Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My Chromecast Ultra would not start until I began answering 8.8.8.8

mailarchive.ietf.org

Post reply on HN
Print view View original

81–90 of 519 posts

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#81

Post by FactolSarin »

apostacy wrote: post #43
scrollaway wrote: post #14

I'm always shocked at how easy it is for people to fall into the "Google is evil!!1" trap on such trivial stuff (and funnily enough, much more serious privacy issues related to Google are ignored/downvoted). Hardcoded DNS servers are common. Extremely common in a bunch of IOT devices, given how broken some ISPs are. This is a non-story and the only reason it's being upvoted is because Google is doing it, and they als…

This isn't a case of an IOT device though. My Chromecast went through massive amount of trouble to use Google's DNS servers, to serve ads behind my pi-hole. It would respect all of my DHCP parameters, but silently ignore DNS settings. It was clearly intentional to serve ads. I had to set up a firewall to force it to use my DNS server. And eventually even that stopped working with an update (which themselves are reall…

The Chromecast doesn't serve ads. Individual services you run on it might, but I doubt those are being served through Google's DNS server.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#82

Post by igetspam »

scrollaway wrote: post #61
vbezhenar wrote: post #52

Earlier quoted context omitted.

"Broken" ISP are likely to intercept DNS requests, so really the only option against them is something like DNS over HTTPS.

[citation needed] on that "likely" word. I've seen instances of that, but they're extremely rare because intercepting DNS altogether is a fucked up thing to do for an ISP. Seen far, far more instances of: - ISPs shipping shitty network devices / awful factory settings - ISP's own DNS servers being terrible in various ways - Uncle Steve "the IT guy of the family" having messed with the network settings and nobody know…

TimeWarner and Comcast have both done it toe. TWC did of to let me know of a TOS violation and Comcast uses it as part of their setup. If you don't allow them to hijack DNS and show you things that you have to click through, you may find yourself unable to route traffic at all until you call them. I've dealt with this with every move in CA (about a half dozen times) and my move to TX. Seems pretty likely to me.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#83

Post by vetinari »

yardstick wrote: post #71
vetinari wrote: post #31

Earlier quoted context omitted.

It is not shitty ISPs giving fake results. It is me. My resolver does that and it is for a reason. Disrespecting what the local network tells you to use just leads to arms race.

To be fair once DNS over TLS/HTTP become mainstream, local DNS servers won’t work without valid certificates, which I’m guessing will be a pain even with letsencrypt and co.

If you have a machine joined into a domain (Active Directory, FreeIPA, others), it already has a custom CA certificate installed into its store. So this domain CA will just sign the certificate for the local DNS server, like it does for other local TLS services. If you don't, just make up a local CA and install the cert on your machines or devices.

No need to drag letsencrypt and co into the game, that's only for publicly facing machines.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#84

Post by adsadadsad »

pexaizix wrote: post #62
apostacy wrote: post #43

Earlier quoted context omitted.

This isn't a case of an IOT device though. My Chromecast went through massive amount of trouble to use Google's DNS servers, to serve ads behind my pi-hole. It would respect all of my DHCP parameters, but silently ignore DNS settings. It was clearly intentional to serve ads. I had to set up a firewall to force it to use my DNS server. And eventually even that stopped working with an update (which themselves are reall…

>My Chromecast went through massive amount of trouble to use Google's DNS servers No it didn't, it just queried 8.8.8.8 instead of whatever DNS server your DHCP configuration told it to use. Putting "nameserver 8.8.8.8" in /etc/resolv.conf and marking it read-only would have the same effect. Doesn't look like much trouble does it?

Oh and in the chromecast (non-ultra anyway), chromecast attempts to ignore any DNS servers supplied by your DHCP - hence why the watch-TV VPN's smartdns fails. Good luck rooting your Chromecast and chattr +i it's /etc/resolv.conf

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#85

Post by syn0byte »

shawnz wrote: post #25
zamazingo wrote: post #16

Earlier quoted context omitted.

Unless you want your own dns server used at all times.

But why would you care about that? You're already connecting to Google's service, YouTube, so what does it change to use Google's DNS to resolve it? What is the circumstance where you'd care about not using Google's DNS but then connect to a Google service anyway? If Chromecasts allowed arbitrary web browsing, I would maybe see your point -- but they don't.

CDN and routing optimization ala 'ECS'. Also ISPs that inject or screw with DNS queries. Its easier and more importantly cheaper to get all the same metrics and data from other sources rather than DNS. (And you already consented for those other data sources.)

I don't trust they aren't evil, they are. I trust they are also smart.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#86

Post by lelf »

scrollaway wrote: post #14

I'm always shocked at how easy it is for people to fall into the "Google is evil!!1" trap on such trivial stuff (and funnily enough, much more serious privacy issues related to Google are ignored/downvoted). Hardcoded DNS servers are common. Extremely common in a bunch of IOT devices, given how broken some ISPs are. This is a non-story and the only reason it's being upvoted is because Google is doing it, and they als…

> If Google used Google DNS to spy on people

Are you seriously thinking they don't store/analyse/use that kind of information??? (That's every site you visit, at minimum.)

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#87

Post by vetinari »

thecatspaw wrote: post #45
vetinari wrote: post #31

Earlier quoted context omitted.

It is not shitty ISPs giving fake results. It is me. My resolver does that and it is for a reason. Disrespecting what the local network tells you to use just leads to arms race.

Google doesnt care about a piHole or similar, its such a tiny tiny part of their customers its not worth fighting it at this point

Still, Google is tightening the screws: moving DNS resolver into the browser, instead of using the system one; moving DNS over to https+ESNI to hide among other traffic; forcing their own DNS servers instead of user configured. That's all together means, that they do not trust not only the ISPs, but neither the user, and that they want to have a unobstructed communication channel out of their software to the mothership, privacy and control by the users be damned.

So the pihole community is tiny, but that may be the reason, why Google thinks that they are worth the sacrifice: after all, there is just a few of them.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#88

Post by vetinari »

fixermark wrote: post #53
vetinari wrote: post #31

Earlier quoted context omitted.

It is not shitty ISPs giving fake results. It is me. My resolver does that and it is for a reason. Disrespecting what the local network tells you to use just leads to arms race.

That's the issue though---there was already an arms race (between users and ISPs), and it was making it hard to create reliable consumer electronics devices because DNS logic is complicated and the complexity adds cost (and more importantly, pushes configuration burden from the device onto the user). It sucks that customization was damaged in the arms race, but that's the nature of measure-countermeasure in web techn…

Behavior like this will make it even worse for developers; that's what arms races do.

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#89

Post by yardstick »

vetinari wrote: post #83
yardstick wrote: post #71

Earlier quoted context omitted.

To be fair once DNS over TLS/HTTP become mainstream, local DNS servers won’t work without valid certificates, which I’m guessing will be a pain even with letsencrypt and co.

If you have a machine joined into a domain (Active Directory, FreeIPA, others), it already has a custom CA certificate installed into its store. So this domain CA will just sign the certificate for the local DNS server, like it does for other local TLS services. If you don't, just make up a local CA and install the cert on your machines or devices. No need to drag letsencrypt and co into the game, that's only for pub…

What about PiHoles as well as consumer devices like Chromecast? Once CC uses DNS over TLS etc it’s game over for local consumer DNS servers. No way to configure a custom CA within CC.

(I’m a fan of local DNS for many reasons and so I think DoT is two steps forward for privacy and 3 steps backward for everything else)

Re: My Chromecast Ultra would not start until I began answering 8.8.8.8

#90

Post by pexaizix »

adsadadsad wrote: post #80
pexaizix wrote: post #62

Earlier quoted context omitted.

>My Chromecast went through massive amount of trouble to use Google's DNS servers No it didn't, it just queried 8.8.8.8 instead of whatever DNS server your DHCP configuration told it to use. Putting "nameserver 8.8.8.8" in /etc/resolv.conf and marking it read-only would have the same effect. Doesn't look like much trouble does it?

Maybe. But it's trivial, for your ADSL/DSL/Fiber shitty $30 router to intercept port 53/(udp|tcp) bind it to it's own local dnsmasq or whatever and then send DNS onward to DHCP DNS servers supplied by your ISP. When I say trivial I mean I've seen it happen on several setups, old me - we'll just change the DNS on this box to bust the cache here to 1.1.1.1(CF)/8.8.8.8(EvilG) but still end up a shitty ISP dns servers (a…

Yes I know. I've had it happen to me with a Huawei HG556a. You could disable it with admin access... which the ISP would not give you. Fun times.

A good way of bypassing this would be to simply have Google run their DNS server in a port other than 53. But I don't believe you can set a different port in /etc/resolv.conf

Post reply on HN