4 ms·

I agree with the shadiness of this, but just to play devil's advocate here, is this to work around shitty ISP's that play games with DNS? Residential ISPs have

I agree with the shadiness of this, but just to play devil's advocate here, is this to work around shitty ISP's that play games with DNS? Residential ISPs have not exactly been good faith actors in this game ...

megous 8y ago
Yes, but how does it help hardcoding one IP address that ISPs can simply route to their own DNS server?
- tialaramex 8y ago
  Today the ISP could, with a bunch of effort, re-route the traffic, though I haven't seen any evidence that any of them do that. So it helps materially because for today it works. Tomorrow these devices will do DPRIV, probably DNS over HTTPS, and so the ISP won't be different from any other man-in-the-middle, unable to meddle with the contents of protected traffic.
  - oarsinsync 8y ago
    > Today the ISP could, with a bunch of effort, re-route the traffic Injecting a route into your IGP is pretty trivial, any ISP with an engineer with more than 6 month's experience could manage this. > though I haven't seen any evidence that any of them do that Unless you've actually looked, and performed pcap analysis of what your dns request/response looks like to try and determine if your ISP is intercepting, you can't be sure. That said, several ISPs used to do this quite transparently (pun not intended) in the early 2000s, to return advertising pages whenever a DNS query failed. Some of them would do this on their own DNS servers (that were the default pushed to your CPE, which was then the default for your network), some of them would actually hijack anything going to udp/53. This used to be prevalent for a while. Then again, who's making more money monetising your activity? Your ISP or Google? Given that your ISP can already see every IP you visit and how much traffic you exchange with that counterparty, who would you rather protect your DNS requests from? Them or Google?
    - JohnFen 8y ago
      > several ISPs used to do this quite transparently (pun not intended) in the early 2000s, to return advertising pages whenever a DNS query failed. Yep. This was what spurred me to start running and using my own DNS server in the first place. > who would you rather protect your DNS requests from? Them or Google? I don't think one of them is better than the other on that count.
    - rincebrain 8y ago
      Verizon still does this to this day, in fact.
  - cma 8y ago
    They could keep routing it and modify it's results. Comcast already does this with http, injecting datacap warnings into HTML pages.
  - stordoff 8y ago
    It's quite common in the UK: https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kingdom#By_feed_type https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kin... My ISP does the blocking slightly - the DNS response is fine, but they inject a redirect into the HTTP response.
  - andreareina 8y ago
    I've experienced ISPs trying to block sites by intercepting the DNS request and returning their own servers. DNS over HTTP solves that for now, but I'm concerned that they'll just switch to blocking by IP or SNI.
Tsubasachan 8y ago
I actually trust my ISP more than Google.
- josteink 8y ago
  No need for downvotes. Outside the US, most people do. Anything else would be weird.
  - int_19h 8y ago
    I'm in US, and I still trust my ISP more that Google. Which is to say, I trust them both to try to screw me, but the ISP has already done so to the extent that they were able. But Google is just warming up, and they're more competent.

megous 8y ago

Yes, but how does it help hardcoding one IP address that ISPs can simply route to their own DNS server?

tialaramex 8y ago
Today the ISP could, with a bunch of effort, re-route the traffic, though I haven't seen any evidence that any of them do that. So it helps materially because for today it works. Tomorrow these devices will do DPRIV, probably DNS over HTTPS, and so the ISP won't be different from any other man-in-the-middle, unable to meddle with the contents of protected traffic.
- oarsinsync 8y ago
  > Today the ISP could, with a bunch of effort, re-route the traffic Injecting a route into your IGP is pretty trivial, any ISP with an engineer with more than 6 month's experience could manage this. > though I haven't seen any evidence that any of them do that Unless you've actually looked, and performed pcap analysis of what your dns request/response looks like to try and determine if your ISP is intercepting, you can't be sure. That said, several ISPs used to do this quite transparently (pun not intended) in the early 2000s, to return advertising pages whenever a DNS query failed. Some of them would do this on their own DNS servers (that were the default pushed to your CPE, which was then the default for your network), some of them would actually hijack anything going to udp/53. This used to be prevalent for a while. Then again, who's making more money monetising your activity? Your ISP or Google? Given that your ISP can already see every IP you visit and how much traffic you exchange with that counterparty, who would you rather protect your DNS requests from? Them or Google?
  - JohnFen 8y ago
    > several ISPs used to do this quite transparently (pun not intended) in the early 2000s, to return advertising pages whenever a DNS query failed. Yep. This was what spurred me to start running and using my own DNS server in the first place. > who would you rather protect your DNS requests from? Them or Google? I don't think one of them is better than the other on that count.
  - rincebrain 8y ago
    Verizon still does this to this day, in fact.
- cma 8y ago
  They could keep routing it and modify it's results. Comcast already does this with http, injecting datacap warnings into HTML pages.
- stordoff 8y ago
  It's quite common in the UK: https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kingdom#By_feed_type https://en.wikipedia.org/wiki/Web_blocking_in_the_United_Kin... My ISP does the blocking slightly - the DNS response is fine, but they inject a redirect into the HTTP response.
- andreareina 8y ago
  I've experienced ISPs trying to block sites by intercepting the DNS request and returning their own servers. DNS over HTTP solves that for now, but I'm concerned that they'll just switch to blocking by IP or SNI.

Tsubasachan 8y ago

I actually trust my ISP more than Google.

josteink 8y ago
No need for downvotes. Outside the US, most people do. Anything else would be weird.
- int_19h 8y ago
  I'm in US, and I still trust my ISP more that Google. Which is to say, I trust them both to try to screw me, but the ISP has already done so to the extent that they were able. But Google is just warming up, and they're more competent.