Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

72% of smart TVs and 46% of game consoles hardcode DNS settings

labzilla.io

Post reply on HN
Print view View original

511–520 of 673 posts

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#511

Post by gsich »

fiddlerwoaroof wrote: post #222
acdha wrote: post #221

Earlier quoted context omitted.

Network filtering means blocking traffic at the network level. Trying to use DNS for this leaves you trusting the client - and there are decades of precedent for clients bypassing that for various reasons, such as this post shows. The solution is to start doing network filtering: if you block packets to unapproved servers, you can actually stop this. You’ll need to run your own proxy, of course, but that’s always bee…

That isn’t really possible, though: CDNs mean that blocking by IP just doesn’t work. The most effective method I’ve found is transparently redirecting all traffic on port 53 to a DNS server I control. DoH means that I might as well setup a transparent HTTPS proxy.

Right now you can block the common IPs for the DoH servers and be fine.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#513

Post by vetinari »

myrandomcomment wrote: post #324
LeoPanthera wrote: post #176

Earlier quoted context omitted.

HN not liking something doesn't make it a bad choice. Kodi running on a Pi or some other low power computer is probably HN-friendly, although the usability isn't even close to as good as the Apple TV.

No Netflix or Amazon on Kodi. While I have a NAS with my media on it that Kodi worked fine on the need to open a browser and need for a keyboard and mouse became to much of a pain. I switched everything to AppleTV which had the issue of not being able to mount the NAS. Lucky there is a Kodi "port" to the AppleTV in the App Store called Mr.MC for like $8 that is pretty much Kodi with built in support for NFS, SMB, etc…

Or Nvidia Shield TV - there's Netflix, Amazon, whatever - and also the genuide Kodi, right in the Play Store.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#514

Post by sildur »

summm wrote: post #510
tyrion wrote: post #99

Earlier quoted context omitted.

Not sure about raspberry, but I use Kodi to watch Netflix all the time and it works well :) See: https://github.com/CastagnaIT/plugin.video.netflix

But no 4K, due to stupid DRM restrictions.

Yeah, I saw that. And then they wonder why people pirate movies...

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#515

Post by dghughes »

This is the exact situation I ran into trying to block ads with a pihole on a Samsung smart TV. The ads were very specific highly localized to my small province. Not something that could be random or generic.

I thought I was doing something wrong since the TV absolutely refused to accept the DNS settings I was inputting.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#516

Post by inopinatus »

the8472 wrote: post #61
jon-wood wrote: post #10

I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. While sure there are companies explicitly doing this to avoid filtering, at least in my case it’s because a significant proportion of DHCP servers are configured to send DNS to your ISP, and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN r…

> and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN responses into the IP address of their ad-laced web search, and occasionally just highjack every single query to send you to a page saying you’re approaching your bandwidth quota Universally? Perhaps in the US? But IoT devices are sold worldwide. While I do run my own recursive resolver I checked my ISP's and they're behaving…

> I'm sure google had only our best interests in mind when unleashing that on us.

Laughably, DoH is from the same gang of A-record squatters that refused to incorporate SRV into HTTP on the (now very evidently spurious) grounds that it could, in some scenarios, require an extra packet, and they couldn't work out how to make it backwards compatible.

Having been comprehensively hijacked by the interests of advertising companies, my view of the HTTP WG has never been lower. And that's a shame because there are some smart people there, tasked with slowly eroding away the last semblance of end-to-end transparency.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#517

Post by hanklazard »

Sunspark wrote: post #268
hanklazard wrote: post #111

Earlier quoted context omitted.

Yeah I worry about this sort of “annoy the customer into connecting” behavior becoming more common as integrating ads becomes more a part of the business model. Also could connect to open wifi networks in more densely populated areas The real problem will be integrated cellular connectivity with no option to disable.

If it comes with an unlimited data plan, I'd happily buy that TV just to open it up to take the SIM out of it and use it in another device.

Yeah, but if/when that situation comes about, they're not going to let you do that. They'll brick your TV when you pry it out after forcing you to void your warranty by burying it in some difficult-to-access electronic guts.

I'm waiting on some high quality "dumb" TV. I'll happily pay more for not having to worry about all this nonsense and my sense is that I'm not alone (though most people will happily continue to buy non-privacy respecting brands for a lower price).

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#518

Post by dec0dedab0de »

dralley wrote: post #489
EvanAnderson wrote: post #19

Earlier quoted context omitted.

You're right to be suspicious. The DNS-over-HTTPS model favors those who run the servers (because they get exclusive access to monetizable end user name resolution data) and those who control the resolvers. You might control the resolver on your personal computer (for now). You probably don't control it on your phone. You most likely won't control it on your embedded devices.

> The DNS-over-HTTPS model favors those who run the servers (because they get exclusive access to monetizable end user name resolution data) Hold up. You are claiming that the fact that DoH prevents DNS requests from being visible in cleartext network traffic is a bad thing ? ...what? In a world where the choice is between one party (the DNS provider) having access to my DNS requests and everyone on the network inclu…

Hold up. You are claiming that the fact that DoH prevents DNS requests from being visible in cleartext network traffic is a bad thing?

It is when its my network. If they cared about people sniffing they would use DNSSEC, but still use the network DNS server. DNS over HTTPS is just a way for shady companies to hide what they're doing.

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#519

Post by gumby »

ant6n wrote: post #490
gumby wrote: post #335

Earlier quoted context omitted.

This comment has a link to one https://news.ycombinator.com/item?id=25316823

„ KEY FEATURES Content Management/Group Management SuperSign Control Simple Network Management Protocol (SNMP) Wake-on-LAN Crestron Connected® (Network Based Control)“ That’s not a dumb TV

Doesn’t have Netflix or whatever, but you’re right it’s not dumb

Re: 72% of smart TVs and 46% of game consoles hardcode DNS settings

#520

Post by tamrix »

heavyset_go wrote: post #339
jon-wood wrote: post #10

I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. While sure there are companies explicitly doing this to avoid filtering, at least in my case it’s because a significant proportion of DHCP servers are configured to send DNS to your ISP, and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN r…

> Just be aware DNS over HTTPS is a thing now, and while the devices I’m responsible for aren’t going to try and evade your redirects, the companies that are trying to make sure ads get delivered will absolutely switch to DoH which will be much more difficult to work around. I've been running PiHole-like software on my network for a few years now. A couple of years ago, it would block over 40% of traffic consistently…

Search up some more blocklists online which are still being updated. It can use the same block lists browsers ad blocks use.

Run 'update your block lists' on your Pihole to make sure the lists are being updated correctly.

Post reply on HN