Hacker News Reader

Comment by zaarn | Hacker News Reader

This discussion is the worst to have to repeat every time.

This fallback will only be used when:

* You have no DNS and NTP servers assigned via DHCP (your router does by default in 99.99% of cases) * You have no DNS configured in /etc/resolve.conf * Your distro does not change the defaults to nothing or something else (almost every distro does) * You still have internet connectivity (somehow)

In most cases, these conditions would simply not be met because everyone has DNS configured somehow. This isn't a fallback for when your DNS is unreachable, it's for when no DNS has been configured at all anywhere (including by distro upstream) but you still want to use the internet.

So in that rare circumstance, where your distro didn't change upstream defaults and you don't have any DNS configuration, it will fall back to Google DNS.

View on HN

The likelihood of this scenario is mind-bogglingly small. You need to have a valid IP configuration for the network you are on, including a default gateway that will route you to the internet, yet somehow do not have any DNS servers configured at all?

Why even bother covering this case? It seems most likely to come up when this situation is created intentionally, in which case you don't want to go and ruin it by trying to be clever.

It's used for testing. (At least that was the rationale given for the NTP default setting, I guess the same applies for DNS too.)

It's sort of a sane/understandable default, considering all the context.

Though maybe they could switch to CloudFlare.

Cloudflare has a dns privacy policy that is exactly like Google’s but without as many robust internal controls to enforce it. There are reasons to prefer it but a rational risk model isn’t one.

Can you elaborate on these extra internal controls?

Google is pretty vocal about how only reviewed, submitted, and hermetically built code can run in production, how they audit such things, how their hardware security module helps them achieve this, etc. Cloudflare has been pretty vocal about the opposite: how they use tons of off-the-shelf software components, vendor firmware, etc. There's no reason to believe that Cloudflare is as able to provide the privacy they promise as Google is.

Caveat that I am a DNS layman, but I disagree that Google's logging described in https://developers.google.com/speed/public-dns/privacy is equivalent to Cloudflare's described in https://developers.cloudflare.com/1.1.1.1/privacy/public-dns...

Google keeps Permanent Logs and doesn't make it easy for me to see whether that information can be shared and to whom.

Cloudflare only stores Public Resolver Logs, deletes them after 25 hours, and acknowledges it shares an anonymized subset of the data only with APNIC Labs.

Your comments about build pipeline and firmware are interesting, and to me fall into two rough camps:

* preventing bugs from leaking private info: to be honest, I trust neither on this, and I'm more worried about Google being sneaky in its ToS than Cloudflare being sloppy in their dev process.

* preventing infiltration from state actors and hackers -- this is a non-goal for me.

So for my goal of limiting the power of surveillance capitalism on my life, Cloudflare appears to be a clear winner.

I agree, I would find it extremely unintuitive. I'm only scanning the issue at a high level like most others, so it really depends on how systemd presents this information. If it sort of happens in the background with the systemd resolver and shows no DNS servers but queries magically work I would be extremely confused, especially since no upstream resolution is a scenario we see in particular networks with our products.

On the other hand, if it does present the servers and it's still configurable, might be a bit of a different story.

The fallback is just stupid. Make it a hard fail in that case, as you pointed out it is a very uncommon scenario. If you really, really want to have fallback, why not have list of root DNS servers and have the resolver do recursive query. I set up my network that way (don't use google, cloudflare, my ISP or anything else) and used it for years without problem.

But I think hard failure is best approach in this case, because this behavior will also make it harder to troubleshoot issues, let say you are setting up a network and misconfigured your router that doesn't provide DNS now you will be puzzled why Internet works on some machines while it doesn't work on others.

It’s not “stupid”, it’s reasoned out based on premises that you disagree with. The rest of your argument is weakened by that opening, even if it’s a point worth considering.

The fundamental flaw in your argument is that systemd-resolved is not a resolving proxy DNS server. Many other proxy DNS server softwares indeed are switchable between resolving and forwarding modes, some even doing both at once, but systemd-resolved only provides forwarding proxy DNS service. There is no resolving mode to default to.

Which is in fact the core of the problem. It's actually a fairly rare kind of proxy DNS server software, one for which there isn't really a sensible universal default for the unconfigured case.

The discussion seems to be a logical circle. If the default fallback is such rare circumstance that it doesn't matter, then the best options seems to leave it blank as suggest last in the ticket. Let it fail hard and if any users has a complaint they can direct that towards downstream which should have set a sensible fallback. If the default fallback actually do matter then it seems reasonable to have a discussion about what it should be.

I agree.

In my experience with systemd-resolvd, things happen that make it _believe_ there is no DNS configured, and you end up with something incomprehensible (a "hidden default" or some such).

Please let it just fail so that one at least has a chance of understanding what's happening rather than some magic.

Typical systemd rationalization, imho: "should anything be perceived as wrong, perform hidden magic."

> /etc/resolve.conf

It’s /etc/resolv.conf, and systemd overwrites it, Network Manager overwrites it (like every 10 minutes), dhcp overwrites it, etc. What do they overwrite it to? Most just get it from the router even if the router has no assigned servers. These days manually managing /etc/resolv.conf by hand requires hooking into every service that overwrites it on most systemd distributions. So really the people this change would affect are those with misconfigured routers.

My issue is why they didn’t go with a more private DNS such as Open DNS or even Cloudfare DNS. Google’s privacy policy is worse than either of the two. It seems the questioner asked in bad faith but I would’ve hoped Poettering would respond to the validity and dismiss the malintent instead of dismissing the whole issue.

I do:

  chattr +i /etc/resolv.conf

on my own servers to stop things from fiddling around with it.

It seems kinda brutal to just stop writing, but I guess there's a bit of a dogpile for writes on this file, does dhcpconf let you specify DNS servers kind of a 'layer up' from resolvconf?

I usually just add it to either netplan or cloudconfig, whichever is active.

Both of them have yaml syntax though, which is imo extremely unfortunate for this kind of configuration.

    It’s /etc/resolv.conf, and systemd overwrites it, 
    Network Manager overwrites it (like every 10 minutes),
    dhcp overwrites it, etc. What do they overwrite it to?

I still haven't understood where is the definitive place to set dns nowadays.

/etc/resolv.conf is routinely touched by stuff like NetworkManager and other stuff. Systemd-resolved config seems like the correct place, but I'm not sure how that plays with network-manager.

Universal practice is editing the resolv.conf file and then write-protecting it with.

  chattr +i /etc/resolv.conf

This always works, but certain applications NetworkManager have their own preferred way of doing things that I quite frankly do not care to learn.

I think it get's a bit harder than this, with newer systemd supporting name resolution over dbus. It's conceivable that some programs may move away from libc resolvers using resolv.conf and start querying the service directly over dbus.

I'm not sure I'm personally a fan, just saying it's something that might become more common based on my read of the systemd docs awhile back.

Ah, I didn't want to get into the stupidity and sysadmin nightmare of systemd-resolved, but rest-assured even with systemd-resolved active most users can simply manage their /etc/resolv.conf file and systemd-resolved should respect it. It gets trickier when you don't have a network manager program or are use dhcp, VPNs, etc.

> with newer systemd supporting name resolution over dbus.

Not only that, with suitably configured nsswitch.conf, (e.g. with nss-resolve), you might find out that your /etc/resolv.conf is used only by apps that have their own resolver and ignore the glibc one.

That's because distro releases just love to keep changing where network configuration goes.

NetworkManager? No it's in sysconfig/interfaces. No that was last release. Now it's in a netplan YAML file you get to learn all about.

So many terrific "improvements" every release!

> I still haven't understood where is the definitive place to set dns nowadays.

If you are using NetworkManager, then in NetworkManager, per each connection. You can also configure which zones each of them can resolve, if they are not global.

So you can things like using your prefered global DNS and then have per-VPN DNS that can resolve hosts in whatever network you VPN into.

> I still haven't understood where is the definitive place to set dns nowadays.

There isn't. There are half a dozen packages on a Linux install that each will reset the DNS settings as they wish.

Setting your network DHCP with the correct values tends to work, because everything queries it. But I still didn't manage to replace the upstream DNS on the DHCP server.

There is no definitive place, because there are several ways in which people set up DNS service:

1. local resolving/forwarding proxy DNS server on loopback

2. resolving/forwarding proxy DNS server on another machine on the LAN with a known IP address

3. resolving/forwarding proxy DNS server on another machine on the LAN but only the LAN's DHCP server definitively knows what its IP address is

4. resolving/forwarding proxy DNS server out on the WAN with a known IP address

5. resolving/forwarding proxy DNS server out on the WAN but only the LAN's DHCP server definitively knows what its IP address is

There's scope for variation within each of these categories, moreover.

Part of the confusion is that most DHCP clients assume that you are doing #3 or #5, and continually switch over to them, until you turn that off by ignoring/superseding the relevant DHCP options. Traditionally in the Unix world one actually generally did #1, with a local BIND being as much a thing as a local Sendmail. Some DHCP clients can do a forwarding variant of #1, but only interoperate (easily) with a few forwarding proxy DNS server softwares. That nowadays #1 might be done with dnscache, or dnsmasq, or PowerDNS, or MaraDNS, or unbound, or something else, introduces configuration file variance but doesn't change the fundamental nature of #1.

systemd-resolved is mainly #1 too, but can operate in a mode where it is #3 or #5, in which case you have it and the DHCP clients doing overlapping work. One of the things that, in fairness, one can actually praise about systemd-resolved is that whilst conventional DHCP clients actually end up rewriting /etc/resolv.conf itself (via resolvconf and similar mechanisms) systemd-resolved instead rewrites two files of its own, and lets you rather choose to symbolically link /etc/resolv.conf to (one of) them. If the conventional DHCP clients also did this more, there'd be less of the conflict between #1/#2/#4 and #3/#5.

Are you sure systemd overwrites it? I believe it maintains its own /run/systemd/resolve/{resolv,stub-resolv}.conf file, and it's up to you whether you want to symlink /etc/resolv.conf to one of these or not.

I've run into this situation at home when setting up some new networking equipment with much more configurability than I'm used to. My system had no DNS, alerting me to the issue, and I fixed it. I don't need nor want my systems to decide for me to use Google's DNS, or any other DNS.

As you mention, this _is_ a rare circumstance, and likely self-induced by some sort of "power user". I assume there are few of those power users who want the choice made for them.

This makes it worse. For all those conditions to be met, it would have to be a conscious choice on the part of the user/administrator. And then systemd decides it knows better and resolves using 8.8.8.8 anyways?

You can configure an invalid DNS server or set the DNSConfig in systemd-resolved. The DNS server option being set at all causes the fallback to not be used, regardless if it's empty or not.

Maybe people would have fewer controversy with quad 9?

Would be 9.9.9.9 instead of 8.8.8.8. If this would be better is probably a matter of preference. Google owns many, many servers, so maybe using the underdog eases the mind of some people.

so... why google and not a privacy-concerning alternative?

Because the privacy concerning aspects are literally irrelevant.

These are set for testing/development purposes. For which the priorities are availability/reliability/speed. For those criteria, Google/Cloudflare are empirically the best worldwide.

This literally is used for test-resolving that at best probably would identify a systemd-dev. Everyone else shouldn't care because it's overwritten by distro maintainers.

Could you give more details about these tests and why the tests can't be modified to set DNS/NTP?

Likely unit tests... https://github.com/systemd/systemd/tree/master/test/test-res...

I assume some of these use it.

>why the tests can't be modified to set DNS/NTP?

I am not a systemd maintainer, they probably could be adjusted, but frankly I don't imagine they or I care enough to do so.

Like I said, this change only affects the devs, so why should it matter to anyone else.

Google offers better documentation than most, and the privacy aspects are good. [1] Of course you have to trust them but that would be true for any company. Given that the natural default would be even less trustworthy ISP, is not that bad.

https://developers.google.com/speed/public-dns/faq

i set up a bind nameserver for my internal network, and mistakenly i did not set upstream resolvers.

It's working anyway, i think it's resolving off the root nameservers...

I guess... You couldn't go more private than that.

Reply on news.ycombinator.com