311–320 of 519 posts
I agree with the shadiness of this, but just to play devil's advocate here, is this to work around shitty ISP's that play games with DNS? Residential ISPs have not exactly been good faith actors in this game ...
Earlier quoted context omitted.
It's not unreasonable to attempt to use DHCP provided DNS servers. It's not unreasonable to use fallback DNS servers when the DHCP provided servers don't work. It would be a bit strange, but maybe not altogether unreasonable to run a fully recursive DNS client with root.hints and what not. I guess you could argue over reasonableness of favoring the fallback DNS over DHCP. It's not reasonable to ignore DHCP when the f…
> It's not unreasonable to use fallback DNS servers when the DHCP provided servers don't work. I don't know about "reasonable" or "unreasonable". I do know that there's no way I'd allow this in my network. My DHCP servers point to my own DNS server for a good reason, and I am completely invested in ensuring that nobody bypasses it to the best of my ability.
Earlier quoted context omitted.
Came here to say exactly this. Why even make a fuss about it? Bro, do you even NAT? The argument is Google can record what you're sending your Chromecast. Well, (sorry for the crudeness) no shit... You're using Google hardware. If you're going to act like the DoD and not use Huawei switches, then don't use Huawei switches. If you so choose, you must look at Google as malevolent as the US DoD would see an attacking na…
Cool, I'll be sure to tell my mother-in-law that if she's concerned about her privacy, she just needs to use NAT "bro".
A more plausible version - google knows most of the people use shitty ISP provided DNS servers, so instead it's using faster DNS that wouldn't inject shit as your ISP will.
EDIT: never mind. It's for ads.
Earlier quoted context omitted.
It's not unreasonable to attempt to use DHCP provided DNS servers. It's not unreasonable to use fallback DNS servers when the DHCP provided servers don't work. It would be a bit strange, but maybe not altogether unreasonable to run a fully recursive DNS client with root.hints and what not. I guess you could argue over reasonableness of favoring the fallback DNS over DHCP. It's not reasonable to ignore DHCP when the f…
> It's not unreasonable to use fallback DNS servers when the DHCP provided servers don't work. I don't know about "reasonable" or "unreasonable". I do know that there's no way I'd allow this in my network. My DHCP servers point to my own DNS server for a good reason, and I am completely invested in ensuring that nobody bypasses it to the best of my ability.
Then your network is a private walled garden and not "the internet", and I don't know why you expect consumer devices designed to be able to get to the open internet to work unmodified.
I mean, I'm sure your decisions are made with the best intent, but how is what you're doing any different technically than the DNS hijacking the Comcast et. al. have been caught doing?
Earlier quoted context omitted.
I'm not sure Im following why is HTTPS going to cause a shitload more problems?
Not HTTPS. DNS over HTTPS. If we create internet infrastructure (like DNS over HTTPS) which prevents network operators from actually operating their networks, I’m 100% confident we will find it has bad, unintended and irreversible consequences.
Earlier quoted context omitted.
It doesn't bother me because it's a Chromecast, an appliance I don't want or need. If I needed something similar, I could get it from other manufacturers.
FWIW, Chrome does this as well. Its DNS prefetch feature will ignore your local hosts file and configured DNS servers. It creates annoying problems if you have a VPN where some hosts resolve differently than they do publicly. Granted, in this case if you block Google's DNS servers from routing, Chrome will use your system's name resolution configuration.
Gotta love Paul's approach. Amazing to see things that break when you run a black hole DNS server on your inside network. I have a Samsung TV that won't complete boot until it has verified there aren't any firmware updates at Samsung. I finally resorted to copying the http response traffic and having an a bit of code on my RasPi return it when the TV asks (it says "no new firmware for you"). Of course these sorts of…
The extend to which modern appliances feel a need to be internet connected is getting ridicules. My TV isn't going to be internet connected, even if it's able to. It simply have no reason to. Smart TVs in particular should not be a thing. The TV manufactures have proven themself incapable of writing and maintaining software, so at this point they should accept defeat and just produce the TVs with enough HDMI connecti…
I admire your sentiment but recognize that on the current path that means at some point in the future this choice will mean "I don't have a TV." What is missed here, and alluded to in other comments, is that the costs for things are being subsidized by selling the digital exhaust they generate. Creating more exhaust means more margin, less (or even zero) exhaust means less margin. Since consumer electronics compete on price, a zero exhaust device will cost more and won't sell as well. So the market won't produce them. Further, the ability to convert a consumer device to one that generates zero exhaust will get targeted, and since there is no way to "win" that race, the final act will be a consumer device that refuses to operate if its ability to spew digital breadcrumbs is disrupted. Just like HP "all in one" printers will refuse to scan a document if they are low on ink. They don't need ink to scan, but the purpose of the printer is to create a recurring revenue stream for high margin ink, so all functions are in service to that purpose. Allowing utility that would mitigate the need to buy ink is unacceptable.
Earlier quoted context omitted.
> bind it to it's own local dnsmasq or whatever and then send DNS onward to DHCP DNS servers supplied by your ISP... There's a reason for the push for DNS over HTTPS. This is looking at things and totally backwards. You have a local problem, a broken router and you suggest we fix this by changing how all edge nodes on the internet works. In the age of ever increasing, untrustworthy IOT-devices, you don’t solve this p…
>DNS over HTTPS is going to cause a shitload more problems than it solves. Oh, absolutely. What I wonder is if people don't notice this, or they do but believe Google is right in pushing fundamental internet design decisions that prioritize Google's incidental access to surveillance data over a high quality and resilient network for everyone.
By control, what I mean is that once DoH usage to G servers hits critical mass, they can decide who can visit what. Not that they would, but they can. People generally do what people can do.
Earlier quoted context omitted.
As someone who has had to block and redirect DNS traffic, there are reasons we do this and if you have a problem with it then you should contact the admins about it. If you're unwilling to do that, maybe you shouldn't be doing what you're trying to do at work.
Do you happen to be the admin at the meeting venue that discarded my SRV and DNSSEC lookups? What were the reasons you did this, if so?
Earlier quoted context omitted.
> It's not unreasonable to use fallback DNS servers when the DHCP provided servers don't work. I don't know about "reasonable" or "unreasonable". I do know that there's no way I'd allow this in my network. My DHCP servers point to my own DNS server for a good reason, and I am completely invested in ensuring that nobody bypasses it to the best of my ability.
> I am completely invested in ensuring that nobody bypasses it to the best of my ability. Then your network is a private walled garden and not "the internet", and I don't know why you expect consumer devices designed to be able to get to the open internet to work unmodified. I mean, I'm sure your decisions are made with the best intent, but how is what you're doing any different technically than the DNS hijacking the…
Because he's doing it on his network with his devices that he paid for.
He's not meddling with the traffic of paying customers.