10 ms·

This discussion is the worst to have to repeat every time. This fallback will only be used when: * You have no DNS and NTP servers assigned via DHCP (your rou

by zaarn 6y ago

This discussion is the worst to have to repeat every time. This fallback will only be used when: * You have no DNS and NTP servers assigned via DHCP (your router does by default in 99.99% of cases) * You have no DNS configured in /etc/resolve.conf * Your distro does not change the defaults to nothing or something else (almost every distro does) * You still have internet connectivity (somehow) In most cases, these conditions would simply not be met because everyone has DNS configured somehow. This isn't a fallback for when your DNS is unreachable, it's for when no DNS has been configured at all anywhere (including by distro upstream) but you still want to use the internet. So in that rare circumstance, where your distro didn't change upstream defaults and you don't have any DNS configuration, it will fall back to Google DNS.

hansdieter1337 6y ago
so... why google and not a privacy-concerning alternative?
- kd913 6y ago
  Because the privacy concerning aspects are literally irrelevant. These are set for testing/development purposes. For which the priorities are availability/reliability/speed. For those criteria, Google/Cloudflare are empirically the best worldwide. This literally is used for test-resolving that at best probably would identify a systemd-dev. Everyone else shouldn't care because it's overwritten by distro maintainers.
  - wrkronmiller 6y ago
    Could you give more details about these tests and why the tests can't be modified to set DNS/NTP?
    - kd913 6y ago
      Likely unit tests... https://github.com/systemd/systemd/tree/master/test/test-resolve https://github.com/systemd/systemd/tree/master/test/test-res... I assume some of these use it. >why the tests can't be modified to set DNS/NTP? I am not a systemd maintainer, they probably could be adjusted, but frankly I don't imagine they or I care enough to do so. Like I said, this change only affects the devs, so why should it matter to anyone else.
- riquito 6y ago
  Google offers better documentation than most, and the privacy aspects are good. [1] Of course you have to trust them but that would be true for any company. Given that the natural default would be even less trustworthy ISP, is not that bad. https://developers.google.com/speed/public-dns/faq https://developers.google.com/speed/public-dns/faq
- znpy 6y ago
  i set up a bind nameserver for my internal network, and mistakenly i did not set upstream resolvers. It's working anyway, i think it's resolving off the root nameservers... I guess... You couldn't go more private than that.
manjalyc 6y ago
> /etc/resolve.conf It’s /etc/resolv.conf, and systemd overwrites it, Network Manager overwrites it (like every 10 minutes), dhcp overwrites it, etc. What do they overwrite it to? Most just get it from the router even if the router has no assigned servers. These days manually managing /etc/resolv.conf by hand requires hooking into every service that overwrites it on most systemd distributions. So really the people this change would affect are those with misconfigured routers. My issue is why they didn’t go with a more private DNS such as Open DNS or even Cloudfare DNS. Google’s privacy policy is worse than either of the two. It seems the questioner asked in bad faith but I would’ve hoped Poettering would respond to the validity and dismiss the malintent instead of dismissing the whole issue.
- rwmj 6y ago
  I do: chattr +i /etc/resolv.conf on my own servers to stop things from fiddling around with it.
  - snus-kin 6y ago
    It seems kinda brutal to just stop writing, but I guess there's a bit of a dogpile for writes on this file, does dhcpconf let you specify DNS servers kind of a 'layer up' from resolvconf?
  - 411111111111111 6y ago
    I usually just add it to either netplan or cloudconfig, whichever is active. Both of them have yaml syntax though, which is imo extremely unfortunate for this kind of configuration.
- znpy 6y ago
  It’s /etc/resolv.conf, and systemd overwrites it, Network Manager overwrites it (like every 10 minutes), dhcp overwrites it, etc. What do they overwrite it to? I still haven't understood where is the definitive place to set dns nowadays. /etc/resolv.conf is routinely touched by stuff like NetworkManager and other stuff. Systemd-resolved config seems like the correct place, but I'm not sure how that plays with network-manager.
AnIdiotOnTheNet 6y ago
The likelihood of this scenario is mind-bogglingly small. You need to have a valid IP configuration for the network you are on, including a default gateway that will route you to the internet, yet somehow do not have any DNS servers configured at all? Why even bother covering this case? It seems most likely to come up when this situation is created intentionally, in which case you don't want to go and ruin it by trying to be clever.
- pas 6y ago
  It's used for testing. (At least that was the rationale given for the NTP default setting, I guess the same applies for DNS too.) It's sort of a sane/understandable default, considering all the context. Though maybe they could switch to CloudFlare.
  - jeffbee 6y ago
    Cloudflare has a dns privacy policy that is exactly like Google’s but without as many robust internal controls to enforce it. There are reasons to prefer it but a rational risk model isn’t one.
    - dundarious 6y ago
      Can you elaborate on these extra internal controls?
      - jeffbee 6y ago
        Google is pretty vocal about how only reviewed, submitted, and hermetically built code can run in production, how they audit such things, how their hardware security module helps them achieve this, etc. Cloudflare has been pretty vocal about the opposite: how they use tons of off-the-shelf software components, vendor firmware, etc. There's no reason to believe that Cloudflare is as able to provide the privacy they promise as Google is.
        6y ago
AlexandrB 6y ago
This makes it worse. For all those conditions to be met, it would have to be a conscious choice on the part of the user/administrator. And then systemd decides it knows better and resolves using 8.8.8.8 anyways?
- zaarn 6y ago
  You can configure an invalid DNS server or set the DNSConfig in systemd-resolved. The DNS server option being set at all causes the fallback to not be used, regardless if it's empty or not.
belorn 6y ago
The discussion seems to be a logical circle. If the default fallback is such rare circumstance that it doesn't matter, then the best options seems to leave it blank as suggest last in the ticket. Let it fail hard and if any users has a complaint they can direct that towards downstream which should have set a sensible fallback. If the default fallback actually do matter then it seems reasonable to have a discussion about what it should be.
- creeble 6y ago
  I agree. In my experience with systemd-resolvd, things happen that make it _believe_ there is no DNS configured, and you end up with something incomprehensible (a "hidden default" or some such). Please let it just fail so that one at least has a chance of understanding what's happening rather than some magic. Typical systemd rationalization, imho: "should anything be perceived as wrong, perform hidden magic."
takeda 6y ago
The fallback is just stupid. Make it a hard fail in that case, as you pointed out it is a very uncommon scenario. If you really, really want to have fallback, why not have list of root DNS servers and have the resolver do recursive query. I set up my network that way (don't use google, cloudflare, my ISP or anything else) and used it for years without problem. But I think hard failure is best approach in this case, because this behavior will also make it harder to troubleshoot issues, let say you are setting up a network and misconfigured your router that doesn't provide DNS now you will be puzzled why Internet works on some machines while it doesn't work on others.
- floatingatoll 6y ago
  It’s not “stupid”, it’s reasoned out based on premises that you disagree with. The rest of your argument is weakened by that opening, even if it’s a point worth considering.
- JdeBP 6y ago
  The fundamental flaw in your argument is that systemd-resolved is not a resolving proxy DNS server. Many other proxy DNS server softwares indeed are switchable between resolving and forwarding modes, some even doing both at once, but systemd-resolved only provides forwarding proxy DNS service. There is no resolving mode to default to. Which is in fact the core of the problem. It's actually a fairly rare kind of proxy DNS server software, one for which there isn't really a sensible universal default for the unconfigured case.
johnbrodie 6y ago
I've run into this situation at home when setting up some new networking equipment with much more configurability than I'm used to. My system had no DNS, alerting me to the issue, and I fixed it. I don't need nor want my systems to decide for me to use Google's DNS, or any other DNS. As you mention, this _is_ a rare circumstance, and likely self-induced by some sort of "power user". I assume there are few of those power users who want the choice made for them.
raxxorrax 6y ago
Maybe people would have fewer controversy with quad 9? Would be 9.9.9.9 instead of 8.8.8.8. If this would be better is probably a matter of preference. Google owns many, many servers, so maybe using the underdog eases the mind of some people.

by zaarn 6y ago

hansdieter1337 6y ago

so... why google and not a privacy-concerning alternative?

kd913 6y ago
Because the privacy concerning aspects are literally irrelevant. These are set for testing/development purposes. For which the priorities are availability/reliability/speed. For those criteria, Google/Cloudflare are empirically the best worldwide. This literally is used for test-resolving that at best probably would identify a systemd-dev. Everyone else shouldn't care because it's overwritten by distro maintainers.
- wrkronmiller 6y ago
  Could you give more details about these tests and why the tests can't be modified to set DNS/NTP?
  - kd913 6y ago
    Likely unit tests... https://github.com/systemd/systemd/tree/master/test/test-resolve https://github.com/systemd/systemd/tree/master/test/test-res... I assume some of these use it. >why the tests can't be modified to set DNS/NTP? I am not a systemd maintainer, they probably could be adjusted, but frankly I don't imagine they or I care enough to do so. Like I said, this change only affects the devs, so why should it matter to anyone else.
riquito 6y ago
Google offers better documentation than most, and the privacy aspects are good. [1] Of course you have to trust them but that would be true for any company. Given that the natural default would be even less trustworthy ISP, is not that bad. https://developers.google.com/speed/public-dns/faq https://developers.google.com/speed/public-dns/faq
znpy 6y ago
i set up a bind nameserver for my internal network, and mistakenly i did not set upstream resolvers. It's working anyway, i think it's resolving off the root nameservers... I guess... You couldn't go more private than that.

manjalyc 6y ago

> /etc/resolve.conf It’s /etc/resolv.conf, and systemd overwrites it, Network Manager overwrites it (like every 10 minutes), dhcp overwrites it, etc. What do they overwrite it to? Most just get it from the router even if the router has no assigned servers. These days manually managing /etc/resolv.conf by hand requires hooking into every service that overwrites it on most systemd distributions. So really the people this change would affect are those with misconfigured routers. My issue is why they didn’t go with a more private DNS such as Open DNS or even Cloudfare DNS. Google’s privacy policy is worse than either of the two. It seems the questioner asked in bad faith but I would’ve hoped Poettering would respond to the validity and dismiss the malintent instead of dismissing the whole issue.

rwmj 6y ago
I do: chattr +i /etc/resolv.conf on my own servers to stop things from fiddling around with it.
- snus-kin 6y ago
  It seems kinda brutal to just stop writing, but I guess there's a bit of a dogpile for writes on this file, does dhcpconf let you specify DNS servers kind of a 'layer up' from resolvconf?
- 411111111111111 6y ago
  I usually just add it to either netplan or cloudconfig, whichever is active. Both of them have yaml syntax though, which is imo extremely unfortunate for this kind of configuration.
znpy 6y ago
It’s /etc/resolv.conf, and systemd overwrites it, Network Manager overwrites it (like every 10 minutes), dhcp overwrites it, etc. What do they overwrite it to? I still haven't understood where is the definitive place to set dns nowadays. /etc/resolv.conf is routinely touched by stuff like NetworkManager and other stuff. Systemd-resolved config seems like the correct place, but I'm not sure how that plays with network-manager.

AnIdiotOnTheNet 6y ago

The likelihood of this scenario is mind-bogglingly small. You need to have a valid IP configuration for the network you are on, including a default gateway that will route you to the internet, yet somehow do not have any DNS servers configured at all? Why even bother covering this case? It seems most likely to come up when this situation is created intentionally, in which case you don't want to go and ruin it by trying to be clever.

pas 6y ago
It's used for testing. (At least that was the rationale given for the NTP default setting, I guess the same applies for DNS too.) It's sort of a sane/understandable default, considering all the context. Though maybe they could switch to CloudFlare.
- jeffbee 6y ago
  Cloudflare has a dns privacy policy that is exactly like Google’s but without as many robust internal controls to enforce it. There are reasons to prefer it but a rational risk model isn’t one.
  - dundarious 6y ago
    Can you elaborate on these extra internal controls?
    - jeffbee 6y ago
      Google is pretty vocal about how only reviewed, submitted, and hermetically built code can run in production, how they audit such things, how their hardware security module helps them achieve this, etc. Cloudflare has been pretty vocal about the opposite: how they use tons of off-the-shelf software components, vendor firmware, etc. There's no reason to believe that Cloudflare is as able to provide the privacy they promise as Google is.
      - 6y ago

AlexandrB 6y ago

This makes it worse. For all those conditions to be met, it would have to be a conscious choice on the part of the user/administrator. And then systemd decides it knows better and resolves using 8.8.8.8 anyways?

zaarn 6y ago
You can configure an invalid DNS server or set the DNSConfig in systemd-resolved. The DNS server option being set at all causes the fallback to not be used, regardless if it's empty or not.

belorn 6y ago

The discussion seems to be a logical circle. If the default fallback is such rare circumstance that it doesn't matter, then the best options seems to leave it blank as suggest last in the ticket. Let it fail hard and if any users has a complaint they can direct that towards downstream which should have set a sensible fallback. If the default fallback actually do matter then it seems reasonable to have a discussion about what it should be.

creeble 6y ago
I agree. In my experience with systemd-resolvd, things happen that make it _believe_ there is no DNS configured, and you end up with something incomprehensible (a "hidden default" or some such). Please let it just fail so that one at least has a chance of understanding what's happening rather than some magic. Typical systemd rationalization, imho: "should anything be perceived as wrong, perform hidden magic."

takeda 6y ago

The fallback is just stupid. Make it a hard fail in that case, as you pointed out it is a very uncommon scenario. If you really, really want to have fallback, why not have list of root DNS servers and have the resolver do recursive query. I set up my network that way (don't use google, cloudflare, my ISP or anything else) and used it for years without problem. But I think hard failure is best approach in this case, because this behavior will also make it harder to troubleshoot issues, let say you are setting up a network and misconfigured your router that doesn't provide DNS now you will be puzzled why Internet works on some machines while it doesn't work on others.

floatingatoll 6y ago
It’s not “stupid”, it’s reasoned out based on premises that you disagree with. The rest of your argument is weakened by that opening, even if it’s a point worth considering.
JdeBP 6y ago
The fundamental flaw in your argument is that systemd-resolved is not a resolving proxy DNS server. Many other proxy DNS server softwares indeed are switchable between resolving and forwarding modes, some even doing both at once, but systemd-resolved only provides forwarding proxy DNS service. There is no resolving mode to default to. Which is in fact the core of the problem. It's actually a fairly rare kind of proxy DNS server software, one for which there isn't really a sensible universal default for the unconfigured case.

johnbrodie 6y ago

I've run into this situation at home when setting up some new networking equipment with much more configurability than I'm used to. My system had no DNS, alerting me to the issue, and I fixed it. I don't need nor want my systems to decide for me to use Google's DNS, or any other DNS. As you mention, this _is_ a rare circumstance, and likely self-induced by some sort of "power user". I assume there are few of those power users who want the choice made for them.

raxxorrax 6y ago

Maybe people would have fewer controversy with quad 9? Would be 9.9.9.9 instead of 8.8.8.8. If this would be better is probably a matter of preference. Google owns many, many servers, so maybe using the underdog eases the mind of some people.