5 ms·

This issue only exists because without chrome's work here virtually every ISP / Wifi provider etc started hijacking DNS inquiries to pump trash ads down your th

This issue only exists because without chrome's work here virtually every ISP / Wifi provider etc started hijacking DNS inquiries to pump trash ads down your throat. THANK you google for stopping this total abuse of internet standards (very annoying for some cases where no UI as well). The irony of Verisign complaining about this is incredible actually - they were the no 1 abusers of this in the past! They go on about interception being the exception these days. That's actually because chrome put a stake right through the heart of Verisgns efforts to intercept.

donor20 6y ago
Separate question - if google did what mozilla did and wrapped DNS in HTTPS and ran it to 8.8.8.8 (allowing user to pick other resolvers) - would that be better? It feels like folks complain - you are sending too much traffic. If google said - we can handle it directly (they obviously can - the bandwidth youtube alone uses has got to be magnitudes larger) people would complain - no no - send us the traffic. Google already runs 8.8.8.8 and encourages adoption of it I think - maybe it can handle the billion requests per day? Or maybe they can help verisign scale their infra?
- firloop 6y ago
  Google running the DNS resolver wouldn’t fix this problem; due to the nature of the requests that Chrome is making, the lookups would have to hit the root server because they wouldn’t be cached anywhere else.
  - donor20 6y ago
    I'm suggesting let google run some root resolvers. Not to rain on the sob story, but netflix, amazon and google probably pump out orders of magniture more bytes then these requests. It's axiomatic. If my session makes 3 512 byte requests when I start browsing, and then I watch 10 youtube videos at 2K, then a netflix movie at 4K, how in the WORLD is the bandwidth from the 3 512 byte requests crushing infrastructure? And if it is, let google or amazon or someone with a clue run the infra. Seriously - this makes no sense that THIS is the bandwidth killer out there. Apple updates - sure, those are monsters and a ton of people get them. DNS packets are pretty small by contrast.
    - sterlind 6y ago
      Bandwidth isn't the issue, it's the dynamic nature of the content and the global consistency needed between DNS servers. Videos are static content; they don't get updated so you don't need any schemes to check for updates. It's certainly possible to design DNS to scale, it's just that they may be overwhelmed by QPS right now because they made different trade-offs.
      - donor20 6y ago
        We are talking 15k qps. A single AMD machine should be able to much higher rates - millions. Yes, there is overhead, but my point was, if verisign or whoever is in charge can't run these root servers to handle 15k qps for the entire global internet then let google do it. These are ridiculously low numbers, and dns is EASIER not harder than video. Google is doing full live streaming, multi res / format delivery with chat across a ton of platforms. And no - root DNS does not change at a high rate of speed. It's a 2MB file you can download yourself. .com stays .com for a LONG time and the TTLs are going to be in hours and days.
    - thayne 6y ago
      I think the root resolvers can handle it (at least so far). It's just that these probably unnecessary DNS request to test for a somewhat rare situation are causing just about as much traffic to root resolvers as the rest of the internet combined. Note that this will actually be disproportionately higher than DNS traffic to recursive resolvers, because, since these domain names are randomly generated, they won't be cached very well. I think the complaint is not "we can't handle this" so much as "we don't want to pay for this." Now, if you are saying that google should run root resolvers so they can absorb some cost of doing this, that might be fair. Although, I suspect it would be cheaper for them to find a different way to accomplish this in the browser.
  - suprfsat 6y ago
    If Chrome switched to Google DNS for everything they wouldn't need to check for ISP interception.
  - eat_veggies 6y ago
    If Chrome used DoH then it wouldn't need to send these types of queries
    - gsich 6y ago
      That's not the proper way though.
- thanhhaimai 6y ago
  The real "complaint" is that Google broke the ISPs ability to highjack your DNS. With that real goal in mind, they will still "complain" if Google wrap DNS on https and send to 8.8.8.8 The ISPs now will have a series of PR articles about how Google wants to own the internet, track all your web DNS, monopolize the access, and evil blah blah. We should read these articles with the mindset that they are PR pieces, not a solution request. Opinions are my own.
  - donor20 6y ago
    Verisign, the folks complaining did a wildcard DNS entry for ALL .com and .net domains called sitefinder! How can they handle the bandwidth for that (serving full web pages with lots of "partner" offers etc) but not 3 DNS packets? Something doesn't make sense here.
    - floatingatoll 6y ago
      The budget for operating the root servers is unlikely to be shared with the budget for operating Sitefinder.
      - icedchai 6y ago
        The GTLD / top level domain servers are different from root servers. Also, root servers are a shared, distributed responsibility. Verisign doesn't run most of them: https://en.wikipedia.org/wiki/Root_name_server https://en.wikipedia.org/wiki/Root_name_server
  - hn_check 6y ago
    "The ISPs now will have a series of PR articles about how Google wants to own the internet, track all your web DNS, monopolize the access, and evil blah blah." They'd be right, but that's neither here nor there in this contrived strawman. And yes, a lot of people would have a serious problem if Google baked in their own DNS. That would break a lot of stuff. And it would make the notion of checking invalid DNS entries rather unnecessary, wouldn't it?
- drivebycomment 6y ago
  A billion requests-per-day is not much actually. 1B / (24h * 60m * 60s) = 11.5K qps Let's say 2:1 between daily peak and trough, and call that 23K qps peak. 10 years ago a single server could do 30Kqps of DNS: https://www.dell.com/downloads/global/shared/DNS_performance.pdf https://www.dell.com/downloads/global/shared/DNS_performance... So ~40 boxes 10 years ago would have been able to handle 60 billion queries per day. I'd expect a single modern server of reasonable size to easily do 100K qps, and probably more like 200-300K qps, if not exceeding a million qps (though a single box may hit the packet/s bottleneck). So Verisign is complaining about a single digit to low double digit server box worth of traffic. I have a hard time imagining this being more than a rounding error for them. EDIT: Updated to directly reflect 60B queries per day figure.
  - fanf2 6y ago
    You can get over 9 million queries per second from an AMD Epyc box https://en.blog.nic.cz/2019/12/10/epic-dns-benchmarking/ https://en.blog.nic.cz/2019/12/10/epic-dns-benchmarking/ and over a million qps on more modest hardware https://www.knot-dns.cz/benchmark/ https://www.knot-dns.cz/benchmark/ but a lot of the root DNS servers are running BIND so aren’t able to reach such lofty heights
    - drivebycomment 6y ago
      Thanks for confirming my intuition. I haven't paid attention to bind performance for well over a decade. So now I am even more flabbergasted that Verisign are even talking about the load.
petee 6y ago
The irony is actually Google ignores/bends standards all the time because they can get away with it.
mlindner 6y ago
Except there's other ways of doing this. For example Firefox does the same thing and doesn't do this. https://blog.apnic.net/2020/08/21/chromiums-impact-on-root-dns-traffic/ https://blog.apnic.net/2020/08/21/chromiums-impact-on-root-d... > The root server system is, out of necessity, designed to handle very large amounts of traffic. As we have shown here, under normal operating conditions, half of the traffic originates with a single library function, on a single browser platform, whose sole purpose is to detect DNS interception. Such interception is certainly the exception rather than the norm. In almost any other scenario, this traffic would be indistinguishable from a distributed denial of service (DDoS) attack. > Could Chromium achieve its goal while only sending one or two queries instead of three? Are other approaches feasible? For example, Firefox’s captive portal test uses delegated namespace probe queries, directing them away from the root servers towards the browser’s infrastructure.
1vuio0pswjnm7 6y ago
But isn't Google's business collecting user data and then providing assistance to other companies that may want to stuff trash ads down your throat? Google's search engine is not an "internet standard". Being the default on Chrome, that is in effect what this DNS querying behaviour is protecting. Protecting Google "search via the address bar" is also the raison d'etre for Google Public DNS. Back in 2008/2009, this type of "search" was being hijacked by OpenDNS. The solution to not having DNS "hijacked" is to have more user control of DNS. Letting users select a third party DNS provider is better than no choice at all, but that is not really control. The third party still has control. Unfortunately, full user control -- the best solution to stop hijacking and other DNS tricks -- is not what Google and others are promoting. By design, I have no entries for certain Google domains in the zone files I use on the LAN. I have seen how much involuntary DNS traffic there is from Chrome and other Google software 24/7 (including queries for these random strings). It is significant, even for just one user. Why don't they provide an option to turn this off.
- x86_64Ubuntu 6y ago
  Google collecting user data for ads is a different issue from ISPs intercepting DNS requests, and then hijacking the response. You are conflating two different issues. And can't you select your DNS provider in Chrome by going to Settings > Security > Advanced > DNS Stuff
  - deleted 6y ago
    [deleted]
deleted 6y ago
[deleted]
danShumway 6y ago
Agreed. I'm not a Google stan, but I'm inclined to be on their side here. It would be good to switch to a less expensive solution, and I hope the Chromium team does so, but at the end of the day we don't want ISPs to hijack DNS queries. I'm not convinced that I should care more about the extra load on root DNS servers than I should care about the hijacking. And frankly, I don't trust the people who are complaining about this.
1vuio0pswjnm7 6y ago
In re Verisign, did you mean this: https://en.wikipedia.org/wiki/Site_Finder https://en.wikipedia.org/wiki/Site_Finder Google had nothing to do with solving that problem.
deeblering4 6y ago
> THANK you google for stopping this total abuse of internet standards Sending all browser DNS queries back to google by default seems abusive in a different way.
- gempir 6y ago
  They don't. They use the default DNS that's available for the user. That's the whole point of this feature.
Hokusai 6y ago
> THANK you google for stopping this total abuse Changing one abuse for another is barely an improvement. Regulations is what will force ISP to behave correctly and stop hijacking DNS queries. For me, as European, it is worst to be spied by Google and my data given to the United States of America intelligence, than to depend on my ISP that is bounded to European laws and will know where I connect regardless. Google is abusing its position and most users are not technical savvy enough to understand the implications.
- thanhhaimai 6y ago
  This is a strawman. The context of the discussion is whether Google should be sending those DNS queries. The premises involved technical details about how heavy those DNS queries are. The DNS queries don't make things worse for the end-users privacy wise. Nobody is arguing that we should give Google more "abuse". There is an actual net negative of "abuse" in this case, by removing the abuse from the ISPs, with a solution that doesn't change your data privacy from Google.
- sthnblllII 6y ago
  The only additional data going to google would be intranet requests incorrectly sent to google as searches. I don't think google did this to collect that data, but some legal standards would be nice either way.
iforgotpassword 6y ago
They could still improve on it to make the impact less severe. (for example [1]) Mind you they do this globally even though that practice is illegal in many countries, so in a lot of places this is a complete waste. [1] https://news.ycombinator.com/item?id=24233903 https://news.ycombinator.com/item?id=24233903
JdeBP 6y ago
Google isn't alone in objecting to this. * http://jdebp.uk./FGA/verisign-internet-coup.html http://jdebp.uk./FGA/verisign-internet-coup.html

donor20 6y ago

Separate question - if google did what mozilla did and wrapped DNS in HTTPS and ran it to 8.8.8.8 (allowing user to pick other resolvers) - would that be better? It feels like folks complain - you are sending too much traffic. If google said - we can handle it directly (they obviously can - the bandwidth youtube alone uses has got to be magnitudes larger) people would complain - no no - send us the traffic. Google already runs 8.8.8.8 and encourages adoption of it I think - maybe it can handle the billion requests per day? Or maybe they can help verisign scale their infra?

firloop 6y ago
Google running the DNS resolver wouldn’t fix this problem; due to the nature of the requests that Chrome is making, the lookups would have to hit the root server because they wouldn’t be cached anywhere else.
- donor20 6y ago
  I'm suggesting let google run some root resolvers. Not to rain on the sob story, but netflix, amazon and google probably pump out orders of magniture more bytes then these requests. It's axiomatic. If my session makes 3 512 byte requests when I start browsing, and then I watch 10 youtube videos at 2K, then a netflix movie at 4K, how in the WORLD is the bandwidth from the 3 512 byte requests crushing infrastructure? And if it is, let google or amazon or someone with a clue run the infra. Seriously - this makes no sense that THIS is the bandwidth killer out there. Apple updates - sure, those are monsters and a ton of people get them. DNS packets are pretty small by contrast.
  - sterlind 6y ago
    Bandwidth isn't the issue, it's the dynamic nature of the content and the global consistency needed between DNS servers. Videos are static content; they don't get updated so you don't need any schemes to check for updates. It's certainly possible to design DNS to scale, it's just that they may be overwhelmed by QPS right now because they made different trade-offs.
    - donor20 6y ago
      We are talking 15k qps. A single AMD machine should be able to much higher rates - millions. Yes, there is overhead, but my point was, if verisign or whoever is in charge can't run these root servers to handle 15k qps for the entire global internet then let google do it. These are ridiculously low numbers, and dns is EASIER not harder than video. Google is doing full live streaming, multi res / format delivery with chat across a ton of platforms. And no - root DNS does not change at a high rate of speed. It's a 2MB file you can download yourself. .com stays .com for a LONG time and the TTLs are going to be in hours and days.
  - thayne 6y ago
    I think the root resolvers can handle it (at least so far). It's just that these probably unnecessary DNS request to test for a somewhat rare situation are causing just about as much traffic to root resolvers as the rest of the internet combined. Note that this will actually be disproportionately higher than DNS traffic to recursive resolvers, because, since these domain names are randomly generated, they won't be cached very well. I think the complaint is not "we can't handle this" so much as "we don't want to pay for this." Now, if you are saying that google should run root resolvers so they can absorb some cost of doing this, that might be fair. Although, I suspect it would be cheaper for them to find a different way to accomplish this in the browser.
- suprfsat 6y ago
  If Chrome switched to Google DNS for everything they wouldn't need to check for ISP interception.
- eat_veggies 6y ago
  If Chrome used DoH then it wouldn't need to send these types of queries
  - gsich 6y ago
    That's not the proper way though.
thanhhaimai 6y ago
The real "complaint" is that Google broke the ISPs ability to highjack your DNS. With that real goal in mind, they will still "complain" if Google wrap DNS on https and send to 8.8.8.8 The ISPs now will have a series of PR articles about how Google wants to own the internet, track all your web DNS, monopolize the access, and evil blah blah. We should read these articles with the mindset that they are PR pieces, not a solution request. Opinions are my own.
- donor20 6y ago
  Verisign, the folks complaining did a wildcard DNS entry for ALL .com and .net domains called sitefinder! How can they handle the bandwidth for that (serving full web pages with lots of "partner" offers etc) but not 3 DNS packets? Something doesn't make sense here.
  - floatingatoll 6y ago
    The budget for operating the root servers is unlikely to be shared with the budget for operating Sitefinder.
    - icedchai 6y ago
      The GTLD / top level domain servers are different from root servers. Also, root servers are a shared, distributed responsibility. Verisign doesn't run most of them: https://en.wikipedia.org/wiki/Root_name_server https://en.wikipedia.org/wiki/Root_name_server
- hn_check 6y ago
  "The ISPs now will have a series of PR articles about how Google wants to own the internet, track all your web DNS, monopolize the access, and evil blah blah." They'd be right, but that's neither here nor there in this contrived strawman. And yes, a lot of people would have a serious problem if Google baked in their own DNS. That would break a lot of stuff. And it would make the notion of checking invalid DNS entries rather unnecessary, wouldn't it?
drivebycomment 6y ago
A billion requests-per-day is not much actually. 1B / (24h * 60m * 60s) = 11.5K qps Let's say 2:1 between daily peak and trough, and call that 23K qps peak. 10 years ago a single server could do 30Kqps of DNS: https://www.dell.com/downloads/global/shared/DNS_performance.pdf https://www.dell.com/downloads/global/shared/DNS_performance... So ~40 boxes 10 years ago would have been able to handle 60 billion queries per day. I'd expect a single modern server of reasonable size to easily do 100K qps, and probably more like 200-300K qps, if not exceeding a million qps (though a single box may hit the packet/s bottleneck). So Verisign is complaining about a single digit to low double digit server box worth of traffic. I have a hard time imagining this being more than a rounding error for them. EDIT: Updated to directly reflect 60B queries per day figure.
- fanf2 6y ago
  You can get over 9 million queries per second from an AMD Epyc box https://en.blog.nic.cz/2019/12/10/epic-dns-benchmarking/ https://en.blog.nic.cz/2019/12/10/epic-dns-benchmarking/ and over a million qps on more modest hardware https://www.knot-dns.cz/benchmark/ https://www.knot-dns.cz/benchmark/ but a lot of the root DNS servers are running BIND so aren’t able to reach such lofty heights
  - drivebycomment 6y ago
    Thanks for confirming my intuition. I haven't paid attention to bind performance for well over a decade. So now I am even more flabbergasted that Verisign are even talking about the load.

petee 6y ago

The irony is actually Google ignores/bends standards all the time because they can get away with it.

mlindner 6y ago

Except there's other ways of doing this. For example Firefox does the same thing and doesn't do this. https://blog.apnic.net/2020/08/21/chromiums-impact-on-root-dns-traffic/ https://blog.apnic.net/2020/08/21/chromiums-impact-on-root-d... > The root server system is, out of necessity, designed to handle very large amounts of traffic. As we have shown here, under normal operating conditions, half of the traffic originates with a single library function, on a single browser platform, whose sole purpose is to detect DNS interception. Such interception is certainly the exception rather than the norm. In almost any other scenario, this traffic would be indistinguishable from a distributed denial of service (DDoS) attack. > Could Chromium achieve its goal while only sending one or two queries instead of three? Are other approaches feasible? For example, Firefox’s captive portal test uses delegated namespace probe queries, directing them away from the root servers towards the browser’s infrastructure.

1vuio0pswjnm7 6y ago

But isn't Google's business collecting user data and then providing assistance to other companies that may want to stuff trash ads down your throat? Google's search engine is not an "internet standard". Being the default on Chrome, that is in effect what this DNS querying behaviour is protecting. Protecting Google "search via the address bar" is also the raison d'etre for Google Public DNS. Back in 2008/2009, this type of "search" was being hijacked by OpenDNS. The solution to not having DNS "hijacked" is to have more user control of DNS. Letting users select a third party DNS provider is better than no choice at all, but that is not really control. The third party still has control. Unfortunately, full user control -- the best solution to stop hijacking and other DNS tricks -- is not what Google and others are promoting. By design, I have no entries for certain Google domains in the zone files I use on the LAN. I have seen how much involuntary DNS traffic there is from Chrome and other Google software 24/7 (including queries for these random strings). It is significant, even for just one user. Why don't they provide an option to turn this off.

x86_64Ubuntu 6y ago
Google collecting user data for ads is a different issue from ISPs intercepting DNS requests, and then hijacking the response. You are conflating two different issues. And can't you select your DNS provider in Chrome by going to Settings > Security > Advanced > DNS Stuff
- deleted 6y ago
  [deleted]

deleted 6y ago

[deleted]

danShumway 6y ago

Agreed. I'm not a Google stan, but I'm inclined to be on their side here. It would be good to switch to a less expensive solution, and I hope the Chromium team does so, but at the end of the day we don't want ISPs to hijack DNS queries. I'm not convinced that I should care more about the extra load on root DNS servers than I should care about the hijacking. And frankly, I don't trust the people who are complaining about this.

1vuio0pswjnm7 6y ago

In re Verisign, did you mean this: https://en.wikipedia.org/wiki/Site_Finder https://en.wikipedia.org/wiki/Site_Finder Google had nothing to do with solving that problem.

deeblering4 6y ago

> THANK you google for stopping this total abuse of internet standards Sending all browser DNS queries back to google by default seems abusive in a different way.

gempir 6y ago
They don't. They use the default DNS that's available for the user. That's the whole point of this feature.

Hokusai 6y ago

> THANK you google for stopping this total abuse Changing one abuse for another is barely an improvement. Regulations is what will force ISP to behave correctly and stop hijacking DNS queries. For me, as European, it is worst to be spied by Google and my data given to the United States of America intelligence, than to depend on my ISP that is bounded to European laws and will know where I connect regardless. Google is abusing its position and most users are not technical savvy enough to understand the implications.

thanhhaimai 6y ago
This is a strawman. The context of the discussion is whether Google should be sending those DNS queries. The premises involved technical details about how heavy those DNS queries are. The DNS queries don't make things worse for the end-users privacy wise. Nobody is arguing that we should give Google more "abuse". There is an actual net negative of "abuse" in this case, by removing the abuse from the ISPs, with a solution that doesn't change your data privacy from Google.
sthnblllII 6y ago
The only additional data going to google would be intranet requests incorrectly sent to google as searches. I don't think google did this to collect that data, but some legal standards would be nice either way.

iforgotpassword 6y ago

They could still improve on it to make the impact less severe. (for example [1]) Mind you they do this globally even though that practice is illegal in many countries, so in a lot of places this is a complete waste. [1] https://news.ycombinator.com/item?id=24233903 https://news.ycombinator.com/item?id=24233903

JdeBP 6y ago

Google isn't alone in objecting to this. * http://jdebp.uk./FGA/verisign-internet-coup.html http://jdebp.uk./FGA/verisign-internet-coup.html