Hacker News Reader

Comment by dschulz | Hacker News Reader

Aren't you doing exactly that with another recursive resolver?

With many other providers I can make deductions about likely threat scenarios. For example I know about both my ISP and about Google that it is in their best interest to serve me correct DNS entries: they have no obvious motive to do otherwise. On the other hand I can be fairly certain that my DNS queries will be fed into Google's database if I use their DNS: they have an obvious motive, have the capability and no obvious disincentive. Etc.

With some new, unknown service with unknown associations I can't reason much about the threat model.

ISPs don't care much about correctness at all if it impacts performance on their side in any way. That's why many people can't actually change their DNS even if they want to (unless you run a local resolver)[1].

[1] - https://news.ycombinator.com/item?id=13037858

Many ISPs abuse DNS to serve ads. One method is to rewrite all NXDOMAIN responses to an ad server. Another involves injecting ads into HTTP responses by hijacking DNS.

Although your points about capability and motive are valid, I don't think that Google does feed DNS queries into a database. Given all the evil DNS servers out there, I think that it is in Google's best interest to provide a clean alternative and contribute to better internet infrastructure.

"After keeping this data for two weeks, we randomly sample a small subset for permanent storage."

https://developers.google.com/speed/public-dns/privacy

Maybe he's running his own non-recursive DNS server..

I personally trust Google with my DNS queries a bit more than some guy on HN.

Reply on news.ycombinator.com