bullshit DNS queries, I’m stuck with a browser that leaks information and fails to do what I want several times a day until I learn to work around this behavior. And the proposed solution is for me, dumb dumb user that I am, t…

I moved to the desert in a developing country. But fibre optics to the house took 4 days and is $55/month. There is no escape.

Re: Chromium's Impact on Root DNS Traffic

#173

Post by jacobsenscott »

boring_twenties wrote: post #92
peteretep wrote: post #58

Wait, so Chrome leaks the first word of my searches to my ISP? That doesn’t sound like something I want to happen

Your local nameserver should be configured to not forward unqualified names upstream.

My local nameserver is run by comcast!

Re: Chromium's Impact on Root DNS Traffic

#174

Post by rsync »

merlinscholz wrote: post #85
peteretep wrote: post #58

Wait, so Chrome leaks the first word of my searches to my ISP? That doesn’t sound like something I want to happen

That's another reason to use an internal DNS server which queries an upstream DOH server.

"That's another reason to use an internal DNS server which queries an upstream DOH server."

Even better, spin up a little VM or VPS somewhere in the cloud, install 'unbound' as a recursive resolver and point it to your nextdns.io account/address.

Let's unpack this ... backwards ...

DNS servers out on the Internet are queried by nextdns, which presumably has no PII from you other than your CC number[1] and zip code.

Nextdns receives nothing but queries from some random VPS/EC2/VM IP. Again, presumably a provider that knows (almost) nothing about you.

Your ISP sees nothing ... just encrypted DNS traffic.

It's win, win, win.

You see no ads, since nextcloud.io acts like a pihole and strips/blocks all of the malicious hostname lookups.

[1] Remember, only AMEX verifies cardholder FIRST LAST. Use your VISA/MC. I think my first/last is Nextdns User or whatever ... YMMV if a merchant is enrolled in that weird "verified by visa" service ...

Re: Chromium's Impact on Root DNS Traffic

#175

Post by boring_twenties »

jacobsenscott wrote: post #173
boring_twenties wrote: post #92

Earlier quoted context omitted.

Your local nameserver should be configured to not forward unqualified names upstream.

My local nameserver is run by comcast!

Really? Your router does not have a caching nameserver built in?

Re: Chromium's Impact on Root DNS Traffic

#176

Post by boring_twenties »

kevincox wrote: post #135
boring_twenties wrote: post #92

Earlier quoted context omitted.

Your local nameserver should be configured to not forward unqualified names upstream.

So how does it resolve com then? Or the (small number) of sites that are on the TLD.

It doesn't. It's not a recursive resolver. It forwards qualified names (those including a dot) to the upstream nameserver (the ISP's).

Re: Chromium's Impact on Root DNS Traffic

#177

Post by boring_twenties »

stjohnswarts wrote: post #163
boring_twenties wrote: post #92

Earlier quoted context omitted.

Your local nameserver should be configured to not forward unqualified names upstream.

How many people know how to configure their local name server outside of the HN crowd?

This is the default configuration in all consumer routers I've seen. Granted, that's not very many.

Re: Chromium's Impact on Root DNS Traffic

#178

Post by bacondude3 »

rsync wrote: post #174
merlinscholz wrote: post #85

Earlier quoted context omitted.

That's another reason to use an internal DNS server which queries an upstream DOH server.

"That's another reason to use an internal DNS server which queries an upstream DOH server." Even better, spin up a little VM or VPS somewhere in the cloud, install 'unbound' as a recursive resolver and point it to your nextdns.io account/address. Let's unpack this ... backwards ... DNS servers out on the Internet are queried by nextdns, which presumably has no PII from you other than your CC number[1] and zip code. N…

> Remember, only AMEX verifies cardholder FIRST LAST. Use your VISA/MC.

Do you have a source for this?

Re: Chromium's Impact on Root DNS Traffic

#179

Post by kube-system »

boring_twenties wrote: post #175
jacobsenscott wrote: post #173

Earlier quoted context omitted.

My local nameserver is run by comcast!

Really? Your router does not have a caching nameserver built in?

Both may be true. https://www.logicum.co/wp-content/uploads/2016/08/Comcast-Ro...

Re: Chromium's Impact on Root DNS Traffic

#180

Post by thayne »

Slartie wrote: post #29
thayne wrote: post #25

Earlier quoted context omitted.

Google could, you know, use their own DNS servers for this...

No, they couldn't. The whole purpose of these probe requests is to assess whether the DNS server used by a particular client is acting normally (responding with NXDOMAIN if a domain does not exist), so these must bde sent to the DNS server of the client, which effectively means that unless this DNS server performs the hijacking that is to be detected, they will inevitably end up on a root DNS server, because no serve…

ah, good point.
Post reply on HN