11 ms·
A Chrome feature is creating load on global root DNS servers
- creeble 6y agoWhat does Firefox do to prevent the problem chromium is trying to solve?
- stefan_ 6y agoThey turned on DNS over HTTPs by default and send your queries to Cloudflare: https://blog.mozilla.org/blog/2020/02/25/firefox-continues-push-to-bring-dns-over-https-by-default-for-us-users/ https://blog.mozilla.org/blog/2020/02/25/firefox-continues-p...
- stuartd 6y agoYou’re seemingly pushing you own agenda here? As the article itself says: > Are other approaches feasible? For example, Firefox’s captive portal test uses delegated namespace probe queries, directing them away from the root servers towards the browser’s infrastructure.
- stefan_ 6y agoIn your agenda to expose my agenda in linking a Firefox blog post, you have missed that this isn't even about captive portal detection. Captive portals are easily detected by trying to load a known response page; captive portals don't fake that because they want to be detected so that the browser redirects you to their portal. This is about malicious DNS resolvers that don't return NXDOMAIN for non-existent domains but instead send you to an ISP advertisement page. This messes with the omnibox. For all other domains, they resolve just fine. These resolvers are inclined to evade detection, e.g. if browsers checked a static list of domains, they would just return NXDOMAIN for only those.
- carlhjerpe 6y agoI can't even remember last i got an advertisement page. Must've been about 10 years ago, though the last 5 I've been using third party DNS. I don't know any Swedish ISP that does this. I'm using ISP DNS on my phone.
- floatingatoll 6y agoSounds like your country isn't as commonly affected. Lucky you :)
- stefan_ 6y agoI assume at some point the calculus flipped for ISPs to not annoy you with low-quality ads and make customers cut them out, but instead operate a real DNS resolver so you can still sell their real-time browsing history to advertisers. Part of that is the Google and Cloudflare marketing campaigns for their public resolvers, so people had a ready alternative.
- GauntletWizard 6y agoGee, 10 years ago - About when Chrome implemented this feature and started to gain worldwide traction.
- stuartd 6y agoOk sorry, please forgive my misunderstanding, it sounds like you’re saying Cloudflare is a ‘malicious DNS resolver’, but I guess I’m wrong there as well? I opted into DoH when it became available in Nightly (though not in the US), am I being a mug here?
- eat_veggies 6y agothey're saying that ISPs run malicious DNS resolvers (which is correct), not Cloudflare.
- stuartd 6y agoI don’t see that in the parent comment, though, to which my misguided reply has been heavily downvoted? I guess I need to learn more about this. Edit: or just stay out of it.
- gsnedders 6y ago(for US users only, unlike what Chrome does which is worldwide)
- tobyhinloopen 6y agoInteresting problem
- lilSebastian 6y agoThis topic has been posted several times in the last few days
- jwilk 6y agohttps://news.ycombinator.com/item?id=24231857 https://news.ycombinator.com/item?id=24231857 (4 days ago, 207 comments) Anything else?
- floatingatoll 6y agoYou can email the mods using the footer Contact link and ask them to dupe them all together, if you provide them the HN story links for the dupes.
- donor20 6y agoThis issue only exists because without chrome's work here virtually every ISP / Wifi provider etc started hijacking DNS inquiries to pump trash ads down your throat. THANK you google for stopping this total abuse of internet standards (very annoying for some cases where no UI as well). The irony of Verisign complaining about this is incredible actually - they were the no 1 abusers of this in the past! They go on about interception being the exception these days. That's actually because chrome put a stake right through the heart of Verisgns efforts to intercept.
- donor20 6y agoSeparate question - if google did what mozilla did and wrapped DNS in HTTPS and ran it to 8.8.8.8 (allowing user to pick other resolvers) - would that be better? It feels like folks complain - you are sending too much traffic. If google said - we can handle it directly (they obviously can - the bandwidth youtube alone uses has got to be magnitudes larger) people would complain - no no - send us the traffic. Google already runs 8.8.8.8 and encourages adoption of it I think - maybe it can handle the billion requests per day? Or maybe they can help verisign scale their infra?
- firloop 6y agoGoogle running the DNS resolver wouldn’t fix this problem; due to the nature of the requests that Chrome is making, the lookups would have to hit the root server because they wouldn’t be cached anywhere else.
- donor20 6y agoI'm suggesting let google run some root resolvers. Not to rain on the sob story, but netflix, amazon and google probably pump out orders of magniture more bytes then these requests. It's axiomatic. If my session makes 3 512 byte requests when I start browsing, and then I watch 10 youtube videos at 2K, then a netflix movie at 4K, how in the WORLD is the bandwidth from the 3 512 byte requests crushing infrastructure? And if it is, let google or amazon or someone with a clue run the infra. Seriously - this makes no sense that THIS is the bandwidth killer out there. Apple updates - sure, those are monsters and a ton of people get them. DNS packets are pretty small by contrast.
- Animats 6y agoThe root servers may have to delay NXDOMAIN replies. Those are rare for legit requests.
- adrr 6y agoJust require HTTPS already.
- godman_8 6y agoHTTPS doesn’t protect against DNS or SNI interception
- adrr 6y agoIf there’s no valid cert for the domain, you can’t 301/302 redirect over https connection. SNI just lets the middleman peak at the host name, it doesn’t allow you to redirect. DNS interception allows the attackers to change IP but https still needs a valid cert for the host.
- kenniskrag 6y agoWith HSTS and preload it should mitigate the vulnerability.
- adrr 6y agoIssues with HSTS is that it is opt in. It should be an opt out with a list of legacy sites that ships with the browsers similar to how hsts preloading works.
- Polylactic_acid 6y agoThe option browser vendors are going with seems to be to make http show a full page warning about being insecure. No need to change HSTS now.
- stordoff 6y agoIncidentally, this affects how my ISP implements its domain blocks. Non-HTTPS sites are 307 redirected to https://assets.virginmedia.com/site-blocked.html https://assets.virginmedia.com/site-blocked.html, whereas connections to HTTPS sites are just halted (IIRC, it sends a TCP reset, but it's a while since I looked into it).
- jiggawatts 6y agoIn a previous YCNews discussion of this topic, I worked out based on public Root DNS statistics that this traffic amounts to at most a few gigabits spread across hundreds of DNS servers, each of which has at least a gigabit connection. Notice that all of the breathless articles going on about how evil Google is are using percentages, not absolute numbers? This is because journalists don't do journalism any more, they just put their name on corporate PR that is intended as a weapon in a war for control.
- x0 6y agoYou know, that actually makes sense to me. You'd want a lot of margin. If they were running the root DNS servers and were hitting like 80% of their bandwidth on a normal day, I'd be worried.
- GauntletWizard 6y agoWe're not talking about 80%. We're talking about 8%. The size of the traffic they are talking about is low enough that I, personally, would consider paying for it. It is a couple thousands of dollars a month to run this "abused" infrastructure. If they were doing it as a thankless task for free, it would make sense to be upset about it; but they're not. They're doing it for a cut of every single .com purchase on the whole web.
- deleted 6y ago[deleted]
- t-writescode 6y agoWhat does this do to users of PiHole?
- manigandham 6y agoSo half of the traffic is Chrome requests, but how much capacity is all of the traffic actually using? Are the root servers 90% idle or are they overloaded? That changes everything. Also servers are fast, bandwidth is cheap, and DNS is lightweight. How is this really a major resource issue?
- OnlyRepliesToBS 6y agoNOT FUCKING CHROME
- cordite 6y agoI've been using google DNS, and cloudflare DNS (as of late) since I found out about this ISP behavior. It's unacceptable, it's unhelpful, and I see it as a vector for getting untrustworthy software on less savy users hardware.
- lilyball 6y agoI don’t understand why it has to randomly generate new domains each time. Surely all that matters is that it’s testing for domains that are statistically unlikely to exist, right? Why not seed the RNG with something like the current date, such that the domains are still random, but all instances of Chrome generate the same domains every day? That way the NXDOMAIN results should be able to be cached by upstream resolvers, thus significantly reducing the load on the root servers.
- JoshTriplett 6y agoIf they were in any way predictable, people would register them, or the broken DNS servers would handle those domains properly while still giving broken results for others.
- 1f60c 6y agoThat shouldn't be a problem: I don't think it's possible to make qwajuixk resolve to anything on the public internet. I bet they could hardcode a list of domains, change it up every couple releases, and that'd stop 80% of the rogue sysadmins who are doing this.
- recursive 6y agoI don't think so. If there is any kind of predictability, I think at least 80% of the spam would come back. And these aren't rogue sysadmins. Huge companies are doing this.
- theonemind 6y agoI've mostly seen DNS hijacking from large ISPs. Probably hardly any sysadmin anywhere wants to implement DNS hijacking, but have corporate overlords that tell them to do it. The first big ISP would get it working pretty quickly no matter what Google did, then other big companies would see it and tell their sysadmins to figure it out, the other company is already doing it. I bet there's a decent amount of cash in DNS hijacking for big players, so you should probably think of it like the hypothetical cryptography attacker. You should assume they will know everything about your method but still can't beat it. If you can tell them what you're doing and they can beat it, they will. They wouldn't have done it in the first place without motivation.
- AviationAtom 6y agoThe case for add blockers. Less DNS lookup load on the Internet!
- toast0 6y agoIs the root zone AXFR able? Maybe recursive servers should just periodically do that, and then they don't need to forward these queries.
- JdeBP 6y agoYes, it is, and that's in fact one popular way to set up a private root content DNS server for a resolving proxy DNS server to consult. I do it on my machines. * https://github.com/jdebp/nosh/blob/9a113ec2c2e58679bab8d8b34413de4acab377f2/source/convert/tinydns.do#L77 https://github.com/jdebp/nosh/blob/9a113ec2c2e58679bab8d8b34...
- kevin_b_er 6y agoIronic that this is Verisign complaining considering the very idea to capture nonexistant domains and replace with spam was a Verisign concept from 2003 called Site Finder. All of .com and .net were wildcarded at the root level. The ISP just took it as a great idea. Now we have to make countermeasures for it. https://en.wikipedia.org/wiki/Site_Finder https://en.wikipedia.org/wiki/Site_Finder
- cmroanirgo 6y agoPrevious discussion (5 days prior) https://news.ycombinator.com/item?id=24231857 https://news.ycombinator.com/item?id=24231857