7 ms·

Google DNS came about because of a very real problem of shitty ISPs giving shitty DNS servers that gave fake results (especially in NXDomain cases) I can see w

Google DNS came about because of a very real problem of shitty ISPs giving shitty DNS servers that gave fake results (especially in NXDomain cases) I can see why you would want to use a known-good dns provider in your product, however at the very least there should be an ability to turn off such behaviour.

vetinari 8y ago
It is not shitty ISPs giving fake results. It is me. My resolver does that and it is for a reason. Disrespecting what the local network tells you to use just leads to arms race.
- thecatspaw 8y ago
  Google doesnt care about a piHole or similar, its such a tiny tiny part of their customers its not worth fighting it at this point
  - vetinari 8y ago
    Still, Google is tightening the screws: moving DNS resolver into the browser, instead of using the system one; moving DNS over to https+ESNI to hide among other traffic; forcing their own DNS servers instead of user configured. That's all together means, that they do not trust not only the ISPs, but neither the user, and that they want to have a unobstructed communication channel out of their software to the mothership, privacy and control by the users be damned. So the pihole community is tiny, but that may be the reason, why Google thinks that they are worth the sacrifice: after all, there is just a few of them.
    - heavenlyblue 8y ago
      Nah. I use 8.8.8.8 at home simply because it was a long time since providers in the UK didn’t try to intercept the failed DNS queries. On top of that, Virgin Media resolver managed to go offline particularly regularly. So here we are: what user sees is that a particular device doesn’t work, while others do. So they obviously blame the ones adhering to standards.
- fixermark 8y ago
  That's the issue though---there was already an arms race (between users and ISPs), and it was making it hard to create reliable consumer electronics devices because DNS logic is complicated and the complexity adds cost (and more importantly, pushes configuration burden from the device onto the user). It sucks that customization was damaged in the arms race, but that's the nature of measure-countermeasure in web technologies across the board. Every web technology is a three-edged sword: the spec, the intention behind the spec, and the real-world implementation of the spec. DNS / DHCP implementation drifted from intention years ago.
  - vetinari 8y ago
    Behavior like this will make it even worse for developers; that's what arms races do.
- yardstick 8y ago
  To be fair once DNS over TLS/HTTP become mainstream, local DNS servers won’t work without valid certificates, which I’m guessing will be a pain even with letsencrypt and co.
  - vetinari 8y ago
    If you have a machine joined into a domain (Active Directory, FreeIPA, others), it already has a custom CA certificate installed into its store. So this domain CA will just sign the certificate for the local DNS server, like it does for other local TLS services. If you don't, just make up a local CA and install the cert on your machines or devices. No need to drag letsencrypt and co into the game, that's only for publicly facing machines.
    - yardstick 8y ago
      What about PiHoles as well as consumer devices like Chromecast? Once CC uses DNS over TLS etc it’s game over for local consumer DNS servers. No way to configure a custom CA within CC. (I’m a fan of local DNS for many reasons and so I think DoT is two steps forward for privacy and 3 steps backward for everything else)
      - vetinari 8y ago
        DNS over TLS is easy to block (it is separate port), that's why browsers are pushing for DNS over HTTPS, so you cannot make them fall back on local DNS so easily. With DoH, it will be more difficult, but still possible - you will have to run your own proxy. I imagine, that folks that came up pihole, will package something similar that includes proxy. On such networks, devices that won't allow to enroll custom certificates won't get onto Internet. It is then up to the user, what he or she prefers, privacy and control or that specific product. I actually like DoT a DoH as protocols, from the privacy point of view. However, I don't like their implementations and the lockdown they are used for, where they try to establish the tunnel out of the local networks, taking control out of their owners.
    - pixl97 8y ago
- creeble 8y ago
  This is easy to say until you've found yourself supporting 10s of thousands of devices across the world and are the guy support calls when people complain about (what turns out to be) broken DNS servers at hundreds of ISPs. People who buy little internet devices usually don't respond well to "it's your ISP" when their day-to-day web browsing experience is just fine to them. If your resolver does that, you're going to be the 0.01% that complains, rather than the 2-5% that is crushing customer support. Not saying that makes it "right", just saying it fixes it.
  - vetinari 8y ago
    I know, that it looks just like a quick fix, and it gets things done. However, that quick fix does a damage. Why don't you use it just like a fallback. Why use it, when everything works right?
    - creeble 8y ago
      Because it often doesn't work right, and there's no way to tell. One of the most common complaints we get is that things "are slow to start" or that "I click and it's slow to respond". After long and expensive remote diagnosis, this turns out to be slow DNS, and 8.8.8.8 fixes it. Falling back to it wouldn't change the user experience.

vetinari 8y ago

It is not shitty ISPs giving fake results. It is me. My resolver does that and it is for a reason. Disrespecting what the local network tells you to use just leads to arms race.

thecatspaw 8y ago
Google doesnt care about a piHole or similar, its such a tiny tiny part of their customers its not worth fighting it at this point
- vetinari 8y ago
  Still, Google is tightening the screws: moving DNS resolver into the browser, instead of using the system one; moving DNS over to https+ESNI to hide among other traffic; forcing their own DNS servers instead of user configured. That's all together means, that they do not trust not only the ISPs, but neither the user, and that they want to have a unobstructed communication channel out of their software to the mothership, privacy and control by the users be damned. So the pihole community is tiny, but that may be the reason, why Google thinks that they are worth the sacrifice: after all, there is just a few of them.
  - heavenlyblue 8y ago
    Nah. I use 8.8.8.8 at home simply because it was a long time since providers in the UK didn’t try to intercept the failed DNS queries. On top of that, Virgin Media resolver managed to go offline particularly regularly. So here we are: what user sees is that a particular device doesn’t work, while others do. So they obviously blame the ones adhering to standards.
fixermark 8y ago
That's the issue though---there was already an arms race (between users and ISPs), and it was making it hard to create reliable consumer electronics devices because DNS logic is complicated and the complexity adds cost (and more importantly, pushes configuration burden from the device onto the user). It sucks that customization was damaged in the arms race, but that's the nature of measure-countermeasure in web technologies across the board. Every web technology is a three-edged sword: the spec, the intention behind the spec, and the real-world implementation of the spec. DNS / DHCP implementation drifted from intention years ago.
- vetinari 8y ago
  Behavior like this will make it even worse for developers; that's what arms races do.
yardstick 8y ago
To be fair once DNS over TLS/HTTP become mainstream, local DNS servers won’t work without valid certificates, which I’m guessing will be a pain even with letsencrypt and co.
- vetinari 8y ago
  If you have a machine joined into a domain (Active Directory, FreeIPA, others), it already has a custom CA certificate installed into its store. So this domain CA will just sign the certificate for the local DNS server, like it does for other local TLS services. If you don't, just make up a local CA and install the cert on your machines or devices. No need to drag letsencrypt and co into the game, that's only for publicly facing machines.
  - yardstick 8y ago
    What about PiHoles as well as consumer devices like Chromecast? Once CC uses DNS over TLS etc it’s game over for local consumer DNS servers. No way to configure a custom CA within CC. (I’m a fan of local DNS for many reasons and so I think DoT is two steps forward for privacy and 3 steps backward for everything else)
    - vetinari 8y ago
      DNS over TLS is easy to block (it is separate port), that's why browsers are pushing for DNS over HTTPS, so you cannot make them fall back on local DNS so easily. With DoH, it will be more difficult, but still possible - you will have to run your own proxy. I imagine, that folks that came up pihole, will package something similar that includes proxy. On such networks, devices that won't allow to enroll custom certificates won't get onto Internet. It is then up to the user, what he or she prefers, privacy and control or that specific product. I actually like DoT a DoH as protocols, from the privacy point of view. However, I don't like their implementations and the lockdown they are used for, where they try to establish the tunnel out of the local networks, taking control out of their owners.
  - pixl97 8y ago
creeble 8y ago
This is easy to say until you've found yourself supporting 10s of thousands of devices across the world and are the guy support calls when people complain about (what turns out to be) broken DNS servers at hundreds of ISPs. People who buy little internet devices usually don't respond well to "it's your ISP" when their day-to-day web browsing experience is just fine to them. If your resolver does that, you're going to be the 0.01% that complains, rather than the 2-5% that is crushing customer support. Not saying that makes it "right", just saying it fixes it.
- vetinari 8y ago
  I know, that it looks just like a quick fix, and it gets things done. However, that quick fix does a damage. Why don't you use it just like a fallback. Why use it, when everything works right?
  - creeble 8y ago
    Because it often doesn't work right, and there's no way to tell. One of the most common complaints we get is that things "are slow to start" or that "I click and it's slow to respond". After long and expensive remote diagnosis, this turns out to be slow DNS, and 8.8.8.8 fixes it. Falling back to it wouldn't change the user experience.