5 ms·

I too have written code that asks 8.8.8.8 and 8.8.4.4, because the DNS server I get from DHCP frequently is so brain-damaged. (SRV records, what's that?) I aske

by Arnt 8y ago

I too have written code that asks 8.8.8.8 and 8.8.4.4, because the DNS server I get from DHCP frequently is so brain-damaged. (SRV records, what's that?) I asked both in parallel. On one hand it feels wrong to not ask in parallel. On the other, $%#@%#$%!$@# the %$#%#$%^$#@%#$! packet filters that block DNS packets to everyone except the local brain-damaged resolver. Or even redirect. If Google will fight that fight I'll happily enjoy the benefits.

AnIdiotOnTheNet 8y ago
As someone who has had to block and redirect DNS traffic, there are reasons we do this and if you have a problem with it then you should contact the admins about it. If you're unwilling to do that, maybe you shouldn't be doing what you're trying to do at work.
- Arnt 8y ago
  Do you happen to be the admin at the meeting venue that discarded my SRV and DNSSEC lookups? What were the reasons you did this, if so?
  - AnIdiotOnTheNet 8y ago
    Use the guest WiFi, that's what it's there for.
    - Arnt 8y ago
      Does that have a sensibly working resolver? In my haphazard experience, the networks that block access to UDP port 53 are more than likely to have gelded broken name servers that e.g. serve empty NXERROR results for anything but A/TXT, and receptionists that say, "uh, let me check" and then check that their browser can open the google home page. (Insert invectives here.) I've seen be fixed. Once. One meeting I attended started with a quite broken network, but it was an IETF meeting, and the IETF tools team reconfigured the AP channel layout, the DHCP server and the caching name server at that hotel and after that it was fine.
kazinator 8y ago
> If Google will fight that fight I'll happily enjoy the benefits. Evidently, they are: https://en.wikipedia.org/wiki/DNS_over_HTTPS https://en.wikipedia.org/wiki/DNS_over_HTTPS https://developers.google.com/speed/public-dns/docs/dns-over-https https://developers.google.com/speed/public-dns/docs/dns-over...
- vetinari 8y ago
  And that's how we are going to get mandatory https proxies in networks... The arms race will continue, making the lives of everyone more difficult.
  - kazinator 8y ago
    A HTTPS proxy can't rewrite the contents of your stream. If it redirects to the wrong host, the cert doesn't match.
    - vetinari 8y ago
      That's fine, it is not about rewriting stream, but about not allowing to connect certain hosts.
  - glennpratt 8y ago
    I will never install that cert, so it stops there for me. IT security theater be damned.
JohnFen 8y ago
> On the other, $%#@%#$%!$@# the %$#%#$%^$#@%#$! packet filters that block DNS packets to everyone except the local brain-damaged resolver. Curse it all you want, but forcing all DNS lookups to be resolved by a particular server is often an important security measure.
- glennpratt 8y ago
  Lolwut? Seriously, what serious exploit would be stopped by this.

by Arnt 8y ago

AnIdiotOnTheNet 8y ago

As someone who has had to block and redirect DNS traffic, there are reasons we do this and if you have a problem with it then you should contact the admins about it. If you're unwilling to do that, maybe you shouldn't be doing what you're trying to do at work.

Arnt 8y ago
Do you happen to be the admin at the meeting venue that discarded my SRV and DNSSEC lookups? What were the reasons you did this, if so?
- AnIdiotOnTheNet 8y ago
  Use the guest WiFi, that's what it's there for.
  - Arnt 8y ago
    Does that have a sensibly working resolver? In my haphazard experience, the networks that block access to UDP port 53 are more than likely to have gelded broken name servers that e.g. serve empty NXERROR results for anything but A/TXT, and receptionists that say, "uh, let me check" and then check that their browser can open the google home page. (Insert invectives here.) I've seen be fixed. Once. One meeting I attended started with a quite broken network, but it was an IETF meeting, and the IETF tools team reconfigured the AP channel layout, the DHCP server and the caching name server at that hotel and after that it was fine.

kazinator 8y ago

> If Google will fight that fight I'll happily enjoy the benefits. Evidently, they are: https://en.wikipedia.org/wiki/DNS_over_HTTPS https://en.wikipedia.org/wiki/DNS_over_HTTPS https://developers.google.com/speed/public-dns/docs/dns-over-https https://developers.google.com/speed/public-dns/docs/dns-over...

vetinari 8y ago
And that's how we are going to get mandatory https proxies in networks... The arms race will continue, making the lives of everyone more difficult.
- kazinator 8y ago
  A HTTPS proxy can't rewrite the contents of your stream. If it redirects to the wrong host, the cert doesn't match.
  - vetinari 8y ago
    That's fine, it is not about rewriting stream, but about not allowing to connect certain hosts.
- glennpratt 8y ago
  I will never install that cert, so it stops there for me. IT security theater be damned.

JohnFen 8y ago

> On the other, $%#@%#$%!$@# the %$#%#$%^$#@%#$! packet filters that block DNS packets to everyone except the local brain-damaged resolver. Curse it all you want, but forcing all DNS lookups to be resolved by a particular server is often an important security measure.

glennpratt 8y ago
Lolwut? Seriously, what serious exploit would be stopped by this.