Hacker News Reader

Comment by scrollaway | Hacker News Reader

I'm always shocked at how easy it is for people to fall into the "Google is evil!!1" trap on such trivial stuff (and funnily enough, much more serious privacy issues related to Google are ignored/downvoted).

Hardcoded DNS servers are common. Extremely common in a bunch of IOT devices, given how broken some ISPs are. This is a non-story and the only reason it's being upvoted is because Google is doing it, and they also control the DNS server.

You know what would be an actual story though? If Google used Google DNS to spy on people. If anyone has concrete evidence that they're doing that, that is a big fucking deal. Not some email about a google-complaint-of-the-week.

Edit: To be clear I'd agree that in a high quality product there needs to be a way to change the DNS servers. Then again, this is a $30 device to hook up TVs, and I've seen $200 routers lacking that ability.

----

Edit 2, elaborating on the above: You make a cheap device that will likely end up in millions of homes and your #1 support issue is "It doesn't work [because my ISP is terrible therefore my network configuration is shit]!". What do you do? Do you tell your consumers to suck it up and talk to their ISP? Or do you… hardcode a DNS server that you at least know will work?

"Issues" like this one are non-issues and distract from the myriad of very real privacy issues coming out of Google. Yes, this should be configurable at the very least… then again, Google products aren't exactly known for their wonderful configurability.

View on HN

It's being upvoted because the issue was raised by none other than the father of DNS.

Well... Paul Mockepetris may not agree with that. But he's also the kind of guy who wouldn't mind.

This isn't a case of an IOT device though. My Chromecast went through massive amount of trouble to use Google's DNS servers, to serve ads behind my pi-hole.

It would respect all of my DHCP parameters, but silently ignore DNS settings.

It was clearly intentional to serve ads. I had to set up a firewall to force it to use my DNS server. And eventually even that stopped working with an update (which themselves are really hard to block).

I think the Chromecast is the ideal Google device, and a preview of what Google's model is: It slowly removes features through updates that you cannot turn off, and would rather fail completely than not be able to serve you ads.

I can't really entertain the suggestion that pi-holes are considered by Google as a serious-enough threat that they'd go through this trouble just to fuck with it.

Seriously, think about the venn diagram of Chromecast users and pi-hole users. It looks a lot like a tennis ball being dropped into the sun.

Um, the pi-hole wasn't specifically targeted. They just wouldn't accept anything other than Google's DNS. Some ISPs will do DNS hijinks too, like transparently intercepting port 53 traffic and re-routing it.

At a maximum rate of $58 per tenis ball:

https://www.statista.com/statistics/195680/share-of-keywords...

Mesothelioma cost 319$ 5 years ago and I'm pretty sure it's only gone up since then: https://www.adgooroo.com/the-most-expensive-keywords-in-paid...

i don't think its totally unreasonable. the same thing could be said about the people who used adblock back in the day, but im sure google knowing what they know now would never let it thru. im pretty sure they are actively thinking about it now and how to ensure that they can deliver what they want directly to our eyes no matter what. from the position of google everything else would be stupid, im pretty sure they learned the lesion.

Google would certainly be aware of pi-holes and the potential of the threat, but to put things back in context we're talking about a mass-market device which has to deal with bad network config, bad isps, bad routers, etc. What's more likely?

I really gave Chromecast an honest run for the money. One day at the start the of the weekend, it started hanging at 80% when initiating streaming content I had purchased on the Play store. The forums had a ton of other people who were complaining about the same thing. Google had pushed out an update that they apparently hadn't event done the most rudimentary testing on. They didn't roll back, and they didn't fix it until after the weekend. I replaced it with a Roku, and I no longer trust Google to do consumer devices.

The Chromecast doesn't serve ads. Individual services you run on it might, but I doubt those are being served through Google's DNS server.

The Chromecast hard-codes Google DNS so _any_ service you run on it resolves through Google DNS.

How is "hardcoding 8.8.8.8" a "massive amount of trouble?"

> would rather fail completely than not be able to serve you ads.

Google is an ad company; if you don’t watch the ads, you’re not a useful product.

It doesn’t matter you “bought a product”, this behavior is their corporate DNA. It’s the Office to their Microsoft. Time and time again, we see a clear behavior from Google: that everything feeds the ad machine — or else!

Could you solve this by just routing 8.8.8.8 to your own DNS inside your network?

How is that simple? I know a lot of developers that couldn't easily do that.

I wouldn't necessarily expect a developer to know how to manipulate network traffic. The OSI model extends a bit to humans as well. But any network engineer can add a DNAT rule.

This is how I solved it.

Someone above says an update prevented this somehow, though.

It seems unlikely to me that the DNS client has the sophistication to know that it's not Google's 8.8.8.8 that it's talking to. That would be a nightmare to maintain; the 8.8.8.8 team changes some implementation detail, and then all Google clients stop working (and are now unable to update because they refuse to resolve DNS names)? I doubt they implemented that because it's crazy.

>It seems unlikely to me that the DNS client has the sophistication to know that it's not Google's 8.8.8.8 that it's talking to

I don't know much about DNS but based on what I do know I would think this to be trivial(?). All you'd need to do is make a request for a domain that doesn't exist. Something like "is-this-google-dns-im-connecting-with.google" or <salted hash of current timestamp>.com. Google DNS could be coded to respond accordingly.

So no DNS response, or not the response you were expecting = not Google DNS.

Clever, kind of reminds me of how map makers insert fake 'trap streets' to prove copyright theft.

>It seems unlikely to me that the DNS client has the sophistication to know that it's not Google's 8.8.8.8 that it's talking to.

DNS over TLS and DNS over HTTPS will change that. Google has pushed encryption in all their other products, and is pushing these implementations so do not be surprised when their end user devices use it by default.

I also don't see a way they could do it, but then I only know just enough to be dangerous, as they say.

how is it showing you ads ? Haven't seen any yet.

pi-hole also blocks tracking services. And I'm sure chromecast is full of tracking to enhance the value of your account.

Surely you'd know, right? As Pi-Hole logs all of this stuff.

just install apps or use chrome to browse (on Chromecast Ultra of course)

hmm, won't that all get worse with DND over HTTPS?

here i thought DoH was the panacea, solving all our DNS troubles. but this is one case where DoH doesn't help at all. on the contrary. with DoH we will have no control at all where our apps resolve their DNS requests.

I was going to post something similar. This is not an accident or a mistake. This was done on purpose.

>My Chromecast went through massive amount of trouble to use Google's DNS servers

No it didn't, it just queried 8.8.8.8 instead of whatever DNS server your DHCP configuration told it to use.

Putting "nameserver 8.8.8.8" in /etc/resolv.conf and marking it read-only would have the same effect. Doesn't look like much trouble does it?

Maybe. But it's trivial, for your ADSL/DSL/Fiber shitty $30 router to intercept port 53/(udp|tcp) bind it to it's own local dnsmasq or whatever and then send DNS onward to DHCP DNS servers supplied by your ISP. When I say trivial I mean I've seen it happen on several setups, old me - we'll just change the DNS on this box to bust the cache here to 1.1.1.1(CF)/8.8.8.8(EvilG) but still end up a shitty ISP dns servers (and their poisoned cache regardless). There's a reason for the push for DNS over HTTPS.

You think you're guaranteed to be querying 8.8.8.8 with "nslookup hostname.tld 8.8.8.8"?

> bind it to it's own local dnsmasq or whatever and then send DNS onward to DHCP DNS servers supplied by your ISP... There's a reason for the push for DNS over HTTPS.

This is looking at things and totally backwards. You have a local problem, a broken router and you suggest we fix this by changing how all edge nodes on the internet works.

In the age of ever increasing, untrustworthy IOT-devices, you don’t solve this problem by taking control away from the network operator. You need to increase his control. Taking DNS out of his hands is literally madness.

Good luck trying to block their attempts to spy and report on you now!

DNS over HTTPS is going to cause a shitload more problems than it solves.

In a world of mobile devices and public WiFi spots set up by random businesses, you're saying we should trust the network operator? That's a rather odd argument.

>DNS over HTTPS is going to cause a shitload more problems than it solves.

Oh, absolutely. What I wonder is if people don't notice this, or they do but believe Google is right in pushing fundamental internet design decisions that prioritize Google's incidental access to surveillance data over a high quality and resilient network for everyone.

I believe that they have created a double-edged razor blade. DoH can protect people that have malicious ISP's. It also hands over a lot more control to Google. I don't like either of those scenarios.

By control, what I mean is that once DoH usage to G servers hits critical mass, they can decide who can visit what. Not that they would, but they can. People generally do what people can do.

I'm not sure Im following why is HTTPS going to cause a shitload more problems?

Because it's encrypted to the app rather than the endpoint's OS or local DNS, so it's more difficult for the system owner to override it or implement a systemic policy.

The performance characteristics are also rather unfortunate. TCP handshake + TLS handshake with multiple public key operations + TCP protocol overhead adds quite a lot of both latency and computation vs. UDP DNS. DoH is even worse. There would have been ways (e.g. DNSCurve) to get equivalent or better security with less latency and computation if it weren't for horrible middleboxes breaking everything they don't understand.

And all that complexity is attack surface.

Not HTTPS. DNS over HTTPS.

If we create internet infrastructure (like DNS over HTTPS) which prevents network operators from actually operating their networks, I’m 100% confident we will find it has bad, unintended and irreversible consequences.

If by "network operators" you mean ISP's then I don't care. They have proven beyond a shadow of a doubt that they are malicious ones more often than not and I want them to be a dumb pipe NOT someone who is mucking around with my network. I will take being able to PICK who I trust my DNS with over being forced to use my ISP's any day of the week. One of those things I can change, one of them I cannot.

By network operator I mean me, the person controlling my own local network.

Also: ISPs behave nice almost everywhere in the world where there is proper regulation.

What you have in the US is not a technical problem. It’s a regulatory one.

yup, hey i bought this device, that i cannot see what it is doing exactly. great.

Agreed. Many orgs will end up null routing the DoH resolver IP addresses. I warned them about this from the start of DoH development and they ignored me, since most end users won't block anything.

Yes I know. I've had it happen to me with a Huawei HG556a. You could disable it with admin access... which the ISP would not give you. Fun times.

A good way of bypassing this would be to simply have Google run their DNS server in a port other than 53. But I don't believe you can set a different port in /etc/resolv.conf

Possibly feasible with local netfilter/iptables rules or maybe userland proxy/rerouter. set /etc/resolv.conf to localhost:53, have that forward to 8.8.8.8:1053 or whatever, but without encryption it could be detected I'm guess with deep packet filtering (hopefully beyond the thoroughput constraints of eyeball ISPs)

Is it reasonable to fail if you can't access a specific DNS server? This is unexpected behavior.

And I don't have access to the /etc/resolv.conf on my Chromecast, that's the problem! Anyway, there's a new thread on this specific phenomenon. I'm glad I'm not the only one: https://news.ycombinator.com/item?id=19170671

If it's a hot-fix for ISP troubles then I can imagine it being overlooked. Nobody working at Google would ever fail to connect to 8.8.8.8 while developing it.

Oh and in the chromecast (non-ultra anyway), chromecast attempts to ignore any DNS servers supplied by your DHCP - hence why the watch-TV VPN's smartdns fails. Good luck rooting your Chromecast and chattr +i it's /etc/resolv.conf

How does a device "attempt to ignore" DNS servers supplied by DHCP? Like all devices connected to a network it must either use DHCP to get your DNS server or use a hardcoded value, it's not some kind of conspiracy.

"Attempt to ignore" Great question. So it uses hardcoded values of 8.8.8.8/8.8.4.4, unless it can't contact them by testing to resolve connectivity-test.google.com (or something like that), if it can't then it falls back to the DNS servers provided by your DHCP server/router. So to use smartdns with chromecast you have to both set your router to provide the SmartDNS servers and also blackhole 8.8.8.8/8.8.4.4 on your shitty ISP router (iirc static routes) - conspiracy? - i'll leave that to you? (the smartdns route is necessary since chromecast don't have their own VPN facility)

> You know what would be an actual story though? If Google used Google DNS to spy on people.

this. I highly doubt Google is actually using DNS for tracking or connecting queries to someone's account, especially when they say they don't [1].

Many people say "use Cloudflare DNS if you're worried about privacy", but Google effectively makes the same claim as Cloudflare that they don't use DNS to track you. The only plus you get from Cloudflare is how they get KPMG to audit and ensure they're not logging IPs forever.

1: https://developers.google.com/speed/public-dns/privacy

CloudFlare makes their money differently than Google though. Google wants figure out how to most efficiently put other people’s ads in front of me, and to sell my attention for the most value. Even if they have absolutely no ulterior motives (evil or otherwise), Google’s business is one such that they have every motive to abuse my privacy for their own gain.

CloudFlare doesn’t make their money off of brokering my attention, they have a decent track record of doing the ‘right’ things (or at least not the ‘wrong’ things), and they’ve made some decently pro-privacy statements in the past.

It seems that everyone wants to collect data on everything and figure out how to sell it off, so I’m not putting it out of the realm of possibility that CloudFlare could do shady stuff and abuse my privacy as well- but their general line of business doesn’t require it the way Google’s does.

All things otherwise equal, I’m gonna trust the company who’s business isn’t selling my profile a bit more for most things. I used to use Google DNS a lot, now I use CloudFlare’s. I trust them both more than Comcast, AT&T, and Verizon with respect to technical competency and security at the very least.

Why do you think CloudFlare has less incentive to sell your data than Google?

Both CloudFlare and Google are for-profit corporations which want to take actions to maximize their profits. Insomuch as they are profit maximizing, we should expect them to take actions where the expected gain is greater than the expected cost, and to prioritize actions which have the maximum gain over actions which are only barely profitable.

If the cost -- in terms of extra labor and reputation if the data-selling becomes public -- is estimated to be less than people are willing to pay for the data, why would any profit-seeking corporation choose not to sell your data?

We can't trust companies not to sell poisoned food, even though that's a huge reputational hit. We can't trust companies manufacturing herbal, vitamin or nutritional supplements to actually put the herb, vitamin or nutritional factor they claim they are in the bottles they sell. We can't trust the makers of USB cables to produce cables that actually meet the USB specifications. Why should we believe that any corporation, regardless of whether or not you pay them for their goods and services, would leave the money to be made selling your data on the table, even if there's a potential reputational hit if the practice becomes public?

Google's stock-in-trade is personal data. They use it to sell, and they use it to gather more data and to make data about that data. It's kind of scary.

But Cloudflare's business model is different: they get rich by making the internet faster. Plus, it's great publicity for them. Their customer acquisition focuses largely on winning developers (by letting them use a great, barely cut-down-at-all service for free) so they use it in companies later. This helps with that a lot.

You have to trust any place you send your traffic, but I trust Cloudflare more than Google simply because of their business model. People get too caught up in "evil!" but it's simply about business models and how likely a business is to bend towards unethical behavior to stay in business, or continue to grow revenue/profits.

Cloudflare doesn't need to analyze my data to make money -- they offer a great service that people will throw money at them to use.

> I highly doubt Google is actually using DNS for tracking or connecting queries to someone's account, especially when they say they don't [1].

But pi-hole (or other privacy dns appliances/services) also block tracking targets. By enabling/enforcing the "free and unaltered internet experience" Google also ensures access to tracking.

> I highly doubt Google is actually using DNS for tracking or connecting queries to someone's account, especially when they say they don't

Why do you doubt it? This behavior would be consistent with Google's behavior generally.

This is unduly paternalistic: a story is whatever the HN community decides to pay attention to, even if that leaves out important stories or puts a spotlight on minor trivia.

> You know what would be an actual story though? If Google used Google DNS to spy on people. If anyone has concrete evidence that they're doing that, that is a big fucking deal.

I'm an optimist, but I'm also cynical enough to foresee the same complaints — it's not a story! everyone does it — if that came to pass.

Prevention is important because in real life you can almost never recoup the losses as easily. You can take it to the courts etc. but if your data leaks, it's out there, you can't undo it.

> This is unduly paternalistic

You're right, I'm sorry. I edited my post a bit to soften it.

> I'm an optimist, but I'm also cynical enough to foresee the same complaints

Well, maybe. I would hope not, specifically because Google has made previous guarantees that they do not use that data for spying.

It's different when it's your ISP, which already does tons of shady shit and buried somewhere in your TOS that they do this stuff.

I don't find it any more acceptable, but it would or at least should be a bigger story if Google was doing it with Google DNS.

You do realize your ISP can spy on any DNS records passing its routers with deep packet inspection right? Only DNS(HTTPS/TLS) can fix that.

"I'm always shocked at how easy it is for people to fall into the "Google is evil!!1" trap on such trivial stuff"

Google's smart though. They know that rolling out unsavory ideas in small pieces keeps it under the radar.

They didn't, for example, push the organic search results under the fold all at once.

This could be innocuous, or part of some larger agenda.

This is usually called salami slicing: https://en.wikipedia.org/wiki/Salami_slicing See also the boiling frog fable: https://en.wikipedia.org/wiki/Boiling_frog

Or privacy zuckering

That's like my favorite comedy, but few people know their history well enough to laugh at the jokes anymore :(

I don't really see the point of changing the DNS settings to watch YouTube, either way Google will know what you're watching. I know the Chromecast can do other casting but I assume those services (Netflix, Hulu, etc) are using more than just DNS queries as well to see what you watch. And if you're casting local media then no DNS goes out at all.

Could be some other motivation, like making it not work in typical corporate environments, where arbitrary external DNS access isn't a given. Perhaps to upsell some other, more expensive device.

(Maybe not this, just an example to note that motivation can be hard to discern)

Irrespective of motivations/agenda, we can look at the current state of the consumer-facing Internet (the trend continues): https://news.ycombinator.com/item?id=16421072

> If Google used Google DNS to spy on people

Are you seriously thinking they don't store/analyse/use that kind of information??? (That's every site you visit, at minimum.)

Yes.

They don't. They guarantee they don't.

The spooky answer is they don't need it.

They don't retain IP addresses beyond 48 hours but they may retain other information (permanently). For example, the domain requested, your ISP and your approximate location (city or region).

https://developers.google.com/speed/public-dns/privacy

So, while it can't be traced back to you, it is absolutely useful information for their business. Why do you think they offer the service? To be nice?

This guarantee is one TOS change away from vanishing...

Then they'd need to announce that to all of the users of their DNS service.

You tell me how to do that.

They'd do it the same way every web service since the beginning of the internet has done it.

"By using service X you are agreeing to be bound by the terms located at .... "

Changing privacy policies doesn't work that way. You have to inform users of the changes, or they can claim that they didn't know and aren't bound by it.

That's why whenever companies change their ToS you get email/notifications/actual mail informing you of the changes.

You can't do that for DNS.

> Changing privacy policies doesn't work that way.

Legally speaking, yes it does. It's a free service. The only obligation they have is to make their terms freely accessible, and to publicize any major changes.

You seem to be implying that Google and other free DNS providers have never changed their privacy policies since there's no good way to notify the users. Google's own website (and the Internet Archive) totally contradict this.

https://developers.google.com/speed/public-dns/privacy

"Last updated October 29, 2018."

> They guarantee they don't.

They claim that they don't. You have no way of knowing if they're lying or not, though, so it boils down to "do you trust Google?"

You do, and that's fair. I don't, and that's also fair.

I would actually find it much more annoying from a troubleshooting perspective if every single IOT device I buy has a different hard-coded DNS server, provided by that manufacturer, instead of the one set by my local DHCP server. Because when the DNS set by your network fails, everything fails almost instantly and it's fairly easy to spot the problem from any device on your network.

RE: configurability ... I thought one of the main reasons people went with Google over Apple, specifically with Android, was precisely because of their configurability. Every person I talk to that left iOS tells me this.

Android is the exception IMO. Google's product are notoriously unconfigurable. For example, Chrome got a lot of flak over this especially in its early days.

Android also seems to be going the way of iOS on many fronts, because as it turns out, this philosophy makes things hard to maintain.

Note that the original email complaint linked to was written by Paul Vixie, one of the major DNS creators/contributors.

>You know what would be an actual story though? If Google used Google DNS to spy on people. If anyone has concrete evidence that they're doing that, that is a big fucking deal.

In general data that exists can be supoenaed, and if the logs don't exist a court order can make them begin to exist.

Hardcoded DNS servers are common

Common != Right.

I have a said expensive router, a Nighthawk, that will only advertise itself as the DNS and proxy requests. Unfortunately it's really bad at that and I was getting lots of lookup failures. Now I hardcode most of my devices to 8.8.8.8 .

I can totally see how they and other IoT vendors would want to do that. What boggles my mind is that so many people believe the feature implemented was "Use 8.8.8.8 and break otherwise so we can trojan our DNS into places" instead of "Hardcode 8.8.8.8 so it works in most cases".

Personally, I think they kind of _are_. I now no longer point to or use Google's DNS because of this. Call me paranoid.

For what it's worth I don't think that's paranoid at all. You don't want to deal with Google, so you don't introduce them to your network, that's reasonable.

What is paranoid IMO is some commenters' (as well as seemingly Paul Vixie's) implication that Google does this trick with the Chromecast to better spy on people, which completely goes against Occam's Razor.

I mean, spying on people is the foundation of their entire ad market. They have means and motive, the only question is whether they've followed through.

> If Google used Google DNS to spy on people

It's not "spying". Google DNS just "monetizes data sent through Google servers". Like they do with Chrome Data Saver, or Amp, or Calendar, or Contacts, or Voice, or GKeyboard, or Photos, or Maps, or Gmail, or Search, or...

> You know what would be an actual story though? If Google used Google DNS to spy on people.

What constitutes "spying" to you? Do you honestly believe Google isn't mapping your IP address to your account and monitoring your DNS requests to influence the ads they serve to you?

https://developers.google.com/speed/public-dns/privacy

> We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services.

Fair enough.

That page is full of doublespeak. They claim they "don't keep personally identifiable information or IP information" in the permanent logs, but then go on to explain how they log everything else that you would need to track someone. In addition to saving everything about the DNS query itself (domain, record type, etc)j, they also admit to logging (quoting from the above URL):

* Client's AS (autonomous system or ISP), e.g. AS15169

* User's geolocation information: i.e. geocode, region ID, city ID, and metro code

* Absolute arrival time in seconds

While Google's AS that the use as an example is huge[1], sometimes the AS is very revealing[2] and only map to a few addresses[3]. Combined with the geo-data, if you're on a smaller AS, Google has better tracking data than the IP address that is easy to correlate back to unique users[4].

As for their claim that "We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services."

There is a lot of carefully chosen language in that claim. You didn't "provide" them with the AS number or geo-data; they looked that stuff up based on your IP address. How are they defining "personal information", and exactly what counts as "provided Google for other services."? These are totally undefined terms and companies have a tendency to evolve their definitions of important-but-not-strictly-defined terminology as the Overton window shifts and bad behavior becomes sufficiently normalized that they can use the "everybody is doing it" excuse.

But looking at it in terms of what they currently say misses the larger problem: unless they have shown that their ability to amend this policy is restrict by a Ulysses Contract[5][6], they can change their policy at any time. They can also have the policy changed by an external power, against their will (e.g. a court could order them to start logging (w/ a timestamp) who communicated with them[7], even if they didn't want to.

[1] "IPs Originated (v4): 8,717,056" https://bgp.he.net/AS15169

[2] Google is admitting to logging which entry on this list each DNS requests originated from (warning, big page, only has US data): https://www.whatismyip.com/asn/US/

[3] "IPs Originated (v4): 256" https://bgp.he.net/AS54007

[4] https://news.ycombinator.com/item?id=17170468

[5] https://en.wikipedia.org/wiki/Ulysses_pact

[6] https://www.youtube.com/watch?v=zlN6wjeCJYk

[7] https://en.wikipedia.org/wiki/Pen_register (or a NSL, etc)

I always assumed the whole point of 8.8.8.8 is to spy on me. Why would they do it otherwise?

> Hardcoded DNS servers are common.

Indeed. And they're terrible. Maybe making a stink about a big player like Google doing this might encourage others to rethink the practice.

Probably not, of course, but the alternative of just shutting up and taking it isn't any better.

Other IOT manufacturers who hardcode the DNS into devices do not own the DNS servers, do they ?

That would be worse, not better. E.g., IoT devices hardcoding NTP servers they don't pay for:

https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#No...

I agree with you on the "G is evil" and so on, I've used Google WiFi and used Cloudflare DNS(as a test) with no problem...(the serious discussion would be why people blindly trust Cloudflare over x or y or z, out of scope now :D)

"Broken" ISP are likely to intercept DNS requests, so really the only option against them is something like DNS over HTTPS.

[citation needed] on that "likely" word. I've seen instances of that, but they're extremely rare because intercepting DNS altogether is a fucked up thing to do for an ISP.

Seen far, far more instances of:

- ISPs shipping shitty network devices / awful factory settings

- ISP's own DNS servers being terrible in various ways

- Uncle Steve "the IT guy of the family" having messed with the network settings and nobody knows why 1 youtube video in 20 doesn't load but we just ignore it.

Centurylink hijacks 100% of real NXDOMAINs to their DNS servers and replaces them with a redirect to their internal portal. They "have" a configuration knob to disable the behavior, but it doesn't work or isn't reliably persisted; it never sticks. Big residential ISP.

TimeWarner and Comcast have both done it toe. TWC did of to let me know of a TOS violation and Comcast uses it as part of their setup. If you don't allow them to hijack DNS and show you things that you have to click through, you may find yourself unable to route traffic at all until you call them. I've dealt with this with every move in CA (about a half dozen times) and my move to TX. Seems pretty likely to me.

the amount of broken, intercepting and censoring DNS out there does not make Google a community service, though.

> this is a $30 device to hook up TVs,

Nitpick, but more like $70; you may be confusing Chromecast Ultra with the base Chromecast.

Yes, you're correct. The Chromecast Ultra isn't sold here in Europe so I didn't make the connection.

Chromecast Ultra is sold in the UK, which is Europe (even if we do end up leaving the EU).

OP said:

> The Chromecast Ultra isn't sold here

And the OP was wrong; Chromecast Ultra is being sold here in Europe.

What? How do you know where OP lives or what is sold there? "Here" and "here" refer to different places depending on who is speaking.

“here in Europe” is not the same as “here” by itself, because the “in Europe” part specifies exactly what “here” means.

IIRC Meraki used to ping 8.8.8.8 as a connectivity check...

The author of that email, Paul Vixie, is not some random person saying, "Google is evil!!!" He is eminently qualified to speak about DNS, since he designed it.

And did I suggest he wasn't qualified to speak about DNS?

Reply on news.ycombinator.com