11 ms·

I'm always shocked at how easy it is for people to fall into the "Google is evil!!1" trap on such trivial stuff (and funnily enough, much more serious privacy i

I'm always shocked at how easy it is for people to fall into the "Google is evil!!1" trap on such trivial stuff (and funnily enough, much more serious privacy issues related to Google are ignored/downvoted). Hardcoded DNS servers are common. Extremely common in a bunch of IOT devices, given how broken some ISPs are. This is a non-story and the only reason it's being upvoted is because Google is doing it, and they also control the DNS server. You know what would be an actual story though? If Google used Google DNS to spy on people. If anyone has concrete evidence that they're doing that, that is a big fucking deal. Not some email about a google-complaint-of-the-week. Edit: To be clear I'd agree that in a high quality product there needs to be a way to change the DNS servers. Then again, this is a $30 device to hook up TVs, and I've seen $200 routers lacking that ability. ---- Edit 2, elaborating on the above: You make a cheap device that will likely end up in millions of homes and your #1 support issue is "It doesn't work [because my ISP is terrible therefore my network configuration is shit]!". What do you do? Do you tell your consumers to suck it up and talk to their ISP? Or do you… hardcode a DNS server that you at least know will work? "Issues" like this one are non-issues and distract from the myriad of very real privacy issues coming out of Google. Yes, this should be configurable at the very least… then again, Google products aren't exactly known for their wonderful configurability.

anilakar 8y ago
It's being upvoted because the issue was raised by none other than the father of DNS.
- scrollaway 8y ago
  Given the ratio of people who upvote stories based on their title without clicking through, I highly doubt that.
  - dang 8y ago
    We don't know what that ratio is, as we don't track it, and I'm skeptical that anyone does.
    - scrollaway 8y ago
      shrugs I wasn't referring specifically to HN, nor was I trying to suggest I know the exact ratio. What I know is it's extremely unlikely that this story is being upvoted because of that given that 1. A lot of people upvote on title alone (I'll die on that hill); 2. Not many people know who Paul Vixie is; 3. Those that do might not notice the name in the UI/email (I certainly didn't).
      - mburns 8y ago
        That’s something you believe. Die on whatever hill you choose. The top comment on HN explains who Paul Vickie is. I believe people tend to read comments before reading the article or voting.
        scrollaway 8y ago
        The current top comment was not written at the time I wrote mine, and was not top comment until less than an hour ago. If you want a spot on my hill, I have room to rent.
      - deleted 8y ago
        [deleted]
- creeble 8y ago
  Well... Paul Mockepetris may not agree with that. But he's also the kind of guy who wouldn't mind.
dictum 8y ago
This is unduly paternalistic: a story is whatever the HN community decides to pay attention to, even if that leaves out important stories or puts a spotlight on minor trivia. > You know what would be an actual story though? If Google used Google DNS to spy on people. If anyone has concrete evidence that they're doing that, that is a big fucking deal. I'm an optimist, but I'm also cynical enough to foresee the same complaints — it's not a story! everyone does it — if that came to pass. Prevention is important because in real life you can almost never recoup the losses as easily. You can take it to the courts etc. but if your data leaks, it's out there, you can't undo it.
- scrollaway 8y ago
  > This is unduly paternalistic You're right, I'm sorry. I edited my post a bit to soften it. > I'm an optimist, but I'm also cynical enough to foresee the same complaints Well, maybe. I would hope not, specifically because Google has made previous guarantees that they do not use that data for spying. It's different when it's your ISP, which already does tons of shady shit and buried somewhere in your TOS that they do this stuff. I don't find it any more acceptable, but it would or at least should be a bigger story if Google was doing it with Google DNS.
  - pixl97 8y ago
    You do realize your ISP can spy on any DNS records passing its routers with deep packet inspection right? Only DNS(HTTPS/TLS) can fix that.
tyingq 8y ago
"I'm always shocked at how easy it is for people to fall into the "Google is evil!!1" trap on such trivial stuff" Google's smart though. They know that rolling out unsavory ideas in small pieces keeps it under the radar. They didn't, for example, push the organic search results under the fold all at once. This could be innocuous, or part of some larger agenda.
- dictum 8y ago
  Irrespective of motivations/agenda, we can look at the current state of the consumer-facing Internet (the trend continues): https://news.ycombinator.com/item?id=16421072 https://news.ycombinator.com/item?id=16421072
- JorgeGT 8y ago
  This is usually called salami slicing: https://en.wikipedia.org/wiki/Salami_slicing https://en.wikipedia.org/wiki/Salami_slicing See also the boiling frog fable: https://en.wikipedia.org/wiki/Boiling_frog https://en.wikipedia.org/wiki/Boiling_frog
  - misterhtmlcss 8y ago
    That's like my favorite comedy, but few people know their history well enough to laugh at the jokes anymore :(
  - thecatspaw 8y ago
    Or privacy zuckering
- OedipusRex 8y ago
  I don't really see the point of changing the DNS settings to watch YouTube, either way Google will know what you're watching. I know the Chromecast can do other casting but I assume those services (Netflix, Hulu, etc) are using more than just DNS queries as well to see what you watch. And if you're casting local media then no DNS goes out at all.
  - 8y ago
sofaofthedamned 8y ago
IIRC Meraki used to ping 8.8.8.8 as a connectivity check...
baptou12 8y ago
Other IOT manufacturers who hardcode the DNS into devices do not own the DNS servers, do they ?
- loeg 8y ago
  That would be worse, not better. E.g., IoT devices hardcoding NTP servers they don't pay for: https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#Notable_cases https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#No...
kilroy123 8y ago
Personally, I think they kind of _are_. I now no longer point to or use Google's DNS because of this. Call me paranoid.
- scrollaway 8y ago
  For what it's worth I don't think that's paranoid at all. You don't want to deal with Google, so you don't introduce them to your network, that's reasonable. What is paranoid IMO is some commenters' (as well as seemingly Paul Vixie's) implication that Google does this trick with the Chromecast to better spy on people, which completely goes against Occam's Razor.
  - cwkoss 8y ago
    I mean, spying on people is the foundation of their entire ad market. They have means and motive, the only question is whether they've followed through.
judge2020 8y ago
> You know what would be an actual story though? If Google used Google DNS to spy on people. this. I highly doubt Google is actually using DNS for tracking or connecting queries to someone's account, especially when they say they don't [1]. Many people say "use Cloudflare DNS if you're worried about privacy", but Google effectively makes the same claim as Cloudflare that they don't use DNS to track you. The only plus you get from Cloudflare is how they get KPMG to audit and ensure they're not logging IPs forever. 1: https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy
- manyxcxi 8y ago
  CloudFlare makes their money differently than Google though. Google wants figure out how to most efficiently put other people’s ads in front of me, and to sell my attention for the most value. Even if they have absolutely no ulterior motives (evil or otherwise), Google’s business is one such that they have every motive to abuse my privacy for their own gain. CloudFlare doesn’t make their money off of brokering my attention, they have a decent track record of doing the ‘right’ things (or at least not the ‘wrong’ things), and they’ve made some decently pro-privacy statements in the past. It seems that everyone wants to collect data on everything and figure out how to sell it off, so I’m not putting it out of the realm of possibility that CloudFlare could do shady stuff and abuse my privacy as well- but their general line of business doesn’t require it the way Google’s does. All things otherwise equal, I’m gonna trust the company who’s business isn’t selling my profile a bit more for most things. I used to use Google DNS a lot, now I use CloudFlare’s. I trust them both more than Comcast, AT&T, and Verizon with respect to technical competency and security at the very least.
  - saalweachter 8y ago
    Why do you think CloudFlare has less incentive to sell your data than Google? Both CloudFlare and Google are for-profit corporations which want to take actions to maximize their profits. Insomuch as they are profit maximizing, we should expect them to take actions where the expected gain is greater than the expected cost, and to prioritize actions which have the maximum gain over actions which are only barely profitable. If the cost -- in terms of extra labor and reputation if the data-selling becomes public -- is estimated to be less than people are willing to pay for the data, why would any profit-seeking corporation choose not to sell your data? We can't trust companies not to sell poisoned food, even though that's a huge reputational hit. We can't trust companies manufacturing herbal, vitamin or nutritional supplements to actually put the herb, vitamin or nutritional factor they claim they are in the bottles they sell. We can't trust the makers of USB cables to produce cables that actually meet the USB specifications. Why should we believe that any corporation, regardless of whether or not you pay them for their goods and services, would leave the money to be made selling your data on the table, even if there's a potential reputational hit if the practice becomes public?
OnlyRepliesToBS 8y ago
lol
apostacy 8y ago
This isn't a case of an IOT device though. My Chromecast went through massive amount of trouble to use Google's DNS servers, to serve ads behind my pi-hole. It would respect all of my DHCP parameters, but silently ignore DNS settings. It was clearly intentional to serve ads. I had to set up a firewall to force it to use my DNS server. And eventually even that stopped working with an update (which themselves are really hard to block). I think the Chromecast is the ideal Google device, and a preview of what Google's model is: It slowly removes features through updates that you cannot turn off, and would rather fail completely than not be able to serve you ads.
- FakeComments 8y ago
  > would rather fail completely than not be able to serve you ads. Google is an ad company; if you don’t watch the ads, you’re not a useful product. It doesn’t matter you “bought a product”, this behavior is their corporate DNA. It’s the Office to their Microsoft. Time and time again, we see a clear behavior from Google: that everything feeds the ad machine — or else!
  - SmellyGeekBoy 8y ago
    As always, don't let facts get in the way of a good rant.
    - FakeComments 8y ago
      There is a continual and persistent trend in Google’s behavior, across a broad range of products. While any lone action might be explainable, as a pattern, they’re poor conduct.
- scrollaway 8y ago
  I can't really entertain the suggestion that pi-holes are considered by Google as a serious-enough threat that they'd go through this trouble just to fuck with it. Seriously, think about the venn diagram of Chromecast users and pi-hole users. It looks a lot like a tennis ball being dropped into the sun.
vbezhenar 8y ago
"Broken" ISP are likely to intercept DNS requests, so really the only option against them is something like DNS over HTTPS.
- scrollaway 8y ago
  [citation needed] on that "likely" word. I've seen instances of that, but they're extremely rare because intercepting DNS altogether is a fucked up thing to do for an ISP. Seen far, far more instances of: - ISPs shipping shitty network devices / awful factory settings - ISP's own DNS servers being terrible in various ways - Uncle Steve "the IT guy of the family" having messed with the network settings and nobody knows why 1 youtube video in 20 doesn't load but we just ignore it.
  - rmoriz 8y ago
    the amount of broken, intercepting and censoring DNS out there does not make Google a community service, though.
  - igetspam 8y ago
    TimeWarner and Comcast have both done it toe. TWC did of to let me know of a TOS violation and Comcast uses it as part of their setup. If you don't allow them to hijack DNS and show you things that you have to click through, you may find yourself unable to route traffic at all until you call them. I've dealt with this with every move in CA (about a half dozen times) and my move to TX. Seems pretty likely to me.
  - loeg 8y ago
    Centurylink hijacks 100% of real NXDOMAINs to their DNS servers and replaces them with a redirect to their internal portal. They "have" a configuration knob to disable the behavior, but it doesn't work or isn't reliably persisted; it never sticks. Big residential ISP.
dragonwriter 8y ago
> this is a $30 device to hook up TVs, Nitpick, but more like $70; you may be confusing Chromecast Ultra with the base Chromecast.
- scrollaway 8y ago
  Yes, you're correct. The Chromecast Ultra isn't sold here in Europe so I didn't make the connection.
  - yardstick 8y ago
    Chromecast Ultra is sold in the UK, which is Europe (even if we do end up leaving the EU).
    - loeg 8y ago
      OP said: > The Chromecast Ultra isn't sold here
      - vetinari 8y ago
        And the OP was wrong; Chromecast Ultra is being sold here in Europe.
        loeg 8y ago
        What? How do you know where OP lives or what is sold there? "Here" and "here" refer to different places depending on who is speaking.
        dragonwriter 8y ago
        “here in Europe” is not the same as “here” by itself, because the “in Europe” part specifies exactly what “here” means.
eeeeeeeeeeeee 8y ago
I would actually find it much more annoying from a troubleshooting perspective if every single IOT device I buy has a different hard-coded DNS server, provided by that manufacturer, instead of the one set by my local DHCP server. Because when the DNS set by your network fails, everything fails almost instantly and it's fairly easy to spot the problem from any device on your network. RE: configurability ... I thought one of the main reasons people went with Google over Apple, specifically with Android, was precisely because of their configurability. Every person I talk to that left iOS tells me this.
- scrollaway 8y ago
  Android is the exception IMO. Google's product are notoriously unconfigurable. For example, Chrome got a lot of flak over this especially in its early days. Android also seems to be going the way of iOS on many fronts, because as it turns out, this philosophy makes things hard to maintain.
lelf 8y ago
> If Google used Google DNS to spy on people Are you seriously thinking they don't store/analyse/use that kind of information??? (That's every site you visit, at minimum.)
- joshuamorton 8y ago
  Yes. They don't. They guarantee they don't. The spooky answer is they don't need it.
  - llukas 8y ago
    This guarantee is one TOS change away from vanishing...
    - joshuamorton 8y ago
      Then they'd need to announce that to all of the users of their DNS service. You tell me how to do that.
      - mthoms 8y ago
        They'd do it the same way every web service since the beginning of the internet has done it. "By using service X you are agreeing to be bound by the terms located at .... "
        joshuamorton 8y ago
        Changing privacy policies doesn't work that way. You have to inform users of the changes, or they can claim that they didn't know and aren't bound by it. That's why whenever companies change their ToS you get email/notifications/actual mail informing you of the changes. You can't do that for DNS.
        mthoms 8y ago
        > Changing privacy policies doesn't work that way. Legally speaking, yes it does. It's a free service. The only obligation they have is to make their terms freely accessible, and to publicize any major changes. You seem to be implying that Google and other free DNS providers have never changed their privacy policies since there's no good way to notify the users. Google's own website (and the Internet Archive) totally contradict this. https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy "Last updated October 29, 2018."
CivBase 8y ago
> You know what would be an actual story though? If Google used Google DNS to spy on people. What constitutes "spying" to you? Do you honestly believe Google isn't mapping your IP address to your account and monitoring your DNS requests to influence the ads they serve to you?
- mankyd 8y ago
  https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy > We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services.
  - CivBase 8y ago
    Fair enough.
    - pdkl95 8y ago
      That page is full of doublespeak. They claim they "don't keep personally identifiable information or IP information" in the permanent logs, but then go on to explain how they log everything else that you would need to track someone. In addition to saving everything about the DNS query itself (domain, record type, etc)j, they also admit to logging (quoting from the above URL): * Client's AS (autonomous system or ISP), e.g. AS15169 * User's geolocation information: i.e. geocode, region ID, city ID, and metro code * Absolute arrival time in seconds While Google's AS that the use as an example is huge[1], sometimes the AS is very revealing[2] and only map to a few addresses[3]. Combined with the geo-data, if you're on a smaller AS, Google has better tracking data than the IP address that is easy to correlate back to unique users[4]. As for their claim that "We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services." There is a lot of carefully chosen language in that claim. You didn't "provide" them with the AS number or geo-data; they looked that stuff up based on your IP address. How are they defining "personal information", and exactly what counts as "provided Google for other services."? These are totally undefined terms and companies have a tendency to evolve their definitions of important-but-not-strictly-defined terminology as the Overton window shifts and bad behavior becomes sufficiently normalized that they can use the "everybody is doing it" excuse. But looking at it in terms of what they currently say misses the larger problem: unless they have shown that their ability to amend this policy is restrict by a Ulysses Contract[5][6], they can change their policy at any time. They can also have the policy changed by an external power, against their will (e.g. a court could order them to start logging (w/ a timestamp) who communicated with them[7], even if they didn't want to. [1] "IPs Originated (v4): 8,717,056" https://bgp.he.net/AS15169 https://bgp.he.net/AS15169 [2] Google is admitting to logging which entry on this list each DNS requests originated from (warning, big page, only has US data): https://www.whatismyip.com/asn/US/ https://www.whatismyip.com/asn/US/ [3] "IPs Originated (v4): 256" https://bgp.he.net/AS54007 https://bgp.he.net/AS54007 [4] https://news.ycombinator.com/item?id=17170468 https://news.ycombinator.com/item?id=17170468 [5] https://en.wikipedia.org/wiki/Ulysses_pact https://en.wikipedia.org/wiki/Ulysses_pact [6] https://www.youtube.com/watch?v=zlN6wjeCJYk https://www.youtube.com/watch?v=zlN6wjeCJYk [7] https://en.wikipedia.org/wiki/Pen_register https://en.wikipedia.org/wiki/Pen_register (or a NSL, etc)
clubm8 8y ago
>You know what would be an actual story though? If Google used Google DNS to spy on people. If anyone has concrete evidence that they're doing that, that is a big fucking deal. In general data that exists can be supoenaed, and if the logs don't exist a court order can make them begin to exist.
jglazko 8y ago
Note that the original email complaint linked to was written by Paul Vixie, one of the major DNS creators/contributors.
IncRnd 8y ago
The author of that email, Paul Vixie, is not some random person saying, "Google is evil!!!" He is eminently qualified to speak about DNS, since he designed it.
- scrollaway 8y ago
  And did I suggest he wasn't qualified to speak about DNS?
tatoalo 8y ago
I agree with you on the "G is evil" and so on, I've used Google WiFi and used Cloudflare DNS(as a test) with no problem...(the serious discussion would be why people blindly trust Cloudflare over x or y or z, out of scope now :D)
reaperducer 8y ago
Hardcoded DNS servers are common Common != Right.
Rapzid 8y ago
I have a said expensive router, a Nighthawk, that will only advertise itself as the DNS and proxy requests. Unfortunately it's really bad at that and I was getting lots of lookup failures. Now I hardcode most of my devices to 8.8.8.8 . I can totally see how they and other IoT vendors would want to do that. What boggles my mind is that so many people believe the feature implemented was "Use 8.8.8.8 and break otherwise so we can trojan our DNS into places" instead of "Hardcode 8.8.8.8 so it works in most cases".
JohnFen 8y ago
> Hardcoded DNS servers are common. Indeed. And they're terrible. Maybe making a stink about a big player like Google doing this might encourage others to rethink the practice. Probably not, of course, but the alternative of just shutting up and taking it isn't any better.
peterwwillis 8y ago
> If Google used Google DNS to spy on people It's not "spying". Google DNS just "monetizes data sent through Google servers". Like they do with Chrome Data Saver, or Amp, or Calendar, or Contacts, or Voice, or GKeyboard, or Photos, or Maps, or Gmail, or Search, or...
tomaskafka 8y ago
I always assumed the whole point of 8.8.8.8 is to spy on me. Why would they do it otherwise?

anilakar 8y ago

It's being upvoted because the issue was raised by none other than the father of DNS.

scrollaway 8y ago
Given the ratio of people who upvote stories based on their title without clicking through, I highly doubt that.
- dang 8y ago
  We don't know what that ratio is, as we don't track it, and I'm skeptical that anyone does.
  - scrollaway 8y ago
    shrugs I wasn't referring specifically to HN, nor was I trying to suggest I know the exact ratio. What I know is it's extremely unlikely that this story is being upvoted because of that given that 1. A lot of people upvote on title alone (I'll die on that hill); 2. Not many people know who Paul Vixie is; 3. Those that do might not notice the name in the UI/email (I certainly didn't).
    - mburns 8y ago
      That’s something you believe. Die on whatever hill you choose. The top comment on HN explains who Paul Vickie is. I believe people tend to read comments before reading the article or voting.
      - scrollaway 8y ago
        The current top comment was not written at the time I wrote mine, and was not top comment until less than an hour ago. If you want a spot on my hill, I have room to rent.
    - deleted 8y ago
      [deleted]
creeble 8y ago
Well... Paul Mockepetris may not agree with that. But he's also the kind of guy who wouldn't mind.

dictum 8y ago

This is unduly paternalistic: a story is whatever the HN community decides to pay attention to, even if that leaves out important stories or puts a spotlight on minor trivia. > You know what would be an actual story though? If Google used Google DNS to spy on people. If anyone has concrete evidence that they're doing that, that is a big fucking deal. I'm an optimist, but I'm also cynical enough to foresee the same complaints — it's not a story! everyone does it — if that came to pass. Prevention is important because in real life you can almost never recoup the losses as easily. You can take it to the courts etc. but if your data leaks, it's out there, you can't undo it.

scrollaway 8y ago
> This is unduly paternalistic You're right, I'm sorry. I edited my post a bit to soften it. > I'm an optimist, but I'm also cynical enough to foresee the same complaints Well, maybe. I would hope not, specifically because Google has made previous guarantees that they do not use that data for spying. It's different when it's your ISP, which already does tons of shady shit and buried somewhere in your TOS that they do this stuff. I don't find it any more acceptable, but it would or at least should be a bigger story if Google was doing it with Google DNS.
- pixl97 8y ago
  You do realize your ISP can spy on any DNS records passing its routers with deep packet inspection right? Only DNS(HTTPS/TLS) can fix that.

tyingq 8y ago

"I'm always shocked at how easy it is for people to fall into the "Google is evil!!1" trap on such trivial stuff" Google's smart though. They know that rolling out unsavory ideas in small pieces keeps it under the radar. They didn't, for example, push the organic search results under the fold all at once. This could be innocuous, or part of some larger agenda.

dictum 8y ago
Irrespective of motivations/agenda, we can look at the current state of the consumer-facing Internet (the trend continues): https://news.ycombinator.com/item?id=16421072 https://news.ycombinator.com/item?id=16421072
JorgeGT 8y ago
This is usually called salami slicing: https://en.wikipedia.org/wiki/Salami_slicing https://en.wikipedia.org/wiki/Salami_slicing See also the boiling frog fable: https://en.wikipedia.org/wiki/Boiling_frog https://en.wikipedia.org/wiki/Boiling_frog
- misterhtmlcss 8y ago
  That's like my favorite comedy, but few people know their history well enough to laugh at the jokes anymore :(
- thecatspaw 8y ago
  Or privacy zuckering
OedipusRex 8y ago
I don't really see the point of changing the DNS settings to watch YouTube, either way Google will know what you're watching. I know the Chromecast can do other casting but I assume those services (Netflix, Hulu, etc) are using more than just DNS queries as well to see what you watch. And if you're casting local media then no DNS goes out at all.
- 8y ago

sofaofthedamned 8y ago

IIRC Meraki used to ping 8.8.8.8 as a connectivity check...

baptou12 8y ago

Other IOT manufacturers who hardcode the DNS into devices do not own the DNS servers, do they ?

loeg 8y ago
That would be worse, not better. E.g., IoT devices hardcoding NTP servers they don't pay for: https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#Notable_cases https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#No...

kilroy123 8y ago

Personally, I think they kind of _are_. I now no longer point to or use Google's DNS because of this. Call me paranoid.

scrollaway 8y ago
For what it's worth I don't think that's paranoid at all. You don't want to deal with Google, so you don't introduce them to your network, that's reasonable. What is paranoid IMO is some commenters' (as well as seemingly Paul Vixie's) implication that Google does this trick with the Chromecast to better spy on people, which completely goes against Occam's Razor.
- cwkoss 8y ago
  I mean, spying on people is the foundation of their entire ad market. They have means and motive, the only question is whether they've followed through.

judge2020 8y ago

> You know what would be an actual story though? If Google used Google DNS to spy on people. this. I highly doubt Google is actually using DNS for tracking or connecting queries to someone's account, especially when they say they don't [1]. Many people say "use Cloudflare DNS if you're worried about privacy", but Google effectively makes the same claim as Cloudflare that they don't use DNS to track you. The only plus you get from Cloudflare is how they get KPMG to audit and ensure they're not logging IPs forever. 1: https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy

manyxcxi 8y ago
CloudFlare makes their money differently than Google though. Google wants figure out how to most efficiently put other people’s ads in front of me, and to sell my attention for the most value. Even if they have absolutely no ulterior motives (evil or otherwise), Google’s business is one such that they have every motive to abuse my privacy for their own gain. CloudFlare doesn’t make their money off of brokering my attention, they have a decent track record of doing the ‘right’ things (or at least not the ‘wrong’ things), and they’ve made some decently pro-privacy statements in the past. It seems that everyone wants to collect data on everything and figure out how to sell it off, so I’m not putting it out of the realm of possibility that CloudFlare could do shady stuff and abuse my privacy as well- but their general line of business doesn’t require it the way Google’s does. All things otherwise equal, I’m gonna trust the company who’s business isn’t selling my profile a bit more for most things. I used to use Google DNS a lot, now I use CloudFlare’s. I trust them both more than Comcast, AT&T, and Verizon with respect to technical competency and security at the very least.
- saalweachter 8y ago
  Why do you think CloudFlare has less incentive to sell your data than Google? Both CloudFlare and Google are for-profit corporations which want to take actions to maximize their profits. Insomuch as they are profit maximizing, we should expect them to take actions where the expected gain is greater than the expected cost, and to prioritize actions which have the maximum gain over actions which are only barely profitable. If the cost -- in terms of extra labor and reputation if the data-selling becomes public -- is estimated to be less than people are willing to pay for the data, why would any profit-seeking corporation choose not to sell your data? We can't trust companies not to sell poisoned food, even though that's a huge reputational hit. We can't trust companies manufacturing herbal, vitamin or nutritional supplements to actually put the herb, vitamin or nutritional factor they claim they are in the bottles they sell. We can't trust the makers of USB cables to produce cables that actually meet the USB specifications. Why should we believe that any corporation, regardless of whether or not you pay them for their goods and services, would leave the money to be made selling your data on the table, even if there's a potential reputational hit if the practice becomes public?

OnlyRepliesToBS 8y ago

lol

apostacy 8y ago

This isn't a case of an IOT device though. My Chromecast went through massive amount of trouble to use Google's DNS servers, to serve ads behind my pi-hole. It would respect all of my DHCP parameters, but silently ignore DNS settings. It was clearly intentional to serve ads. I had to set up a firewall to force it to use my DNS server. And eventually even that stopped working with an update (which themselves are really hard to block). I think the Chromecast is the ideal Google device, and a preview of what Google's model is: It slowly removes features through updates that you cannot turn off, and would rather fail completely than not be able to serve you ads.

FakeComments 8y ago
> would rather fail completely than not be able to serve you ads. Google is an ad company; if you don’t watch the ads, you’re not a useful product. It doesn’t matter you “bought a product”, this behavior is their corporate DNA. It’s the Office to their Microsoft. Time and time again, we see a clear behavior from Google: that everything feeds the ad machine — or else!
- SmellyGeekBoy 8y ago
  As always, don't let facts get in the way of a good rant.
  - FakeComments 8y ago
    There is a continual and persistent trend in Google’s behavior, across a broad range of products. While any lone action might be explainable, as a pattern, they’re poor conduct.
scrollaway 8y ago
I can't really entertain the suggestion that pi-holes are considered by Google as a serious-enough threat that they'd go through this trouble just to fuck with it. Seriously, think about the venn diagram of Chromecast users and pi-hole users. It looks a lot like a tennis ball being dropped into the sun.

vbezhenar 8y ago

"Broken" ISP are likely to intercept DNS requests, so really the only option against them is something like DNS over HTTPS.

scrollaway 8y ago
[citation needed] on that "likely" word. I've seen instances of that, but they're extremely rare because intercepting DNS altogether is a fucked up thing to do for an ISP. Seen far, far more instances of: - ISPs shipping shitty network devices / awful factory settings - ISP's own DNS servers being terrible in various ways - Uncle Steve "the IT guy of the family" having messed with the network settings and nobody knows why 1 youtube video in 20 doesn't load but we just ignore it.
- rmoriz 8y ago
  the amount of broken, intercepting and censoring DNS out there does not make Google a community service, though.
- igetspam 8y ago
  TimeWarner and Comcast have both done it toe. TWC did of to let me know of a TOS violation and Comcast uses it as part of their setup. If you don't allow them to hijack DNS and show you things that you have to click through, you may find yourself unable to route traffic at all until you call them. I've dealt with this with every move in CA (about a half dozen times) and my move to TX. Seems pretty likely to me.
- loeg 8y ago
  Centurylink hijacks 100% of real NXDOMAINs to their DNS servers and replaces them with a redirect to their internal portal. They "have" a configuration knob to disable the behavior, but it doesn't work or isn't reliably persisted; it never sticks. Big residential ISP.

dragonwriter 8y ago

> this is a $30 device to hook up TVs, Nitpick, but more like $70; you may be confusing Chromecast Ultra with the base Chromecast.

scrollaway 8y ago
Yes, you're correct. The Chromecast Ultra isn't sold here in Europe so I didn't make the connection.
- yardstick 8y ago
  Chromecast Ultra is sold in the UK, which is Europe (even if we do end up leaving the EU).
  - loeg 8y ago
    OP said: > The Chromecast Ultra isn't sold here
    - vetinari 8y ago
      And the OP was wrong; Chromecast Ultra is being sold here in Europe.
      - loeg 8y ago
        What? How do you know where OP lives or what is sold there? "Here" and "here" refer to different places depending on who is speaking.
        dragonwriter 8y ago
        “here in Europe” is not the same as “here” by itself, because the “in Europe” part specifies exactly what “here” means.

eeeeeeeeeeeee 8y ago

I would actually find it much more annoying from a troubleshooting perspective if every single IOT device I buy has a different hard-coded DNS server, provided by that manufacturer, instead of the one set by my local DHCP server. Because when the DNS set by your network fails, everything fails almost instantly and it's fairly easy to spot the problem from any device on your network. RE: configurability ... I thought one of the main reasons people went with Google over Apple, specifically with Android, was precisely because of their configurability. Every person I talk to that left iOS tells me this.

scrollaway 8y ago
Android is the exception IMO. Google's product are notoriously unconfigurable. For example, Chrome got a lot of flak over this especially in its early days. Android also seems to be going the way of iOS on many fronts, because as it turns out, this philosophy makes things hard to maintain.

lelf 8y ago

> If Google used Google DNS to spy on people Are you seriously thinking they don't store/analyse/use that kind of information??? (That's every site you visit, at minimum.)

joshuamorton 8y ago
Yes. They don't. They guarantee they don't. The spooky answer is they don't need it.
- llukas 8y ago
  This guarantee is one TOS change away from vanishing...
  - joshuamorton 8y ago
    Then they'd need to announce that to all of the users of their DNS service. You tell me how to do that.
    - mthoms 8y ago
      They'd do it the same way every web service since the beginning of the internet has done it. "By using service X you are agreeing to be bound by the terms located at .... "
      - joshuamorton 8y ago
        Changing privacy policies doesn't work that way. You have to inform users of the changes, or they can claim that they didn't know and aren't bound by it. That's why whenever companies change their ToS you get email/notifications/actual mail informing you of the changes. You can't do that for DNS.
        mthoms 8y ago
        > Changing privacy policies doesn't work that way. Legally speaking, yes it does. It's a free service. The only obligation they have is to make their terms freely accessible, and to publicize any major changes. You seem to be implying that Google and other free DNS providers have never changed their privacy policies since there's no good way to notify the users. Google's own website (and the Internet Archive) totally contradict this. https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy "Last updated October 29, 2018."

CivBase 8y ago

> You know what would be an actual story though? If Google used Google DNS to spy on people. What constitutes "spying" to you? Do you honestly believe Google isn't mapping your IP address to your account and monitoring your DNS requests to influence the ads they serve to you?

mankyd 8y ago
https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy > We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services.
- CivBase 8y ago
  Fair enough.
  - pdkl95 8y ago
    That page is full of doublespeak. They claim they "don't keep personally identifiable information or IP information" in the permanent logs, but then go on to explain how they log everything else that you would need to track someone. In addition to saving everything about the DNS query itself (domain, record type, etc)j, they also admit to logging (quoting from the above URL): * Client's AS (autonomous system or ISP), e.g. AS15169 * User's geolocation information: i.e. geocode, region ID, city ID, and metro code * Absolute arrival time in seconds While Google's AS that the use as an example is huge[1], sometimes the AS is very revealing[2] and only map to a few addresses[3]. Combined with the geo-data, if you're on a smaller AS, Google has better tracking data than the IP address that is easy to correlate back to unique users[4]. As for their claim that "We don't correlate or combine information from our temporary or permanent logs with any personal information that you have provided Google for other services." There is a lot of carefully chosen language in that claim. You didn't "provide" them with the AS number or geo-data; they looked that stuff up based on your IP address. How are they defining "personal information", and exactly what counts as "provided Google for other services."? These are totally undefined terms and companies have a tendency to evolve their definitions of important-but-not-strictly-defined terminology as the Overton window shifts and bad behavior becomes sufficiently normalized that they can use the "everybody is doing it" excuse. But looking at it in terms of what they currently say misses the larger problem: unless they have shown that their ability to amend this policy is restrict by a Ulysses Contract[5][6], they can change their policy at any time. They can also have the policy changed by an external power, against their will (e.g. a court could order them to start logging (w/ a timestamp) who communicated with them[7], even if they didn't want to. [1] "IPs Originated (v4): 8,717,056" https://bgp.he.net/AS15169 https://bgp.he.net/AS15169 [2] Google is admitting to logging which entry on this list each DNS requests originated from (warning, big page, only has US data): https://www.whatismyip.com/asn/US/ https://www.whatismyip.com/asn/US/ [3] "IPs Originated (v4): 256" https://bgp.he.net/AS54007 https://bgp.he.net/AS54007 [4] https://news.ycombinator.com/item?id=17170468 https://news.ycombinator.com/item?id=17170468 [5] https://en.wikipedia.org/wiki/Ulysses_pact https://en.wikipedia.org/wiki/Ulysses_pact [6] https://www.youtube.com/watch?v=zlN6wjeCJYk https://www.youtube.com/watch?v=zlN6wjeCJYk [7] https://en.wikipedia.org/wiki/Pen_register https://en.wikipedia.org/wiki/Pen_register (or a NSL, etc)

clubm8 8y ago

>You know what would be an actual story though? If Google used Google DNS to spy on people. If anyone has concrete evidence that they're doing that, that is a big fucking deal. In general data that exists can be supoenaed, and if the logs don't exist a court order can make them begin to exist.

jglazko 8y ago

Note that the original email complaint linked to was written by Paul Vixie, one of the major DNS creators/contributors.

IncRnd 8y ago

The author of that email, Paul Vixie, is not some random person saying, "Google is evil!!!" He is eminently qualified to speak about DNS, since he designed it.

scrollaway 8y ago
And did I suggest he wasn't qualified to speak about DNS?

tatoalo 8y ago

I agree with you on the "G is evil" and so on, I've used Google WiFi and used Cloudflare DNS(as a test) with no problem...(the serious discussion would be why people blindly trust Cloudflare over x or y or z, out of scope now :D)

reaperducer 8y ago

Hardcoded DNS servers are common Common != Right.

Rapzid 8y ago

I have a said expensive router, a Nighthawk, that will only advertise itself as the DNS and proxy requests. Unfortunately it's really bad at that and I was getting lots of lookup failures. Now I hardcode most of my devices to 8.8.8.8 . I can totally see how they and other IoT vendors would want to do that. What boggles my mind is that so many people believe the feature implemented was "Use 8.8.8.8 and break otherwise so we can trojan our DNS into places" instead of "Hardcode 8.8.8.8 so it works in most cases".

JohnFen 8y ago

> Hardcoded DNS servers are common. Indeed. And they're terrible. Maybe making a stink about a big player like Google doing this might encourage others to rethink the practice. Probably not, of course, but the alternative of just shutting up and taking it isn't any better.

peterwwillis 8y ago

> If Google used Google DNS to spy on people It's not "spying". Google DNS just "monetizes data sent through Google servers". Like they do with Chrome Data Saver, or Amp, or Calendar, or Contacts, or Voice, or GKeyboard, or Photos, or Maps, or Gmail, or Search, or...

tomaskafka 8y ago

I always assumed the whole point of 8.8.8.8 is to spy on me. Why would they do it otherwise?