6 ms·

> "Moreover, Google does not use any personal information collected through the Public DNS service to target ads. We do not correlate or associate personal inf

> "Moreover, Google does not use any personal information collected through the Public DNS service to target ads. We do not correlate or associate personal information in Google Public DNS logs with your information from use of any other Google service except for addressing security and abuse." https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy Do you have proof that the opposite is true?

sofetch 6y ago
> Do you have proof that the opposite is true? Why would this be necessary with the big gaping hole in the assertion? > except for addressing security and abuse. I expect Google and I have very different conceptions of what qualifies as "abuse" and how to "address" it.
dijit 6y ago
Even if it isn’t happening now, which I find no evidence either way (privacy policies are historically less followed than laws, and companies break laws willingly- and even then? What constitutes “abuse”?)- can you make the case that this data will never be correlated or used? In perpetuity? Seems like _not_ giving away data is the only way to be sure if that. Everything else is subject to change.
gsich 6y ago
You posted it yourself. Only Google knows what "abuse" and "security" means. So you need to assume that the opposite is indeed true.
capableweb 6y ago
The privacy policy starts with "We take your privacy very seriously", which coming from Google, is kind of funny. A bit like sitting on the phone in a queue for 2 hours and hearing an automated voice saying "We care about customer service!" repeatedly. The "Google does not use any personal information collected through the Public DNS service to target ads" sentence is oddly specific as well. Why is it only mentioning "targeted ads" and not "for any sort of purposed"? Why is it collected if you're not using it? What does "abuse" really mean in this context, and what does "addressing" it entail? Only the big guys at Google knows. Finally, the holy privacy policy of Google can change at any time. "We change this Privacy Policy from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent." it says, which makes sense if you're a Google user. What about me, who don't have a Google account? How do I, tell this public DNS service that I don't agree to the new privacy policy? Right, I can't, you assume I'm fine with it. I think we're long past the point of having to prove that various tech companies don't care about people's privacy. The burden of proof that you're actively taking steps to preserve it is on you, as you've already burned all the goodwill you had from the internet crowd.
- neuromanser 6y ago
  > The privacy policy starts with "We take your privacy very seriously", which coming from Google, is kind of funny. "We take your privacy, very seriously"
- capableweb 6y ago
  I just realized now in after hand that the statement "Google does not use any personal information collected through the Public DNS service to target ads" confirms that they ARE collecting personal information from the DNS service, they are just not using it for targeting ads. Why are they collecting personal information in the first place, for a public DNS service that is supposedly built for "faster and safer DNS infrastructure"? Collecting no personal data would certainly be the fastest and safest for me as a user.
  - jeffbee 6y ago
    They keep peer IP addresses in their temporary debug logs, as explained in the privacy policy.
  - delroth 6y ago
    You cannot run any internet service without collecting personal information. IP addresses are personal data per GDPR, and by serving TCP connections you are collecting IP addresses of your clients. In the case of DNS, your DNS query is also likely personal data in some cases, and it definitely is personal data when linked to a timestamp and an IP address. There is a huge distinction to be made in collecting vs. storing. The 8888 privacy policy also calls out that some personal information is stored, for how long, and for what purpose. But most people who claim that they're not collecting personal information are just not being accurate in their privacy statements. Disclaimer: googler, opinion is my own and not my employer's.
    - capableweb 6y ago
      > You cannot run any internet service without collecting personal information What the hell are you talking about?! Of course you can, why wouldn't you be able to? You think the internet and the web started out with having everyone automatically collecting everyones personal information? > Disclaimer: googler Aha, yeaaaah, now it makes sense that you don't think it's possible to do anything else but to collect personal data. While the opinion is your own, it's pretty obvious what its been influenced by.
Xelbair 6y ago
Right now google is in territory of "guilty untill proven innocent" not vice versa. What prevents you, in future when policy changes, to start using such data?
- hedora 6y ago
  Almost nothing prevents them from retroactively applying a new policy to old data. Even in cases where using the data would directly violate a contract, bankruptcy courts / acquisition agreements routinely sell the data off as an “asset” and nullify any restrictions from existing agreements. A change in the law that kept the copyright of personal data with the individual the data was about would improve the situation somewhat, but it’s probably safer to just ban the collection of this sort of data set (unless there’s explicit opt-in, and people derive no benefit from opting in).
tannhaeuser 6y ago
It's simply implausible Google is not looking at DNS as source of web visit stats. If they're not using it for tracking on their own, they close this loophole (from their PoV) of visitor data leaking to competitors, to perpetuate their monopoly. Google has simply shut down too many information channels (MMS, RSS, Usenet, forcing https, to name a few) in the name of "security", when they are the ones to gain from this deprivation and monopolization into the "open web". Nobody can convince me Google has oppressed political minorities in mind with DNS-over-HTTP.
- dageshi 6y ago
  My suspicion is that Google employee's were seeing their dns fucked with at public wifi hotspots (something that was happening at the time) and decided to build their own dns for their own security. Being Google and having boat loads of server resources I imagine they decided they may as well make it public. All those products that got killed mostly started that way, employee's wanted them and google had the money to make them happen. Eventually though if they're not growing, then who in google wants to work on them? Did google also see it as a strategic way to make sure dns providers couldn't force search results elsewhere? Probably, but then as users WE certainly don't want dns providers fucking with dns in that manner either.
  - Isomer 6y ago
    Close. AIUI, Google was annoyed at people meddling with DNS results, and with ISPs providing terrible DNS performance for their customers. Google wins when the Internet is fast. Google's goals here are that you can use Websearch quickly and without hotspots etc meddling with traffic. The story is simple: If companies meddle with DNS results, or provide poor performance, then users don't use the Internet as much, and Google doesn't get to sell ads. Google wants you to have the fastest, most reliable Internet it can, because that means you don't get frustrated and go do something else. Google doesn't need to scrape the logs for whatever people think google might be scraping the logs for. Google _does_ log some data for dealing with abuse (as you can probably imagine 8.8.8.8 gets a _lot_ of intentional and unintentional abuse), but tries to be as clear as it can be about what gets logged, what it's used for, and how long it's kept. Google treats these logs very very carefully, carefully limiting who has access, and when you need to use the logs to debug something, it's very carefully audited. Disclaimer: I used to be one of the SREs oncall for Google Public DNS (but not any more – I now work for a different SRE team at Google).
_wldu 6y ago
You don't know if they use your queries to further track/predict your online behavior. It's impossible for you to know this. You certainly do know that you are giving the DNS queries to them (that's a fact). IMO, it is reasonable to assume that an advertising company would use data (that consumers give them) to further enhance and target ads to those consumers.
michaelcampbell 6y ago
> > "Moreover, Google does not use any personal information collected through the Public DNS service to target ads. yet.
unionpivo 6y ago
Google is not saying they are not recording queries. My guess is google saves up everything. And even if they are not doing anything with that data today (I don't buy that), that can change tomorrow. And Goolge is way past where I assume they have good intentions. Do you have any proof Google isn't doing something creepy with that data it collects from DNS logs ?
- Avamander 6y ago
  I have a suspicion that they might not be able to store everything, but do make aggregated reports.
  - hedora 6y ago
    There are currently about 5 billion internet users. For each 12 TB they purchase for logging DNS queries per day, they could store a bit over 2KB per user. Assuming reasonable compression, they shouldn’t be spending more than 2-4B to log each request, so they can store 500-1000 queries per user. My guess is they could store everything, but choose to apply some aggregation.
- jart 6y ago
  That's pretty much what Eric Schmidt talks about in The New Digital Age. He says that the technical requirements for building reliable systems at scale makes information tricky to impossible to delete. He also says the same thing you said, which is that the implication of data being permanent is that, even if privacy is respected by these companies today, future generations might hold the complete opposite values and could change the laws. What's to stop the cloud natives from making all your emails and search history public after you die? Is it really so difficult to believe, if we consider how common it is for the private letters of important historical figures to be published?
hedora 6y ago
The text you quoted is enough proof. Removing double negatives, sentence one reads: “We collect personal information through the public DNS service, but do not use it to target ads.” Sentence 2: We log dns queries and correlate and associate personal information in these logs with other google and third party (and presumably Alphabet, YouTube, etc) services. Datasets that were correlated from Google services is only used to address security and abuse.
- viraptor 6y ago
  > Removing double negatives, sentence one reads: No, you changed the meaning when editing. The original sentence does not confirm the personal data is collected, but if it is it's not used to target ads. This is pedantic, but if you're trying to explain someone's written policy it's important not to put words in their mouth.
  - hedora 6y ago
    The text is part of a EULA, so it is setting contractual boundaries on their behavior. Would you sign a lease that said the landlord wouldn’t use any video surveillance from hidden cameras inside the home to bring legal charges against the tenants? You can be sure every word of this part of the privacy policy was crafted to sound as reasonable as possible without limiting any of their existing behavior.
    - viraptor 6y ago
      I'm not discussing the implication of what's written there. Just that if you transform the text for the purpose of that discussion, you can't change the meaning and present it as equivalent to the original. Especially when talking about contractual boundaries.
  - zo1 6y ago
    The way I see it, he's rephrasing the sentence to describe the "set" of things the Eula doesn't explicitly preclude the possibility of.

sofetch 6y ago

> Do you have proof that the opposite is true? Why would this be necessary with the big gaping hole in the assertion? > except for addressing security and abuse. I expect Google and I have very different conceptions of what qualifies as "abuse" and how to "address" it.

dijit 6y ago

Even if it isn’t happening now, which I find no evidence either way (privacy policies are historically less followed than laws, and companies break laws willingly- and even then? What constitutes “abuse”?)- can you make the case that this data will never be correlated or used? In perpetuity? Seems like _not_ giving away data is the only way to be sure if that. Everything else is subject to change.

gsich 6y ago

You posted it yourself. Only Google knows what "abuse" and "security" means. So you need to assume that the opposite is indeed true.

capableweb 6y ago

The privacy policy starts with "We take your privacy very seriously", which coming from Google, is kind of funny. A bit like sitting on the phone in a queue for 2 hours and hearing an automated voice saying "We care about customer service!" repeatedly. The "Google does not use any personal information collected through the Public DNS service to target ads" sentence is oddly specific as well. Why is it only mentioning "targeted ads" and not "for any sort of purposed"? Why is it collected if you're not using it? What does "abuse" really mean in this context, and what does "addressing" it entail? Only the big guys at Google knows. Finally, the holy privacy policy of Google can change at any time. "We change this Privacy Policy from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent." it says, which makes sense if you're a Google user. What about me, who don't have a Google account? How do I, tell this public DNS service that I don't agree to the new privacy policy? Right, I can't, you assume I'm fine with it. I think we're long past the point of having to prove that various tech companies don't care about people's privacy. The burden of proof that you're actively taking steps to preserve it is on you, as you've already burned all the goodwill you had from the internet crowd.

neuromanser 6y ago
> The privacy policy starts with "We take your privacy very seriously", which coming from Google, is kind of funny. "We take your privacy, very seriously"
capableweb 6y ago
I just realized now in after hand that the statement "Google does not use any personal information collected through the Public DNS service to target ads" confirms that they ARE collecting personal information from the DNS service, they are just not using it for targeting ads. Why are they collecting personal information in the first place, for a public DNS service that is supposedly built for "faster and safer DNS infrastructure"? Collecting no personal data would certainly be the fastest and safest for me as a user.
- jeffbee 6y ago
  They keep peer IP addresses in their temporary debug logs, as explained in the privacy policy.
- delroth 6y ago
  You cannot run any internet service without collecting personal information. IP addresses are personal data per GDPR, and by serving TCP connections you are collecting IP addresses of your clients. In the case of DNS, your DNS query is also likely personal data in some cases, and it definitely is personal data when linked to a timestamp and an IP address. There is a huge distinction to be made in collecting vs. storing. The 8888 privacy policy also calls out that some personal information is stored, for how long, and for what purpose. But most people who claim that they're not collecting personal information are just not being accurate in their privacy statements. Disclaimer: googler, opinion is my own and not my employer's.
  - capableweb 6y ago
    > You cannot run any internet service without collecting personal information What the hell are you talking about?! Of course you can, why wouldn't you be able to? You think the internet and the web started out with having everyone automatically collecting everyones personal information? > Disclaimer: googler Aha, yeaaaah, now it makes sense that you don't think it's possible to do anything else but to collect personal data. While the opinion is your own, it's pretty obvious what its been influenced by.

Xelbair 6y ago

Right now google is in territory of "guilty untill proven innocent" not vice versa. What prevents you, in future when policy changes, to start using such data?

hedora 6y ago
Almost nothing prevents them from retroactively applying a new policy to old data. Even in cases where using the data would directly violate a contract, bankruptcy courts / acquisition agreements routinely sell the data off as an “asset” and nullify any restrictions from existing agreements. A change in the law that kept the copyright of personal data with the individual the data was about would improve the situation somewhat, but it’s probably safer to just ban the collection of this sort of data set (unless there’s explicit opt-in, and people derive no benefit from opting in).

tannhaeuser 6y ago

It's simply implausible Google is not looking at DNS as source of web visit stats. If they're not using it for tracking on their own, they close this loophole (from their PoV) of visitor data leaking to competitors, to perpetuate their monopoly. Google has simply shut down too many information channels (MMS, RSS, Usenet, forcing https, to name a few) in the name of "security", when they are the ones to gain from this deprivation and monopolization into the "open web". Nobody can convince me Google has oppressed political minorities in mind with DNS-over-HTTP.

dageshi 6y ago
My suspicion is that Google employee's were seeing their dns fucked with at public wifi hotspots (something that was happening at the time) and decided to build their own dns for their own security. Being Google and having boat loads of server resources I imagine they decided they may as well make it public. All those products that got killed mostly started that way, employee's wanted them and google had the money to make them happen. Eventually though if they're not growing, then who in google wants to work on them? Did google also see it as a strategic way to make sure dns providers couldn't force search results elsewhere? Probably, but then as users WE certainly don't want dns providers fucking with dns in that manner either.
- Isomer 6y ago
  Close. AIUI, Google was annoyed at people meddling with DNS results, and with ISPs providing terrible DNS performance for their customers. Google wins when the Internet is fast. Google's goals here are that you can use Websearch quickly and without hotspots etc meddling with traffic. The story is simple: If companies meddle with DNS results, or provide poor performance, then users don't use the Internet as much, and Google doesn't get to sell ads. Google wants you to have the fastest, most reliable Internet it can, because that means you don't get frustrated and go do something else. Google doesn't need to scrape the logs for whatever people think google might be scraping the logs for. Google _does_ log some data for dealing with abuse (as you can probably imagine 8.8.8.8 gets a _lot_ of intentional and unintentional abuse), but tries to be as clear as it can be about what gets logged, what it's used for, and how long it's kept. Google treats these logs very very carefully, carefully limiting who has access, and when you need to use the logs to debug something, it's very carefully audited. Disclaimer: I used to be one of the SREs oncall for Google Public DNS (but not any more – I now work for a different SRE team at Google).

_wldu 6y ago

You don't know if they use your queries to further track/predict your online behavior. It's impossible for you to know this. You certainly do know that you are giving the DNS queries to them (that's a fact). IMO, it is reasonable to assume that an advertising company would use data (that consumers give them) to further enhance and target ads to those consumers.

michaelcampbell 6y ago

> > "Moreover, Google does not use any personal information collected through the Public DNS service to target ads. yet.

unionpivo 6y ago

Google is not saying they are not recording queries. My guess is google saves up everything. And even if they are not doing anything with that data today (I don't buy that), that can change tomorrow. And Goolge is way past where I assume they have good intentions. Do you have any proof Google isn't doing something creepy with that data it collects from DNS logs ?

Avamander 6y ago
I have a suspicion that they might not be able to store everything, but do make aggregated reports.
- hedora 6y ago
  There are currently about 5 billion internet users. For each 12 TB they purchase for logging DNS queries per day, they could store a bit over 2KB per user. Assuming reasonable compression, they shouldn’t be spending more than 2-4B to log each request, so they can store 500-1000 queries per user. My guess is they could store everything, but choose to apply some aggregation.
jart 6y ago
That's pretty much what Eric Schmidt talks about in The New Digital Age. He says that the technical requirements for building reliable systems at scale makes information tricky to impossible to delete. He also says the same thing you said, which is that the implication of data being permanent is that, even if privacy is respected by these companies today, future generations might hold the complete opposite values and could change the laws. What's to stop the cloud natives from making all your emails and search history public after you die? Is it really so difficult to believe, if we consider how common it is for the private letters of important historical figures to be published?

hedora 6y ago

The text you quoted is enough proof. Removing double negatives, sentence one reads: “We collect personal information through the public DNS service, but do not use it to target ads.” Sentence 2: We log dns queries and correlate and associate personal information in these logs with other google and third party (and presumably Alphabet, YouTube, etc) services. Datasets that were correlated from Google services is only used to address security and abuse.

viraptor 6y ago
> Removing double negatives, sentence one reads: No, you changed the meaning when editing. The original sentence does not confirm the personal data is collected, but if it is it's not used to target ads. This is pedantic, but if you're trying to explain someone's written policy it's important not to put words in their mouth.
- hedora 6y ago
  The text is part of a EULA, so it is setting contractual boundaries on their behavior. Would you sign a lease that said the landlord wouldn’t use any video surveillance from hidden cameras inside the home to bring legal charges against the tenants? You can be sure every word of this part of the privacy policy was crafted to sound as reasonable as possible without limiting any of their existing behavior.
  - viraptor 6y ago
    I'm not discussing the implication of what's written there. Just that if you transform the text for the purpose of that discussion, you can't change the meaning and present it as equivalent to the original. Especially when talking about contractual boundaries.
- zo1 6y ago
  The way I see it, he's rephrasing the sentence to describe the "set" of things the Eula doesn't explicitly preclude the possibility of.