Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium's Impact on Root DNS Traffic

blog.apnic.net

Post reply on HN
Print view View original

81–90 of 221 posts

Re: Chromium's Impact on Root DNS Traffic

#81

Post by gsich »

stefan_ wrote: post #68
pilif wrote: post #64

Earlier quoted context omitted.

how would they maintain the root servers and correct issues without shell access or tcpdump? Make blind guesses and restart the server until the problem goes away (it won't)? No matter how high-profile the environment, eventually, the rubber will hit the road and some human will be in a privileged position to be able to fix a problem. That is true for every single service out there. Yes. Including Gmail. Including AW…

Why is a server with a problem still part of the root zone? And no, this is absolutely not the case for serious operators. Access to production systems is highly regulated.

How do you remove it?

Re: Chromium's Impact on Root DNS Traffic

#82

Post by gbil »

joshuamorton wrote: post #39
gbil wrote: post #31

Earlier quoted context omitted.

Sure and I explained why it hit us when it hit us Also keep in mind that Edge is chromium based now and has the same issue. And is becoming the standard by MS and thus the impact is increased now because of this

Sure, lockdown and increased VPN use makes sense as to why this got painful in march. However I expect GP was quibbling with this part of your statement: >Furthermore if I remember correctly this "feature" in chrome was enabled in a version which was distributed to our clients maybe a month before the lockdowns so there was little time to see the effect while clients were still in the office Which claims that the fea…

Fair enough, but I wrote if I remember correctly which obsiously I didn't and confused when we got hit by it with the actual implementation

Re: Chromium's Impact on Root DNS Traffic

#83

Post by fanf2 »

mschuster91 wrote: post #13

The worst thing is, this will not even detect a well written NXDOMAIN interceptor that only hijacks requests to valid top level domains. It's about time for DNSSEC to be available on all TLDs and for browsers to nag if it is broken.

DNSSEC allows a recursive DNS server to absorb these Google Chrome junk queries: the resolver can use a secure proof of nonexistence to answer the junk query from cache. Much more efficient, and works to absorb junk traffic in any domain signed with NSEC, not just the root. https://tools.ietf.org/html/rfc8198 https://www.potaroo.net/ispcol/2019-04/root.html

Re: Chromium's Impact on Root DNS Traffic

#84

Post by fanf2 »

stefan_ wrote: post #62

Why on earth is there someone with shell access to the DNS root zone and running tcpdump?

This study used the DITL “day in the life” DNS data collection exercise https://www.dns-oarc.net/oarc/data/ditl which is formally organized regular research activity.

Re: Chromium's Impact on Root DNS Traffic

#87

Post by _qulr »

On macOS you can block these with the excellent product Little Snitch.

I've got several rules for Google Chrome in Little Snitch that seem to do the trick. Deny outgoing UDP connections, and Deny outgoing TCP connections to port 80 for the IP addresses and domain for my ISP. You can see these if you monitor traffic.

Re: Chromium's Impact on Root DNS Traffic

#88

Post by mehrdadn »

brown9-2 wrote: post #86
peteretep wrote: post #58

Wait, so Chrome leaks the first word of my searches to my ISP? That doesn’t sound like something I want to happen

You can prefix your searches in the omnibox with “?” and they won’t be treated as possible short local network names

Ctrl+K for Windows users looking for a shortcut key.

Re: Chromium's Impact on Root DNS Traffic

#89

Post by merlinscholz »

russellbeattie wrote: post #10

I'm sure anyone here who has set up a PiHole ad-blocking DNS server at home has run into these random domain requests and wondered what was going on. At first I thought one of my devices had a virus on it or something until I did a few searches and discovered it was Chrome being ludicrous. (Next topic: Getting Chrome to actually use the DNS provider that you specify and nothing else...)

I recently just blocked port 53 in my firewall completely, for that exact reason. I use an internal DNS server the forwards to an DOH upstream server. No more rogue devices trying to use their own dns, at least until they all switch to DOH too
Post reply on HN