4 ms·

We hardcode known good DNS servers in IoT devices that we ship from work because a significant proportion of issues being reported by customers were caused by I

We hardcode known good DNS servers in IoT devices that we ship from work because a significant proportion of issues being reported by customers were caused by ISP resolvers doing things they shouldn't - mostly either redirecting all domains to a splash screen telling people about bandwidth quotas/other things, or not respecting the TTL returned by our resolvers, which could cause data to get directed to the wrong place for extended periods.

Bartweiss 8y ago
This is a really interesting point, thank you. My initial reaction to the post above was "ship a known-good DNS if you must, but honor the user-chosen service unless it's not answering." This makes sense as a more common reason you'd want to hardcode a DNS, and a reason to honor your setting over whatever is coming back from the customer's DNS. I still can't see a good rationale for only using the hardcoded DNS, though. Not only does it strip user control, it opens the door to all kinds of secondary stupidity like breaking every Chromecast in Turkey by insisting on a blocked DNS.
- cwkoss 8y ago
  There's no reason "use only hardcoded DNS" couldn't be user configurable, for all the benefit with none of the costs. Well... all of the benefit to the user. Google doesn't get to use your DNS requests to sell ads.
  - kllrnohj 8y ago
    > Well... all of the benefit to the user. Google doesn't get to use your DNS requests to sell ads. How do you envision this working on the product in question? When are you ever making arbitrary DNS lookups in a Chromecast? Seriously take the tinfoil hat off for a minute and think rationally. Google owns the entirety of the software on the device, and all connections to & from it. There's nothing they gain in terms of data harvesting from hard-coding their DNS here. There is no user input in play at all here. What are they going to harvest from a device that only ever does DNS lookups for their own hostnames? If this was happening on Chrome, or Android, or something where user input & interaction was actually a thing then sure. But this is a goddamn Chromecast. All it does is watch YouTube and similar. How in any way, shape, or form can those DNS requests in any way help sell ads?
    - jimsmart 8y ago
      In this instance, I think it's got less to do with harvesting data from the lookups, and more to do with ensuring advertising gets shown? i.e. I suspect Google force their own DNS so that one cannot so easily use e.g. PiHole to filter out DNS lookups for servers that stream e.g. YouTube adverts. ?
creeble 8y ago
Been there too, sad to say. We haven't gone so far as to hard-code DNS servers yet, but it's shocking how bad some ISPs' DNS support can be. There should be a better way to fight it, but I fear Google may win here because I haven't been able to find anything wrong with the way their servers work. I.e., 8.8.8.8 isn't doing anything evil afaict... Yet.
- JohnFen 8y ago
  Doing that can be (barely) acceptable, provided that you also do two other things: make it clear to users that you're doing that, and allow a way for the user to change that behavior if they desire.
- jon-wood 8y ago
  We default to Cloudflare’s 1.1.1.1 resolver because they have a clear policy on what they will and won’t do with the data available to them.

Bartweiss 8y ago

This is a really interesting point, thank you. My initial reaction to the post above was "ship a known-good DNS if you must, but honor the user-chosen service unless it's not answering." This makes sense as a more common reason you'd want to hardcode a DNS, and a reason to honor your setting over whatever is coming back from the customer's DNS. I still can't see a good rationale for only using the hardcoded DNS, though. Not only does it strip user control, it opens the door to all kinds of secondary stupidity like breaking every Chromecast in Turkey by insisting on a blocked DNS.

cwkoss 8y ago
There's no reason "use only hardcoded DNS" couldn't be user configurable, for all the benefit with none of the costs. Well... all of the benefit to the user. Google doesn't get to use your DNS requests to sell ads.
- kllrnohj 8y ago
  > Well... all of the benefit to the user. Google doesn't get to use your DNS requests to sell ads. How do you envision this working on the product in question? When are you ever making arbitrary DNS lookups in a Chromecast? Seriously take the tinfoil hat off for a minute and think rationally. Google owns the entirety of the software on the device, and all connections to & from it. There's nothing they gain in terms of data harvesting from hard-coding their DNS here. There is no user input in play at all here. What are they going to harvest from a device that only ever does DNS lookups for their own hostnames? If this was happening on Chrome, or Android, or something where user input & interaction was actually a thing then sure. But this is a goddamn Chromecast. All it does is watch YouTube and similar. How in any way, shape, or form can those DNS requests in any way help sell ads?
  - jimsmart 8y ago
    In this instance, I think it's got less to do with harvesting data from the lookups, and more to do with ensuring advertising gets shown? i.e. I suspect Google force their own DNS so that one cannot so easily use e.g. PiHole to filter out DNS lookups for servers that stream e.g. YouTube adverts. ?

creeble 8y ago

Been there too, sad to say. We haven't gone so far as to hard-code DNS servers yet, but it's shocking how bad some ISPs' DNS support can be. There should be a better way to fight it, but I fear Google may win here because I haven't been able to find anything wrong with the way their servers work. I.e., 8.8.8.8 isn't doing anything evil afaict... Yet.

JohnFen 8y ago
Doing that can be (barely) acceptable, provided that you also do two other things: make it clear to users that you're doing that, and allow a way for the user to change that behavior if they desire.
jon-wood 8y ago
We default to Cloudflare’s 1.1.1.1 resolver because they have a clear policy on what they will and won’t do with the data available to them.