4 ms·

"He is currently Director of Engineering at Netflix, working on Open Connect, Netflix's home CDN also known as the CDN moving about 30% of the total US Internet

by 3xblah 7y ago

"He is currently Director of Engineering at Netflix, working on Open Connect, Netflix's home CDN also known as the CDN moving about 30% of the total US Internet traffic" There is something about CDNs and DNS, usually not good. According to Paul Vixie, that is how we ended up with EDNS0 despite the objection of IETF. Wonder if this company gets permission to share data with Netflix. I would read the terms carefully. Hopefully people will choose to run their own Pi-Holes on their home networks, preferably without pointing them at third party "upstream" DNS providers.

patrec 7y ago
How does your own DNS server substantially help, given that it needs to get its data somewhere?
- tremon 7y ago
  By distributing its requests across the many authoritative servers for the domains you visit. The only one that still sees all your DNS requests is the ISP.
  - kasey_junk 7y ago
    In the US at least the major ISPs are likely the worst people to see your dns queries as they are actively selling that data to advertisers.
    - belorn 7y ago
      I don't think ISP are a bigger threat to ad blocking than google, even if US ISPs have a very bad reputation.
    - zie 7y ago
      They see all of your traffic anyway, so it doesn't really matter if they also see your DNS traffic, it's not like HTTPS hides who you are visiting.
      - naasking 7y ago
        > They see all of your traffic anyway, so it doesn't really matter if they also see your DNS traffic, it's not like HTTPS hides who you are visiting. Given a lot of traffic goes to cloud providers with IP pools that are discriminated largely by the HTTP Host header, it absolutely does somewhat hide "who you are visiting".
        zie 7y ago
        Not really, as HTTPS doesn't currently encrypt the HTTP host header. It might someday, but even that wouldn't be foolproof.
        mathgladiator 7y ago
        I thought https was just http over a socket with ttls? Os, is it the certificate handshake where host header is leaked?
        tremon 7y ago
        SNI requires the host header to be sent unencrypted, as the server needs to know which certificate to offer for the TLS session.
        wrboyce 7y ago
        No. The SNI is transmitted in plain text as part of the ClientHello but TLS does not care about application implementation details. The HTTP Host header is encrypted along with the rest of the request.
        Sohcahtoa82 7y ago
        > is it the certificate handshake where host header is leaked? Yes, because of SNI [0]. In short, the ClientHello message sent by your browser as the first step of TLS negotiation (After the TCP connection is made, obviously) includes the hostname of the server you are trying to connect to unencrypted so that the server knows which certificate to present in the case of multiple sites being served on one IP/port combo. [0] https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication
cryptonym 7y ago
Some CDN rely on DNS for load balancing. They need information on end user network to properly resolve ( sending you to a server in the right geo for instance). If you use a third party resolver and it is not providing enough info, you may get poor performance. That's not some fancy tracking, in the end the CDN will get your IP and traffic. (Not saying it's impossible to use it for tracking purpose)
3xblah 7y ago
s/EDNS0/& Client Subnet

by 3xblah 7y ago

patrec 7y ago

How does your own DNS server substantially help, given that it needs to get its data somewhere?

tremon 7y ago
By distributing its requests across the many authoritative servers for the domains you visit. The only one that still sees all your DNS requests is the ISP.
- kasey_junk 7y ago
  In the US at least the major ISPs are likely the worst people to see your dns queries as they are actively selling that data to advertisers.
  - belorn 7y ago
    I don't think ISP are a bigger threat to ad blocking than google, even if US ISPs have a very bad reputation.
  - zie 7y ago
    They see all of your traffic anyway, so it doesn't really matter if they also see your DNS traffic, it's not like HTTPS hides who you are visiting.
    - naasking 7y ago
      > They see all of your traffic anyway, so it doesn't really matter if they also see your DNS traffic, it's not like HTTPS hides who you are visiting. Given a lot of traffic goes to cloud providers with IP pools that are discriminated largely by the HTTP Host header, it absolutely does somewhat hide "who you are visiting".
      - zie 7y ago
        Not really, as HTTPS doesn't currently encrypt the HTTP host header. It might someday, but even that wouldn't be foolproof.
        mathgladiator 7y ago
        I thought https was just http over a socket with ttls? Os, is it the certificate handshake where host header is leaked?
        tremon 7y ago
        SNI requires the host header to be sent unencrypted, as the server needs to know which certificate to offer for the TLS session.
        wrboyce 7y ago
        No. The SNI is transmitted in plain text as part of the ClientHello but TLS does not care about application implementation details. The HTTP Host header is encrypted along with the rest of the request.
        Sohcahtoa82 7y ago
        > is it the certificate handshake where host header is leaked? Yes, because of SNI [0]. In short, the ClientHello message sent by your browser as the first step of TLS negotiation (After the TCP connection is made, obviously) includes the hostname of the server you are trying to connect to unencrypted so that the server knows which certificate to present in the case of multiple sites being served on one IP/port combo. [0] https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication

cryptonym 7y ago

Some CDN rely on DNS for load balancing. They need information on end user network to properly resolve ( sending you to a server in the right geo for instance). If you use a third party resolver and it is not providing enough info, you may get poor performance. That's not some fancy tracking, in the end the CDN will get your IP and traffic. (Not saying it's impossible to use it for tracking purpose)

3xblah 7y ago

s/EDNS0/& Client Subnet