Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium's Impact on Root DNS Traffic

blog.apnic.net

Post reply on HN
Print view View original

61–70 of 221 posts

Re: Chromium's Impact on Root DNS Traffic

#61

Post by jlgaddis »

gzer0 wrote: post #30
russellbeattie wrote: post #10

I'm sure anyone here who has set up a PiHole ad-blocking DNS server at home has run into these random domain requests and wondered what was going on. At first I thought one of my devices had a virus on it or something until I did a few searches and discovered it was Chrome being ludicrous. (Next topic: Getting Chrome to actually use the DNS provider that you specify and nothing else...)

Would these have occurred on a sever that has unbound as its upstream?

Why wouldn't they?

Chrome doesn't care what DNS server software is in use (even if it could figure that out), it cares whether it's behaving properly or not.

Re: Chromium's Impact on Root DNS Traffic

#63

Post by keeperofdakeys »

jlgaddis wrote: post #60
gbil wrote: post #6

Earlier quoted context omitted.

We got hit by this issue in March when our remotr users increased 5+ times and the DNS traffic going through our VPNs was causing a headache to our DNS servers. We pinpointed this to tis Chrome functionality, which includes also other chromium based browers like new Edge, and we had to deploy a relevant GPO to disable this functionality. Some background, I'm talking about ~200+k remote users. Also while in the office…

In a corporate / enterprise network where the DNS servers are Windows servers (domain controllers, in my experience, most of the time), the best thing you can do is stand up a few instances of , running on Linux, set them up as slaves for your internal zones, and point your users at those servers instead of your Windows servers.

You can also use stub zones to forward traffic for a single subdomain to your AD servers, while the other dns server handles recursive queries to the internet.

Re: Chromium's Impact on Root DNS Traffic

#64

Post by pilif »

stefan_ wrote: post #62

Why on earth is there someone with shell access to the DNS root zone and running tcpdump?

how would they maintain the root servers and correct issues without shell access or tcpdump? Make blind guesses and restart the server until the problem goes away (it won't)?

No matter how high-profile the environment, eventually, the rubber will hit the road and some human will be in a privileged position to be able to fix a problem.

That is true for every single service out there. Yes. Including Gmail. Including AWS. Including Twitter. Everywhere.

Depending on size and profile of the service it's more or less people in need of jumping through more or less hoops to get there, but this must be true for any service.

Always keep this in mind when you make the decision to move your data to a cloud service.

Re: Chromium's Impact on Root DNS Traffic

#65

Post by 0xdeadb00f »

Shared404 wrote: post #48
elric wrote: post #46

Earlier quoted context omitted.

Isn't that just a matter of educating users? Users, contrary to popular belief, are not stupid. Everyone starts off knowing nothing at all, but we can teach them what an address is and we can teach them how to search for things.

> Users, contrary to popular belief, are not stupid. "I don't care about learning, I just want it to work." "Why do I care again?" "Just make it do it right." "Can you come fix the CPU again?" (Speaking about PC, with the difference explained multiple times previously.) "Can you come fix the computer again?" (Same person speaking about monitor. Difference also explained previously.) These are all actual quotes from F…

Ignorance isn't stupidity. But it may be classified as stupid to purposefully remain ignorant so idk.

But I do see your point.

Re: Chromium's Impact on Root DNS Traffic

#66

Post by 1vuio0pswjnm7 »

jve wrote: post #54
1vuio0pswjnm7 wrote: post #49

Why does Chrome (Google) need to know whether DNS is being intercepted? What actions does Google take based on the answer? Note that under this crude test of sending queries for unregistered domains, a user who administers their own DNS could be indistingushiable from "DNS interception" by an ISP or other third party. I administer my own DNS. I do not use third party DNS. These random queries would just hit my own DN…

From article: > Users on such networks might be shown the “did you mean” infobar on every single-term search. To work around this, Chromium needs to know if it can trust the network to provide non-intercepted DNS responses. Don't know if this is the sole reason.

I think you are right.

Reminds me of the story behind "Google Public DNS". Back in 2008/2009, OpenDNS was hijacking "queries" (NXDOMAIN) typed in the address bar to their own search page ("OpenDNS Guide", or some such) on an opendns.com subdomain. In response, Google launched its own open resolver.^1 (OpenDNS was later acquired by Cisco)

1. http://umbrella.cisco.com/blog/opendns-google-dns

Re: Chromium's Impact on Root DNS Traffic

#67

Post by encom »

mschuster91 wrote: post #13

The worst thing is, this will not even detect a well written NXDOMAIN interceptor that only hijacks requests to valid top level domains. It's about time for DNSSEC to be available on all TLDs and for browsers to nag if it is broken.

This comment, and another one mentioning DNSSEC has been downvoted.

Please explain why you hate DNSSEC instead of downvoting things you disagree with.

Re: Chromium's Impact on Root DNS Traffic

#68

Post by stefan_ »

pilif wrote: post #64
stefan_ wrote: post #62

Why on earth is there someone with shell access to the DNS root zone and running tcpdump?

how would they maintain the root servers and correct issues without shell access or tcpdump? Make blind guesses and restart the server until the problem goes away (it won't)? No matter how high-profile the environment, eventually, the rubber will hit the road and some human will be in a privileged position to be able to fix a problem. That is true for every single service out there. Yes. Including Gmail. Including AW…

Why is a server with a problem still part of the root zone? And no, this is absolutely not the case for serious operators. Access to production systems is highly regulated.

Re: Chromium's Impact on Root DNS Traffic

#69

Post by amalcon »

thayne wrote: post #25
the_pwner224 wrote: post #7

Earlier quoted context omitted.

Just thinking for a few seconds, I can think of a number of ways to not repeatedly spam DNS servers while still accomplishing the objective. If you were to send 3 random queries to Google every time you opened your browser, you would quickly get hellbanned behind a recaptcha. Not saying that we should embark on some quest for retribution against Google. It's just sad.

Google could, you know, use their own DNS servers for this...

It wouldn't usually help to use 8.8.8.8, but they probably could use their own authoritative servers instead of the root servers. Look up .dnstest.google.com or .dev or something.

The problem with this is, of course, that a malicious resolver could detect this and NXDOMAIN those queries, while passing others through. I don't see what the incentive would be for ISPs to do that, but ISPs are weird.

Post reply on HN