Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My Chromecast Ultra would not start until I began answering 8.8.8.8

mailarchive.ietf.org

Post reply on HN
Print view View original

421–430 of 519 posts

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#421

Post by userbinator »

chaz6 wrote: post #377
JohnFen wrote: post #278

Earlier quoted context omitted.

> Expect more of this once “DNS over HTTPS” takes hold. I do. DNS-over-HTTPS is why I've modified my network so I can MITM all HTTPS connections.

(Un)fortunately, TLS 1.3 will prevent MITM from working unless you are able to install a trusted root ca cert on the device, which I doubt is possible on Chromecast devices.

TLS and SSL before it has always prevented MITM from working without configuring your own certificates --- that's the whole point of the security it provides, after all. AFAIK TLS 1.3 doesn't change that.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#422

Post by kllrnohj »

wtallis wrote: post #410
TomMarius wrote: post #374

Earlier quoted context omitted.

How would you use the device if you blacklisted its cloud?

It's more about the fact that this device is unnecessarily requiring you to open a hole in that layer of security, potentially leaving other devices exposed if the exception for the Chromecast Ultra is not properly configured.

The device requires you to open holes to its cloud. Why does which IP it demands is open matter here? If you want to blackhole IPs yeah it's going to be painful at times. But you signed up for that by trying to blackhole IPs, no?

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#423

Post by userbinator »

ChuckMcM wrote: post #317
mrweasel wrote: post #305

Earlier quoted context omitted.

The extend to which modern appliances feel a need to be internet connected is getting ridicules. My TV isn't going to be internet connected, even if it's able to. It simply have no reason to. Smart TVs in particular should not be a thing. The TV manufactures have proven themself incapable of writing and maintaining software, so at this point they should accept defeat and just produce the TVs with enough HDMI connecti…

> My TV isn't going to be internet connected, even if it's able to. I admire your sentiment but recognize that on the current path that means at some point in the future this choice will mean "I don't have a TV." What is missed here, and alluded to in other comments, is that the costs for things are being subsidized by selling the digital exhaust they generate. Creating more exhaust means more margin, less (or even z…

This article from a while back (almost 6 years!) turned me off the idea of "smart" TVs completely: https://news.ycombinator.com/item?id=6759426

Fortunately, you can currently still spend a little extra to "stupify" a smart TV --- figure out what LCD panel it uses, then replace the "smart" part of it with a suitable driver board (search the Internet for "HDMI LVDS" --- these are basically what computer monitors use.) Interfaces are reasonably standard so they're compatible with a wide range of panels. Example: https://www.aliexpress.com/item/10-bit-lvds-controller-for-p...

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#424

Post by dragonwriter »

JohnFen wrote: post #336
josteink wrote: post #325

Earlier quoted context omitted.

Sounds interesting. Do you have a write up about creating such a setup?

No, I don't, but it's conceptually pretty easy (the devil is always in the details). I'm sure you could find something on the net describing this better. What I've done is, first, to block the HTTPS port from going anywhere except to my proxy. If you want to use HTTPS in my network, you have to install my cert. That cert is used to negotiate the HTTPS connection to the proxy. The proxy then has access to the plain-te…

> What I've done is, first, to block the HTTPS port from going anywhere except to my proxy. If you want to use HTTPS in my network, you have to install my cert.

But there are a very large number of potential HTTPS ports (a reasonably well behaved system could, as well as 443, use anything that isn't well-known or registered, or which was registered for the particular use, even if the underlying protocol was HTTPS.)

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#425

Post by glennpratt »

JohnFen wrote: post #283
Arnt wrote: post #148

Earlier quoted context omitted.

I too have written code that asks 8.8.8.8 and 8.8.4.4, because the DNS server I get from DHCP frequently is so brain-damaged. (SRV records, what's that?) I asked both in parallel. On one hand it feels wrong to not ask in parallel. On the other, $%#@%#$%!$@# the %$#%#$%^$#@%#$! packet filters that block DNS packets to everyone except the local brain-damaged resolver. Or even redirect. If Google will fight that fight I…

> On the other, $%#@%#$%!$@# the %$#%#$%^$#@%#$! packet filters that block DNS packets to everyone except the local brain-damaged resolver. Curse it all you want, but forcing all DNS lookups to be resolved by a particular server is often an important security measure.

Lolwut? Seriously, what serious exploit would be stopped by this.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#426

Post by nofunsir »

kllrnohj wrote: post #405
pixl97 wrote: post #265

Earlier quoted context omitted.

The problem here is you are falling in the same trap as the Google engineers here. Why would ______ want to do _______ with their ______ device? You can make a locked down device that only does a very limited subset of functions, but you really should make that known to the user before hand. "This device requires access to $X servers to function". If you have secret requirements that go far beyond user expectations,…

Google isn't exactly secret about the fact that Chromecast connects to Google's data centers. Especially if you're using it to, say, watch YouTube, as Paul Vixie was. Chromecast connecting to Google is not a "secret requirements that go far beyond user expectations." Expecting a cloud-connected product to continue to work when you've randomly blacklisted IPs that belong to that company is, however, an unreasonable ex…

"cloud-connected" Hacker News is not the best* place for nebulous cumulonimbus commentary.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#427

Post by mthoms »

vatueil wrote: post #417
mthoms wrote: post #254

Earlier quoted context omitted.

Interesting then, that they chose to do this instead of giving monetary and technical support to the already established opendns.org Kind of like they started Knol to compete directly with Wikipedia.

Despite what the name may suggest, OpenDNS has always been a for-profit company, and they used to serve ads in the same way ISPs have been criticized for. Offering an alternative to OpenDNS was a good choice.

Ah yes, you're right. It definitely seemed like they attempted to portray themselves as some kind of non-profit if memory serves.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#428

Post by nofunsir »

jhayward wrote: post #370
jaredmauch wrote: post #229

Earlier quoted context omitted.

You also maybe should know that I could have texted that to him as well. It's not as if we don't know each other.. i may have even been to his home previously :-)

You should perhaps consider if you are modeling the behavior that you want to see others adopt. They don't know your relationship status, they only know that you find it acceptable to be rude and dismissive in a professional environment. Newcomers, outsiders, and others will take that experience to heart.

How else would he attain status a la Linus in the mailing list world?

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#429

Post by calibas »

kllrnohj wrote: post #344
calibas wrote: post #170

This should bother people here more than it does. The last thing the Internet needs is even more dependence upon Google. They've made it quite clear through their actions that they're not supporters of a free and open Internet: https://theintercept.com/2018/09/14/google-china-prototype-l... If people don't push back against these kinds of things, Google will continue to abuse their power. There shouldn't be an army o…

> The last thing the Internet needs is even more dependence upon Google. This doesn't change that? It's a google streaming device that in order to function at all requires a connection to google's data centers. Why does it matter if that connection happens via 8.8.8.8 or some other IP resolved by a different DNS server? What is the actual, practical difference of that? It's still connecting to Google in order to prov…

I never suggested blocking 8.8.8.8, I'd think you're replying to the wrong comment but you directly quoted part of mine. I criticize Google and I get called a hypocrite for things I never said...

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#430

Post by glennpratt »

vetinari wrote: post #403
kazinator wrote: post #260

Earlier quoted context omitted.

> If Google will fight that fight I'll happily enjoy the benefits. Evidently, they are: https://en.wikipedia.org/wiki/DNS_over_HTTPS https://developers.google.com/speed/public-dns/docs/dns-over...

And that's how we are going to get mandatory https proxies in networks... The arms race will continue, making the lives of everyone more difficult.

I will never install that cert, so it stops there for me. IT security theater be damned.
Post reply on HN