36 ms·

72% of smart TVs and 46% of game consoles hardcode DNS settings

546 points by boramalper 6y ago

AntiImperialist 6y ago
Looks like you meant to share this: https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole
- giuliomagnifico 6y ago
  Oh yes sorry. I haven’t noticed it, don’t know what url I copied in my clipboard.
  - dgl 6y ago
    Looks like it wasn't your fault, the page has: <link rel="canonical" href="https://0.0.0.0:4000/blog/force-dns-pihole https://0.0.0.0:4000/blog/force-dns-pihole"> So some "Share" buttons may pick that up.
    - giuliomagnifico 6y ago
      This is what happened! Because I posted it from my phone via share button! Thanks for the investigation :-)
kowlo 6y ago
How did this make it to the front-page with 11 points by linking to "https://0.0.0.0:4000/blog/force-dns-pihole https://0.0.0.0:4000/blog/force-dns-pihole"? Do most people just vote based on the title?
- sorenjan 6y ago
  I was wondering the same thing. It's at #4 on my front page at the moment, and the link obviously doesn't work.
- OCISLY 6y ago
  Yes, that's open secret of hn and reddit. Only small fraction actually reads articles.
- Kiro 6y ago
  I would presume most upvotes on most articles come from people just voting on the title.
- holyDictionary 6y ago
  To be fair, the article is correctly linked in the comments
- st_goliath 6y ago
  The title says something about the PiHole and the link is to 0.0.0.0. And it made it to the front page. Maybe we count this one as an art performance?
  - deleted 6y ago
    [deleted]
noname120 6y ago
> some of these devices are using a sneaky tactic to bypass your PiHole entirely I don't think that it's malevolent on their part. Lots of ISP DNS are crappy. Hardcoding a reasonably reliable one saves them a lot of frustration and unnecessary technical support.
- ugexe 6y ago
  So if every single piece of hardware or software followed this one crazy trick the world would be better because some people at a tech company wouldn’t have to field as many support questions?
  - fingerlocks 6y ago
    Yes, support is supremely expensive. This is especially true in the hardware IoT space under discussion. Some large fraction of any semi-successful hardware company will exist to field a constant onslaught of support emails, handling returns, warranties, and social media. It’s a big money sink. Margins are already razor thin in hardware, so yeah anything that can be done to reduce your support costs is welcomed.
    - GekkePrutser 6y ago
      I worked in support a long time and yes it's expensive. A few support cases will destroy your margin on a product sold. However, these IoT companies add these features mainly to benefit from selling the acquired data. The users are not asking for this. They're making it difficult for themselves.
    - wang_li 6y ago
      > Yes, support is supremely expensive. I agree. I have support costs too. Which is why every company that sells a product with a hard coded DNS server configured but doesn't advertise said aspect prominently in all advertising, so I can know to avoid their intentionally defective product, should pay me $10000 for the time I wasted buying their product, discovering their product is secretly and intentionally broken, and then return their product.
jon-wood 6y ago
I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. While sure there are companies explicitly doing this to avoid filtering, at least in my case it’s because a significant proportion of DHCP servers are configured to send DNS to your ISP, and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN responses into the IP address of their ad-laced web search, and occasionally just highjack every single query to send you to a page saying you’re approaching your bandwidth quota. In the face of that sort of behaviour you inevitably end up with technical support having to field angry customers who just don’t get that it’s not our fault the hardware isn’t working, and the response to that is hardcoding a set of known good DNS servers which we can rely on. Please, if you have a Pihole, redirect all DNS through it as described in the article. Just be aware DNS over HTTPS is a thing now, and while the devices I’m responsible for aren’t going to try and evade your redirects, the companies that are trying to make sure ads get delivered will absolutely switch to DoH which will be much more difficult to work around.
- foxtrottbravo 6y ago
  Wow, thanks for breaking established standards then...
  - Avamander 6y ago
    Go beat your ISP first.
- intricatedetail 6y ago
  There is no justification for bypassing users network settings, and especially doing it for your own convenience. At very least it should be opt in. If you want to violate customer privacy to save money on support, then I don't know why this is worth even discussing.
- rightbyte 6y ago
  What DNS do you hardcode? Google's? Or do you advice the use to set it up himself? I am very suspicious of the push for https and the like. I feel it is mainly about hiding the payload from me not any third party.
yeswecatan 6y ago
I appreciate the article for bringing this to my attention. That being said, and maybe it's just my severe lack of knowledge around DNS, but I didn't walk away with a greater understanding of what is going on and how to fix it (outside of using pfSense). I'm using OpenWRT and created a guest network which I configured to use certain DNS servers. All of my smart devices are connected to it. How can I check that those devices are actually using the DNS servers assigned at the router level?
willcipriano 6y ago
> Smart devices manufacturers often “hard-code” in a public DNS server, like Google’s 8.8.8.8, and their devices ignore whatever DNS server is assigned by your router - such as your PiHole. Going to be a sad day for those advertisers when the DNS project gets killed by Google. Hopefully they are smart enough to set a alternate as well.
- willis936 6y ago
  I don’t understand the downvotes. Google has a long history of killing projects. Of all the public DNS to trust, why does anyone have confidence in Google? Because they’re big? Fool me once, shame on you. Fool me 1500 times...
  - xyst 6y ago
    https://killedbygoogle.com/ https://killedbygoogle.com/ Per this site that tracks dead google projects, thus far they are at 220.
  - beisner 6y ago
    There are two classes of Google products: ones that are small user applications, and ones that are core infrastructure internally and externally. As far as I know, only the former have a reputation for being EOLed. DNS is the latter. Google’s RSS reader was the former.
    - willis936 6y ago
      The future is uncertain. Google has a history of canceling services and gives no signs of changing their behavior. Even if they made public acknowledgments hand waving “oh it’s these services not those other ones”, why would I fee any better? Google needs to spend a lot of time building trust. They don’t have it.
      - beisner 6y ago
        Any service they have Enterprise contracts for they are extremely unlikely to shut down.
stiray 6y ago
(downvoters #1, what about telling me what you think is wrong with my post :) , I love to see that I am wrong at something as this teaches me new things) (downvoters #2: still cant understand why are you donvoting, explanations are vague - I dont care about karma, but do allow me to understand what you dont like/understand) It can probably ignore it, but it cant ignore my router forbidding all external dns communications except for it. And anyway, I am blocking all my "IoT" devices accessing internet or rather, every network communication is forbidden unless I explicitly allow it. And in this case it goes trough mitm transparent proxy where communication is examined and cut. I dislike dns based blocking anyway, it is a patch, not a solution. I prefer "owning" my communication. Not to mention I dont buy a toaster if it requires 3rd party servers and it is not rootable (my roborock is playing Sepultura while cleaning, I dont know how much time the "beeper" will but feels good. :D). Vote with your money (!), no one will protect you from your behavior but yourself and once you figure out that the device is ignoring your network rules, return it. Or soon all the devices will be like that. It is 2020. Peak of surveillance capitalism was ~5 years back. Why anyone would allow its devices freely roam the internet is beyond my understanding. aaomidi: Sure. Then I wont buy the device. It is that simple. That means "vote with your wallet". If this is the society that everyone wants I wont join it. And legislation is always on the side of capital. Have you seen this "shit"? https://ec.europa.eu/digital-single-market/en/news/proposal-regulation-european-data-governance-data-governance-act https://ec.europa.eu/digital-single-market/en/news/proposal-... GDPR havent even started to fly yet and the EU commission is already undermining it with help of industry ("think of the children"... eee.. or covid in this case). Voting with your wallet is the only option. And if people are incapable of doing it, I will just stop buying devices - they are just toys as I like to tinker but I have yet to find any device that is so useful that I cant live without, more or less they are leveled with toaster with internet connection. GekkePrutser: then you are living in wrong universe (and so do I). You cant help if people are oblivious to what is going on so use your time wisely and inform people. I have personally helped a lot of people to get rid of google and facebook adiction (even serving my own searx instance to them and hosting a few for free email). And the one that is making the hardware CANT change the stance if you dont allow the device to internet. Firmware was updated and this is not what you have bought (do you get the hint ;) ? ) so make the life of the seller a living hell. And if you are living in EU you surely can. CraneWorm: Nope. I wont buy such a device. Kiro: I dont use reply function as they are abusing it to take a revenge on non agreeable opinion (please DO something about it, if you sting one particular person - rust threads are a good example - they will downvote everything from you). Anyway I am provoking this debate as seems like people dont want to hear the facts. And they need to be heard - there is noone that will bother with legislation and they will fail at the end. The only solution is to educate normal people like they were educated to use firefox instead of internet explorer and later to use chrome instead of firefox (which was bad idea). Dahoon: Not really. If the device doesnt have access to the internet, no "dns over http*" will help it.
EvanAnderson 6y ago
Another step in the silly device manufacturer / device owner arms-race. As long as people keep rewarding device manufacturers who treat owners as tenants it will progress. I wish people would just stop buying this garbage. They won't, though-- they see the features but not the down-side. The next step will be hard-coded DoH server IPs. Sly owners will NAT those to a transparent MiTM proxy. Then device manufacturers will counter with certificate pinning for DoH. That will be "game over", and the device manufacturers win. (It'll be a double-win, actually. It will put a hard "expiration date" on the device's functionality when a link in the PKI chain expires.) I believe the owner of a device has right to control the device's network traffic (and, more generally, control of the code running on the device). Business models that rely on taking away an owner's control of their rightfully-purchased general purpose computing devices are really rental models and should be handled as such. I eschew these kinds of devices, use or create self-hosted solutions where I can, and just do without when I can't. It does make me a little sad that I can't get some of these cool "living in the future"-type devices, but I'd be sadder to have my home festooned with manufacturer-controlled surveillance and advertising delivery devices. I wish there was a way to convince the average non-technical person of the merits of owner control. Given the enthusiastic responses in favor of allowing device manufacturers to mistreat owners I see from the Hacker News community, though, even convincing technical people is a lost cause. It feels like most people really want to be subjugated. It doesn't seem ratioinal. I do recognize that the Hacker News community also includes some of the people who profit from subjugation of device owners. Their motivation seems rational (if not sociopathic).
- black3r 6y ago
  > It will put a hard "expiration date" on the device's functionality when a link in the PKI chain expires. If you're certificate pinning an IP address for use with your own software, you can just create a self-signed cert with expiration date set to 2999 or some commonly ridiculous date you don't expect your devices will live to.
  - wang_li 6y ago
    Why would they do that when they can force you to update your firmware by setting the expiration to a year or even less. This way you are guaranteed to be communicating with the mothership and the devices will incorporate any new malfeatures the manufacturer conceives.
CraneWorm 6y ago
Just don't buy smart TV, or any of that IoT crap. It is possible to buy 58 inch dumb TV, connect that to a machine you own.
- mojo982 6y ago
  Is it? I’m still holding onto my TV from 2014 because it doesn’t have “smart” functionality. Every time I look at new ones I can’t find good dumb ones.
  - tga 6y ago
    Aren’t all smart TVs dumb if you don’t connect them to the internet? I wouldn’t be surprised if manufacturers start selling TVs that need to be activated online before first use, but I don’t know of any that do that already.
    - dspillett 6y ago
      Mine quite happily works as a dumb TV without a connection, and I know many others who do the same. Though I hear stories of TVs being annoying to use without a connection (timing out waiting for a server response that can never come, before falling back to an ad free menu, or just constantly nagging, even while content is playing, about the lack of connectivity).
      - comprev 6y ago
        My 'smart' TV has no internet connection configured as I use a Chromecast for streaming services and beaming local content.
        Dahoon 6y ago
        That you know of.. Alexa auto-connects to other Alexa networks (like your neighbors). Some TVs have Alexa built-in. Bingo, telemetry.
choeger 6y ago
We need legislation against this kind of crap. It is only a matter of time until these "smart" devices share childporn or host darknet drug shops. Let's face it, the devs implementing these devices run a scrum process, features get stacked upon features and no one cares about, let alone understands the security of the whole tool stack. It is only a matter of time before we have a bot net of smart tvs and roombas. And network owners will be held responsible.
- dkdbejwi383 6y ago
  I wouldn't be surprised if such a thing already exists
x87678r 6y ago
I'm not sure if its worth posting, but I just installed pihole and its great. You dont actually need a pi, you can run it in docker. its nice that you can see all the dns queries that are happening.
- caymanjim 6y ago
  I think you meant to say that you don't actually need a Pi. It's unfortunate that they named it that way. Never name things after the technology involved in making them work, because if your thing is any good, it'll spread to other devices/languages/operating systems.
  - x87678r 6y ago
    You're right, I've corrected.
  - hutzlibu 6y ago
    Maybe they found the name to be funny?
- yeswecatan 6y ago
  Can you recommend a guide for setting it up on something like a mac?
  - x87678r 6y ago
    I dont know much about macs, but googling this looks like it should work for you. https://pawelurbanek.com/pihole-local-computer https://pawelurbanek.com/pihole-local-computer, though I'd try to use the official compose instead of his version on github. https://github.com/pi-hole/docker-pi-hole https://github.com/pi-hole/docker-pi-hole
jaimex2 6y ago
Honestly there is no scenario where your TV should have Internet access. Setup Kodi and you're done.
- sildur 6y ago
  What about Netflix? Can I have Netflix in Kodi (in a raspberry)? Honesty asking.
  - DarthGhandi 6y ago
    Yes you can. It can stream a bunch of things along with regular tv.
  - tyrion 6y ago
    Not sure about raspberry, but I use Kodi to watch Netflix all the time and it works well :) See: https://github.com/CastagnaIT/plugin.video.netflix https://github.com/CastagnaIT/plugin.video.netflix
    - summm 6y ago
      But no 4K, due to stupid DRM restrictions.
      - sildur 6y ago
        Yeah, I saw that. And then they wonder why people pirate movies...
  - jaimex2 6y ago
    Yep, hardware matters though. You need one that can work with the DRM.
- Angostura 6y ago
  Great. I've set up Kodi on my Mac. Of course, there's no way to get the content from my machine in the office, to the actual TV that I can see. So that doesn't really solve any problems. Unless you mean buy a separate box, put Kodi on it and attach that to the TV
imglorp 6y ago
Are we not going to talk about the TV uploading 60 mb/day?
nbzso 6y ago
In this point in time everything is compromised. It is a business function not user oriented design. If you affect the bottom line you actively making a statement in this. Don't buy smart IoT shit, don't buy new phones, don't use entertainment services. This is how you will make a difference. Waiting for legislation to remove corporate malpractice is absurd. Politicians are fighting who will get "retirement" benefits. The only voting mechanism in our disposal is money, voting with your money always counts.
- hutzlibu 6y ago
  Or support open hardware.
sgt 6y ago
Is there a way to avoid YouTube ads on a Smart TV with PiHole? Those ads are becoming more pervasive each month.
- kristofferR 6y ago
  Not with pi-hole, but on Android TV you can install ad-free clients like SmartTubeNext at least: https://github.com/yuliskov/SmartTubeNext https://github.com/yuliskov/SmartTubeNext
  - sgt 6y ago
    But that sounds like something that will eventually be stopped by YouTube.
- hanklazard 6y ago
  I don’t think so. The source of the ads is through YouTube servers as opposed to some separate ad network like on web pages.
2Gkashmiri 6y ago
Jio (India) is super obnoxious in the fact that their own router is locked down hard. Now you cant even change your DNS. I have suggested few people to bypass this limitation by removing the router as dhcp and using pihole for that. That works but don't know for how long. The pathetic thing is their router does not even allow bridging mode. Fuck jio.
- DarthGhandi 6y ago
  While not for the average consumer, most routers are easily jailbroken. They aren't locked to anywhere near the extent a mobile phone is.
  - 2Gkashmiri 6y ago
    https://www.reddit.com/r/india/comments/czl1f1/jio_fiber_router_is_security_nightmare/ https://www.reddit.com/r/india/comments/czl1f1/jio_fiber_rou...
- jacob019 6y ago
  You can always put your own router in front of the ISP provided crap, pretty common to have to do that.
  - 2Gkashmiri 6y ago
    Agreed. But that is another expense and essentially you are telling millions of people to buy a second device when the first one is capable of doing just that. Only the ISP has locked shit down. The idea should be to force ISPs to keep stuff open, unless the devices are junk and you definitely need a replacement. That is not the case here. Their router is pretty capable, they just want to control people. Thats bad
tux 6y ago
Thank you for the article! Very uselful! Most smart TVs have built in web browsers, you can also try website like https://www.dnsleaktest.com/ https://www.dnsleaktest.com/ to check your DNS.
datanut 6y ago
These shenanigans are exactly why Universal IPv6 only access still fails.
tsjq 6y ago
not long before every TV comes with a built-in SIM card and a whispernet-like arrangement . I hope computer monitors at 40-50inch size reach affordable prices.
- judge2020 6y ago
  https://www.amazon.com/Amazon-Sidewalk/b/?node=21328123011 https://www.amazon.com/Amazon-Sidewalk/b/?node=21328123011
  - tsjq 6y ago
    oops. this is not even a SIM card. can this be disabled? will the devices override user preference and still continue to communicate .
    - judge2020 6y ago
      If you have a device that tries to use sidewalk, you could put tinfoil around the device or desauter the bluetooth chip/900mhz radio (and hope the device works without them in there), but that's really it if these devices come out without a setting to disable sidewalk. If you have an Echo/sidewalk-capable device already, you can opt-out of allowing other devices to use your sidewalk in the Ring or Amazon app https://support.ring.com/hc/en-us/articles/360032524592-Opting-In-and-Out-of-Sidewalk https://support.ring.com/hc/en-us/articles/360032524592-Opti....
ksec 6y ago
May be we start detaching the Smart into a separate box, or basically buying a large Monitor? Is there such thing as 55" Monitor? The whole TV industry needs some new thinking and innovation. Right now it is race to the bottom and everyone is trying to get some extra revenues from Data gathering. There are also a huge oversupply from LCD panel maker.
- asutekku 6y ago
  That's why I have an Apple TV attached to a Television I have not connected to an internet ever.
  - Dahoon 6y ago
    >Apple TV You don't connect your TV but use Apple devices instead. Uhm... okay. You should see the IDS log I'm looking at here. Apple !== no telemetry. All you are doing is putting all your eggs in one basket.
    - albntomat0 6y ago
      An alternative view is that the parent commenter is being deliberate about which device(s) have access, and decided on Apple over whomever made the TV.
- grishka 6y ago
  I heard that you can buy a dumb 55" monitor if you call it digital signage. Though these things are expensive because they're made for businesses. Another option is to simply never give your smart TV any kind of network connection.
  - therealx 6y ago
    Sadly, some will look for other open wireless netorks and connect. In the future, I'm sure all will have a 5g connection.
    - 6y ago
bitlevel 6y ago
They appear to not be trustworthy to be on our networks - so we should: 1. Not join them to our networks 2. Stop buying 'Smart TV's' 3. Get panels and a smart box that you can control I'm lucky enough to be able to direct ALL DNS through my router first. Nothing gets out without my say so. Not everyone has that capability, sadly, with home routers. The solution provided by the OP is a solid one - another would be to purchase a decent router (such as a Mikrotik) and learn how to use it - much more powerful device for the same price, or sometimes lower, as a regular 'home' router.
- Dahoon 6y ago
  >I'm lucky enough to be able to direct ALL DNS through my router first Even DNS over HTTPS? Do you do packet inspection? Just blocking ports doesn't do much any more. I run an IDS/IPS and it blocks lots of DoH to Google. Apple devices are even worse.
  - sbarre 6y ago
    Would you mind sharing a bit more detail on your setup?
    - ianai 6y ago
      I’m interested too.
    - low_key 6y ago
      I'm not sure what the commenter's setup is, but I have one that (at least mostly) achieves the same thing. It is a combination of a few things: 1. Redirect all outbound DNS traffic to your own local DNS server (as described in the link in this post) 2. Return NXDOMAIN for well-known DoH domains [1] (as well as "use-application-dns.net" for well-behaving software like Firefox [2]) 3. Block traffic to well-known DoH providers by destination IP address [1] [1] https://github.com/bambenek/block-doh https://github.com/bambenek/block-doh [2] https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...
newscracker 6y ago
Getting people to add another device like a Pihole or a separate router with better filtering capabilities isn’t going to be an option that most people can handle by themselves. This solution would definitely not work for DNS Over HTTPS (DoH), which I’m guessing will soon become prevalent in many devices. It also seems like DNS Over TLS (DoT) isn’t going to get as much traction exactly because it’s easier to block. As other comments have said, (for those who’re able to do it) not configuring any connection for the device sounds like a good start, but even that has caveats about the device connecting to nearby open networks. So the best thing to do instead is to connect it to a network but not allow any communications to the Internet.
- WarOnPrivacy 6y ago
  >It also seems like DNS Over TLS (DoT) isn’t going to get as much traction exactly because it’s easier to block. DoT is upticking, albeit at a non-boosted rate. The number of servers supporting DoT has doubled in the US (as in from 3 to 6).
myrandomcomment 6y ago
2 steps: 1. Do not setup your TV, do not except EULA. 2. Get other setup, PC, AppleTV and use TV as dumb screen. Issue solved.
atum47 6y ago
I'm ditching my smart tv. I've disable it's wifi and put a raspberry pi with a external hard drive on it.
- guiambros 6y ago
  > I've disabled it's wifi and... For now. Wait until Amazon Sidewalk takes off. https://www.amazon.com/Amazon-Sidewalk/b?node=21328123011 https://www.amazon.com/Amazon-Sidewalk/b?node=21328123011
deleted 6y ago
[deleted]
stiltzkin 6y ago
Is PiHole the best all around solution for network filtering?, last i tried to setup one i did not find it user friendly.
- grawlinson 6y ago
  A few years ago, I tried using ansible to automate setup of PiHole. That did not go well because it's essentially a poorly coded hobby-level project. I've since switched to BIND (named) & it's fantastic implementation of DNZ RPZ[0]. [0]: https://dnsrpz.info/ https://dnsrpz.info/
  - mik3y 6y ago
    One of my incomplete-but-functional quarantine projects tries to tackle this "raspberry pi project" problem: How to reproducibly set up these community-maintained projects, with homebrew-like simplicity. https://github.com/berrypatch/berrypatch https://github.com/berrypatch/berrypatch (I guess I've reached the inevitable "build your own package manager" stage of one's hacking career..)
erentz 6y ago
I’m kind of surprised there isn’t an OpenWRT style project out there to provide a replacement OS for common Smart TVs. At least I couldn’t find one. I’m obviously lacking in understanding the massive difficulties such a project would likely face. But it sure would be very nice to be able to replace my TVs firmware with something open source. I don’t want a dongle or extra box or extra remote. There’s a perfectly good computer in my TV. And all the Roku’s or FireTVs are rubbish and intend to invade your privacy just the same.
- elsjaako 6y ago
  We've come to expect open replacements of everything, but even OpenWRT didn't start out as an open source project. Linksys used Linux on one of their routers, and was thus forced to release their modifications to the kernel for their device.
- solarkraft 6y ago
  I agree, it's also something I would like. I've looked a bit into this regarding Android TVs and found out that most TVs are using similar Amlogic chipsets. What made me give up on the search for alternative software is that there doesn't even seem to be a place in which any manufacturer's models are even listed, much less anything resembling a community.
- DaniloDias 6y ago
  Smart TVs have hardware backed security solutions to protect DRM keys. Anyone who undertakes your proposal is going to have problems staying ahead of any jailbreaking mitigations when the companies motivation for security is maintaining relationships with content service providers.
- deno 6y ago
  No one’s going to target DRM-locked & proprietary (custom motherboard & SOC) Smart TVs when you can get everything you want here (except extra box) targeting an Amlogic s905 or similar box with HDMI CEC[1] that anyone can get for less than 50 USD and is 4K capable and works with absolutely any TV. See: LibreELEC. Your “perfectly good computer” is in fact not yours (it has DRM so you are not the user, you are renting it), and it’s not perfectly good if it can’t run the software you want. [1] This let’s you get away with just one remote including for powering on/off
LeoPanthera 6y ago
I've always wondered why you couldn't resolve all the hostnames in the DNSBL of your choice into IPs, and then block packets to those IPs. Maybe some routers simply don't have that functionality but it seems pretty trivial for pfSense. Is there some reason why that's a terrible idea that I've overlooked?
amelius 6y ago
If you can spare the money, buy a Smart TV and send it to the FCC accompanied by a letter saying that you have no use for a TV that is invading your privacy and there are no alternatives on the market. If they get enough TVs, perhaps they will take action. (If you have less money to spare, buy the TV and return it to the manufacturer for a refund, make sure you state the reason.)
- ozaark 6y ago
  FCC doesn't seem to be on consumer side - at least until Pai and his ilk are out unfortunately. They showed that with NN repeal despite mass public disapproval.
Havoc 6y ago
Will they respect a gateway setting on a router though?
- Spivak 6y ago
  You don’t really get a choice on that. If you try to throw packets at something not the gateway they likely won’t go anywhere.
brandonr49 6y ago
Is there a reason no group has popped up to jailbreak the few major TV "OSes"? Given how prevalant this issue is it seems like a reasonable use of time akin to jailbreaking/rooting cell phones.
- verisimilidude 6y ago
  I imagine most people capable of rooting a TV would already have better alternatives at hand: an Apple TV, an Nvidia Shield, a PlayStation, etc. There’s not much daily incentive to tinker.
  - ant6n 6y ago
    All of these still require a Display.
    - judge2020 6y ago
      And the respective TVs work without internet - the only possible attack vector (by the manufacturers) is if they start trying to connect to random unprotected wifi networks, or god forbid the Amazon Sidewalk network[0]. 0: https://www.amazon.com/Amazon-Sidewalk/b/?node=21328123011 https://www.amazon.com/Amazon-Sidewalk/b/?node=21328123011
    - verisimilidude 6y ago
      Personal example. I already have an nVidia Shield. It works out of the box, it's nice, and it already does everything I want. Even if I jailbroke my TV's smartness, then said TV's smartness probably still wouldn't work as well as the Shield. And if the Shield ever messes with me, I can just replace it with a Roku or AppleTV or Chromecast or whatever. There's just no strong motivation to try to root my TV. I don't like my smart TV but I don't need to, because the smart parts can be "replaced" by any number of external devices. My point is that I suspect many would-be TV hackers are in the same happy situation.
xurukefi 6y ago
I always found it puzzling that DNS blacklisting for adblocking purposes works at all. I mean I'm not a webdev or anything like that, so what I'm saying might be a bit native, but couldn't you simply serve your ads using the same domain you use for your content? This immediately defeats things like PiHole completely.
- scrps 6y ago
  Sadly that is already happening, luckily there are ways to defeat cname cloaking. https://blog.apnic.net/2020/08/04/characterizing-cname-cloaking-based-tracking/ https://blog.apnic.net/2020/08/04/characterizing-cname-cloak...
  - judge2020 6y ago
    This has been happening for a century with first-party advertisements and "sponsored content" that is baked into the content being consumed.
- Ekaros 6y ago
  To me it really sounds like trivial to serve adds from exactly the same address and even full URL as the content. Then again maybe adblocking isn't yet having such big effect that companies want to do that.
  - ev1 6y ago
    There's no honour among thieves and whatnot; advertisers do not trust publishers to report data or log impressions truthfully without money-signs-on-bags running away with stolen money. Which, honestly, will 100% happen, considering the sheer amount of weird "adsense click fraud rings" you can find on the shitty, awful part of the internet, like SEO forums.
- ufmace 6y ago
  It's related to how the internet ad market has evolved. Initially, sites would run their advertising side kind of like newspapers do - have in-house departments to sell ads directly to the companies that want to advertise, then place the ads on their pages manually and serve them from the same servers. It works, but it's a ton of overhead to have all those ad sales people and find companies one at a time willing to set up a direct relationship with your site and deal with direct billing etc. It was kind of a revolution to set up these advertising middlemen. Site owners just sign up to show ads and set up their site to load an ad from the ad company's server. Advertisers buy their ad time from the middlemen too. Nobody has to maintain those high-overhead direct relationships. Huge boon for the little-guy sites on both sides. That's the good part. There's plenty of bad parts too, including monopolization of the market, abuse, poor behavior of anti-abuse mechanisms, etc. It's what we've got though, until somebody comes up with something better.
wishinghand 6y ago
Not a smart TV, but the Youtube app on my Playstation 4 and iPhone. I never see an ad on Youtube when on Firefox with Pihole and uBlock Origin, but almost every video will have a preceding ad and then more if it's longer than 4-5 minutes on non-PC platforms.
WarOnPrivacy 6y ago
>Fortunately, with a few simple firewall rules, you can intercept these hardcoded DNS queries and redirect them to your PiHole. These instructions are for pfSense I can see running pihole instead of a pfSense+pfBlocker rig. But if you've already got pfSesne at the edge, why not just polish it off with pfBlocker/DNSBL instead of erecting a separate pihole machine?
- muststopmyths 6y ago
  I have pfsense with pfblockerng/dnsbl and it lets in way more ads than pihole. I could be doing something wrong, but I have no idea what.
  - WarOnPrivacy 6y ago
    Likely somewhere in the lists. IIRC, we can use pihole lists with DNSBL. That should add full pihole blocking to DNSBL.
swiley 6y ago
At this point I don't want things with nonfree firmware in my house.
- loraa 6y ago
  You have that choice,but probably not for the price you want. People want the cheapest things and then wonder why they're not the most feature packed with 24/7 American tech support.
- zbrozek 6y ago
  Nice sentiment, but hard to deliver. You have a dishwasher and a fridge, right? They've been running firmware you don't get to inspect for a couple of decades already. Luckily they don't have network access.
  - bigbubba 6y ago
    How many years is 'decades'? About 4 or 5 years ago I took apart a freezer that was about 10 years old. The compressor seemed to be switched by a thermostat; I found nothing that would have firmware.
    - rovr138 6y ago
      That freezer is 1.5 decades.
      - bigbubba 6y ago
        Yes, and wouldn't really surprise me if freezers with the same design can still be found in stores today.
        fingerlocks 6y ago
        They can, but they will lack features like vacation mode, cleaning mode, fault sensors, and door ajar audio notification.
supertrope 6y ago
Hard coding DNS removes a troubleshooting variable and decreases customer support load and return rates. Some ISPs hijack DNS to serve up search ads (when it’s not down or slow). Some routers are part of botnets so DNS is not to be trusted.
- ecf 6y ago
  Perhaps companies should hire more talented customer service representatives who have a technical background instead of continuing to make their products shittier.
  - zeta0134 6y ago
    Having worked in this kind of customer support, the issue isn't that technician doesn't understand DNS, but rather that the end user frequently hadn't even heard of it. It's a massive pain to troubleshoot something like that remotely when the caller is non-technical. Not impossible of course, but frustrating and requiring a great deal of patience on both ends.
    - zbrozek 6y ago
      I'm sure that's quite common, but so is the reverse. Almost universally, CSRs have no idea how the product works or have any technical knowledge whatsoever.
    - kevingadd 6y ago
      Also, if their ISP-provided router got owned by a virus and is now part of a botnet, how is the end user going to fix that? Many of those devices are locked down. It may not be a problem they can solve without manually configuring every device to use 8.8.8.8, so now every device needs to have a full flow for configuring its DNS servers. I'm personally in favor of every device having that option but it's also the case that the vast majority of people will not benefit from their TVs and lightbulbs having customizable DNS.
  - loraa 6y ago
    It's hard when you buy the cheapest product you can get and wonder why it can't compare to the most expensive products from the best brands.
williesleg 6y ago
When do I get to own my data?
quaffapint 6y ago
My TLC Roku TV definitely is using my PiHole. I can see the ridiculous number of requests to roku that I have to block which really skews my stats.
sys_64738 6y ago
These smart TVs sound pretty dumb.
- TwoNineA 6y ago
  Maybe they don't want you to block spying/ads on them.
- kstrauser 6y ago
  I prefer the term “sly”. They’re clever, but not in ways that benefit me.
freedomben 6y ago
I use a standard CentOS box to serve local DNS and act as my gateway router. I'm pretty familiar with basic firewalld configurations but I'd love to see some instructions for doing this with firewalld. Does anyone know of such a thing?
Bud 6y ago
This isn't difficult: TVs should not be "smart". TVs should be incredibly dumb. They should be screens for displaying stuff. That's it. Nothing else. No network connection of any kind, no apps, no software beyond that necessary to do basic setup of how that screen works: brightness, input selection, etc.
- stingraycharles 6y ago
  I own several smart TVs but use none of the smart functionality. They don’t even have internet. TV makers are horrible software developers, for the same reasons that mobile manufacturers were horrible mobile OS developers until Android came along. We have similar solutions for televisions in the form of Apple TV and Chromecast. I honestly feel I’m wasting my money when I’m buying a smart TV these days, but you just narrow your choice so much if you only look for dumb phones, you’re almost forced into buying one.
  - 8ytecoder 6y ago
    Both LG webOS and Sony Android TV come across as polished. If not for the fact that I hate advertisement and tracking with a vengeance, I'd gladly use them.
    - RedComet 6y ago
      Yeah, the latest Android TV (Sony) update has ads at the top of the screen that you can't disable.
    - Bud 6y ago
      Will they come across as polished in 10 years, when they haven't had an update in 9 years, and yet the TV itself is still perfectly useful? I doubt it.
  - 1stranger 6y ago
    I'm surprised to say but the latest Samsung interface and remote is quite good. Good enough I feel no need to put an Apple TV on it (which happens to have an awful remote).
adriancr 6y ago
If I use a pihole then Samsung TVs will use 8.8.8.8 as backup (even if not configured) I had to firewall all dns requests as well... I assume in the future they will put DNS over https and it will be harder to block - at which point a Linux media player and tv disconnected will make sense... Doing this because of their crappy spying - sending frames of video to identify what you are playing.
- wirthjason 6y ago
  FYI - This article was linked in another HN post about smart TVs ignoring PiHole. See the original article about how to make sure the TV follows your PiHole. “Your Smart TV is probably ignoring your PiHole” https://news.ycombinator.com/item?id=25313776 https://news.ycombinator.com/item?id=25313776
jeffbee 6y ago
I'm pretty surprised that Google (YouTube, presumably) is so much more represented in the flow census than Netflix. I thought Netflix would have been bigger.
pmalynin 6y ago
It is not. My network is configured to block DNS traffic from anything that isn’t the PiHole. Tbh, when I saw how much traffic the TV was spewing out I just blackholed it all together.
ChuckMcM 6y ago
I read this and yeah, pretty much. Its nice though because I can black hole their DNS lookups in my Pi-Hole and keep my TV from reporting on what it does. The only tricky part was having the 'firmware update page' (which was an HTTP! request) to return 200 OK so it won't complain about firmware.
bborud 6y ago
I'm probably going to get downvoted for this, but I couldn't help but note that 16 year old me would have been utterly baffled (and intrigued) by that headline. Read it out loud a few times and imagine yourself in the VHS era.
Abishek_Muthian 6y ago
Smartphones too! OnePlus hardcodes Google DNS as secondary DNS & I'm sure many others do it too[1] . Forcing DNS requests to Pi Hole is the easiest option to defeat this. [1] https://www.reddit.com/r/oneplus/comments/e0htyg/remove_google_dns_on_wifi/ https://www.reddit.com/r/oneplus/comments/e0htyg/remove_goog...
- kiwijamo 6y ago
  Is this an Android-wide thing or really specific to OnePlus?
  - Abishek_Muthian 6y ago
    There's a mention of Google telling that this was not their doing in a thread somewhere about this.
leshenka 6y ago
Can you just set up your router to forward all dns requests that originate from LAN to pihole (excluding pihole itself)? Wanna use 8.8.8.8? Too bad!
mmglr 6y ago
If I understand correctly using "Nat Rule 1" a network can be configured to ignore my choice of dns server while my device is on their network? What is the mitigation of this? DNSSEC or DNS over HTTPS or DNS over TLS?
- tptacek 6y ago
  DNSSEC does nothing to address NAT interception of DNS, but DoH does: your network can't spoof a TLS certificate for your chosen DoH recurser (though, with some effort, they can just block you from the network if you don't comply with their DNS policy).
samgranieri 6y ago
Time to setup a pihole and experiment with vyatta config settings on my Ubiquiti security gateway. This will be fun
ThePhysicist 6y ago
I haven't been able to verify this yet but I think my (2015) Samsung SmartTV tries to ping a specific Samsung domain to determine whether the device is connected to the Internet. Last weekend something must've happend to that domain because the TV told me it wasn't connected to the Internet and refused to start any app. The Internet connection (as well as the local Wifi connection), however, was perfectly fine. So I expect the device (at least the "smart" functionality) to be bricked as soon as Samsung takes that domain down for good. In fact Samsung already removed 80 % of the gimmicks and remote features the TV came with, some of them didn't even last two years.
- oh_sigh 6y ago
  The worst part is that there isn't just a couple super popular models of TVs that people could develop custom firmwares for, there are thousands of skus for televisions and each of them may behave in a different manner meaning that at their end of life it is unlikely that any group is going to go through the effort to free them from death.
  - ThePhysicist 6y ago
    Yeah it's annoying. But at least they still have a normal HDMI input, so I could still buy a smart TV stick to plug into that (or use a laptop). That seems more and more attractive as well since after a recent software update my TV now takes around a minute to boot to its smart OS, I suspect because the old hardware can't keep up with the new software.
    - tylergetsay 6y ago
      And with CEC you can control the TV, I particularly like my scripts to turn off the TV's when I leave.
      - octoberfranklin 6y ago
        It really sucks that most GPUs don't have CEC. Even the high-end ones. The price for CEC-USB dongles is outrageous too.
syntaxing 6y ago
Do DNS have a specific protocol? Is it possible to block any DNS query on my network that doesn’t ask my pihole?
- rovr138 6y ago
  Look at the link here https://news.ycombinator.com/item?id=25313776 https://news.ycombinator.com/item?id=25313776 More specifically, https://labzilla.io/blog/force-dns-pihole#force-all-dns-queries-through-pihole https://labzilla.io/blog/force-dns-pihole#force-all-dns-quer...
- gruez 6y ago
  >Is it possible to block any DNS query on my network that doesn’t ask my pihole? ...until they force all dns requests through DoH.
- 1over137 6y ago
  DNS is on port 53. So block outgoing port 53 except to your own DNS server. Likewise for DNS Over TLS (DoT), on port 853. The problem is DoH, which uses the same port as https (443) and so is harder to block.
jms703 6y ago
I'd be fine with hardcoded DNS if the devices would fail back to DHCP provided DNS. Then I can just block certain destination IP address. But a NAT redirect is working fine for now.
BooneJS 6y ago
I connected my LG B9 to wireless so I could get firmware updates to enable new framerates for PS5 games that support it. Then I disconnected it again.
jancsika 6y ago
Any reviews of the (beta) ad blocking that comes with raspap, esp. with regard to this?
twblalock 6y ago
I highly recommend that anyone who buys IoT devices, including smart TVs, gets a router or access point that supports multiple SSIDs and VLANS. You can segregate your IoT devices from the rest of your stuff. You can even give a VLAN per device if you really want to, although it's probably not worth the effort. I have 3 VLANs: one for my home network where my computers are, one for my security system, and one for the rest of my IoT devices. I don't even trust my Roomba on my home network! I have a Unifi Dream Machine, but there are a few other consumer products that can achieve this kind of setup. If you have basic knowledge of how to use a computer, you can follow some YouTube tutorials about how to set up VLANs and firewall most of your devices from reaching your home computers.
nicolas_t 6y ago
Is there a list of which game console hardcode DNS settings? I know that the nintendo switch doesn't but I'm curious of the exact devices...
Fiahil 6y ago
I wish I could set a DNS redirect, however I have a Netgear router and the only option I know would be to install a custom router firmware. That's not something I have already done. Does someone have a good walkthrough and recommendations on the choice of firmware ?
- bigphishy 6y ago
  Well the first step would be to decide which router software you would like to use. There are a number of feature rich and secure opensource router software to choose from DDWRT/VyOS/pfsense etc. I would recommend pfsense. Once you choose your preferred OS, search online for some tutorials on stackoverflow. Alternatively, you can always stick a firewall in between your home network and your netgear, and do your filtering on that.
- milofeynman 6y ago
  I have the masquerade and other rules setup on a ubiquiti edgerouter that eats anything trying to go out on port 53 and sends it to pihole. My experience has been one of annoyance when the DNS server breaks randomly or after a power outage it can be a pain of resetting VMs occasionally. But 99% of the time it works well and I'm glad I did it. However DNS over HTTPS is going to kill this method.
zxcvbn4038 6y ago
I bought a new TV for the first time in fourty years and never considered the “smart” TV aspects - I was just focused on image quality and number of inputs. In the end I picked out an LG tv which had a great picture - but it’s app support really sucks if you want something more then Netflix and Hulu. I ended up getting a Fire stick and an Apple TV to go with it so I can access content. If I did it all again I wouldn’t even bother setting up the networking for the TV - it’s just one more vector for advertising - and just plan on having the other devices day one. They are updated much more frequently and get the streaming apps that nobody bothers to develop for the TV itself. Downloading firmware updates for the TV takes hours. I’m pretty sure the server is under somebody’s desk and every LG tv in the world hits it at once so the throughput is bytes per second - they should use an S3 bucket or something instead.
- xxpor 6y ago
  LG and Samsung both have nasty habits of hosting their downloads in South Korea, where while their internet connectivity within the country is amazing, their access to the outside leaves a lot to be desired. They're in a tough spot to serve geographically since they're effectively an island and the closest big country (China) isn't somewhere you'd want to have your cables going though. My understanding is IIRC they largely connect to Japan and perhaps Singapore. But yeah, if they just used a CDN this wouldn't be an issue.
1vuio0pswjnm7 6y ago
"Nearly 70% of smart TVs and 46% of game consoles were found to contain hardcoded DNS settings - allowing them to simply ignore your local network's DNS server entirely. " To be fair, Pi-Hole hardcodes "default" (suggested) DNS settings, too. While the user can change defaults, it is well-known that in most cases, the majority of users do not change them. curl -s https://raw.githubusercontent.com/pi-hole/pi-hole/master/automated%20install/basic-install.sh |grep -C3 8\.8\.[48]\.[48] IMO, the best DNS-based solution for controlling the HTTP requests that applications can successfully make, e.g., to ad servers/trackers, is not to point them (directly or indirectly) at third party DNS caches. Sending the user's DNS queries to an online ad services company (Google) is a interesting default for a project whose raison d'etre is the existence online ads. Perhaps if the online ads industry began to fade, so too would the need for Pi-Hole. After decades of running own root and other authoritative servers on localhost, I would still do it even if online ads were not a problem. I like the speed, reliability and control.
mataug 6y ago
This is precisely the reason I do not connect my TV to my home network. I use a AppleTV for streaming content. Once in a while I check the manufacturer's page, and if there's a firmware update, I factory reset my TV to remove any cached info about my usage, and then update the firmware via ethernet, and immediately remove it from the network. A while ago I noticed that my old Insignia TV refused to use the pi-hole connected to my network, and it was constantly phoning home, that's when I decided that I'm never connecting a TV to the network. Thankfully I've been able to confirm that the Apple TV does not bypass my pi-hole, since it doesn't load anything when the pi-hole is down. I know at some point I need to trust some entities with my data. I prefer choosing those entities to the best of my ability, rather than leaving that choice upto my TV manufacturer.
- seandoe 6y ago
  Yea, I just use my tv like a monitor for a Linux box I have in the living room. I like the bluetooth keyboard with track pad a lot better than any remote clicker. We use vlc and a browser for all our video entertainment. It's nice to have all sorts of desktop apps as well... Spotify, transmission, etc.
  - mataug 6y ago
    I tried that, but everyone besides me found the interface annoying to use, they preferred the Smart TV's slow and crappy UI over a computer desktop. So the AppleTV has been a nice compromise, plus support for various media formats such as Dolby Vision, and HDMI-CEC are really nice to have.
- divbzero 6y ago
  Keeping the TV disconnected from the network is a good idea, and using it as a dumb disconnected screen could mean that those firmware updates aren’t critical anyway.
  - mataug 6y ago
    Sometimes firmware updates fix bugs in the TV's OS, which can improve the user experience. https://www.forbes.com/sites/johnarcher/2018/02/14/lg-oled-tvs-receive-dolby-vision-bug-fix-or-at-least-some-do/?sh=52c59a933516 https://www.forbes.com/sites/johnarcher/2018/02/14/lg-oled-t... You're correct in general though, I'm not worried about security flaws on the TV.
k4rli 6y ago
Where does this 72% come from? Is there a list of TVs which behave like this?
dghughes 6y ago
This is the exact situation I ran into trying to block ads with a pihole on a Samsung smart TV. The ads were very specific highly localized to my small province. Not something that could be random or generic. I thought I was doing something wrong since the TV absolutely refused to accept the DNS settings I was inputting.
Nacdor 6y ago
Why did the HN mods arbitrarily change the title of this article? It's not the correct title and it's harder for the uninformed user to understand. If you told me about hard-coded DNS settings I would say "Ok, what does that mean and why does it matter?". If you said "Smart TVs ignore piholes" (the original title) I would know exactly why that's important.
- recursive 6y ago
  The new title seems more descriptive to me. How many people know what a pihole is, but not DNS? I understand DNS a lot better than pihole, which I've barely heard of.
  - Nacdor 6y ago
    I see pihole recommended constantly as a way to block ads. > I understand DNS a lot better than pihole Unless the mods did a survey this doesn't justify the title change. It's just as likely that more people are familiar with pihole than DNS, and if the mods don't know (which they don't) then they should leave the title as the author wrote it.
cynoclast 6y ago
It's not a "Smart TV" it's a dumb computer that spies on you.
OJFord 6y ago
I use OpenWRT, (not pfSense as in TFA) struggle with both its UI and `iptables`, but I figured it out eventually... In case it's of use to anyone else: pihole_addr='YOUR.IP.GOES.HERE' for p in tcp udp; do iptables -t nat -A prerouting_lan_rule -p "$p" ! --source "$pihole_addr" ! --destination "$pihole_addr" --dport 53 -j DNAT --to "$pihole_addr" done in http://openwrt.lan/cgi-bin/luci/admin/network/firewall/custom http://openwrt.lan/cgi-bin/luci/admin/network/firewall/custo..., or whatever file it saves to, /etc/firewall/something I think.
oars 6y ago
Will redirecting all DNS as described in the article work if the Smart TV is using DNS over HTTPS?
tiew9Vii 6y ago
DoH is unfortunate. I run my own custom openbsd router and use IP masquading to re-route any traffic on port 53 to my local dns server. My local server does caching, ad blocking, DoH resolution. Obviously with applications using their own DoH resolution this breaks as my local dns server gets bypassed. Any application ignoring dns in a dhcp lease are bad net citizens unless the app gives the option to explicitly turn this on or off. It’s also planed obsolescence, what happens when the hard coded dns servers get turned off? Everything just breaks.
fartcannon 6y ago
I recently bought a dumb TV (Proscan something or other, 4K) where I watch Netflix, Prime Video, Youtube and Crave TV in a modified version of Chromium (https://blog.vpetkov.net/ https://blog.vpetkov.net/) on a Raspberry Pi 4. Additionally I stream my Steam Library using the Steam Link deb in the raspbian repos and a set of Steam Controllers via the dongle (the SC bluetooth connection kinda sucks on the RPI4) For best perforance, use a wired ethernet connection, and a bluetooth dongle for your non-Steam controllers and bluetooth headset. Works flawlessly and it's a delight to have a full Linux distro on my TV.
aquaticsunset 6y ago
Strangely enough, my 2018 Samsung TV honors my LAN's DNS preference (set to an internal IP for pihole). It breaks app and system updates, but that's an okay price to pay :)
piracy1 6y ago
That is how linux works by default...
octoberfranklin 6y ago
Routers just need to treat packets to 8.8.8.8 as "send this to the DNS server". Seriously. IPv4=8.8.8.8 means "this goes to the DNS server". The DNS server helps you find all the other IP addresses you need, which is why this one is special. One DNAT rule, one SNAT rule, and you're done. IMO IP should have had this feature from day one.
BorisMelnik 6y ago
on a separate note I think smart TV's are either going to completely die or a massive operating system consolidation is about to happen. I work with a lot of consumers directly and so many of them just hate their smart TVs and opt to use a roku/fire stick/apple TV instead. add to that most major cable providers have so many streaming services baked into their own cablebox OS and there is a lot of redundancy.
herbst 6y ago
For anyone who too hates the software of his smart tv. Get a pi and kodi to experience the freedom some of us are used too.
qwerty456127 6y ago
Every person who cares about their privacy, should run a real firewall (NAT is not a firewall, DNS/hosts is not a firewall either) to control everything what goes in and out of their home network. Unfortunately packet filtering is considerably obscure and most of the people (including most of the programmers and other techies who don't specialize in network administration) are afraid of approaching it.
adikhan01 6y ago
Before going with the conspiratorial take note that Mozilla shipped DoH early and both Microsoft and Apple implemented it. Untrustworthy ISPs are a real problem even if Google deservedly gets suspicion about their motives. This isn’t another
adikhan01 6y ago
What DNS do you hardcode? Google's? Or do you advice the use to set it up himself?
shr00by 6y ago
This is a great article! I am wondering how to test this nslookup command with my smart TV. Has anyone got this working with a Unifi Security Gateway (USG3)?

546 points by boramalper 6y ago

AntiImperialist 6y ago

Looks like you meant to share this: https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole

giuliomagnifico 6y ago
Oh yes sorry. I haven’t noticed it, don’t know what url I copied in my clipboard.
- dgl 6y ago
  Looks like it wasn't your fault, the page has: <link rel="canonical" href="https://0.0.0.0:4000/blog/force-dns-pihole https://0.0.0.0:4000/blog/force-dns-pihole"> So some "Share" buttons may pick that up.
  - giuliomagnifico 6y ago
    This is what happened! Because I posted it from my phone via share button! Thanks for the investigation :-)

kowlo 6y ago

How did this make it to the front-page with 11 points by linking to "https://0.0.0.0:4000/blog/force-dns-pihole https://0.0.0.0:4000/blog/force-dns-pihole"? Do most people just vote based on the title?

sorenjan 6y ago
I was wondering the same thing. It's at #4 on my front page at the moment, and the link obviously doesn't work.
OCISLY 6y ago
Yes, that's open secret of hn and reddit. Only small fraction actually reads articles.
Kiro 6y ago
I would presume most upvotes on most articles come from people just voting on the title.
holyDictionary 6y ago
To be fair, the article is correctly linked in the comments
st_goliath 6y ago
The title says something about the PiHole and the link is to 0.0.0.0. And it made it to the front page. Maybe we count this one as an art performance?
- deleted 6y ago
  [deleted]

noname120 6y ago

> some of these devices are using a sneaky tactic to bypass your PiHole entirely I don't think that it's malevolent on their part. Lots of ISP DNS are crappy. Hardcoding a reasonably reliable one saves them a lot of frustration and unnecessary technical support.

ugexe 6y ago
So if every single piece of hardware or software followed this one crazy trick the world would be better because some people at a tech company wouldn’t have to field as many support questions?
- fingerlocks 6y ago
  Yes, support is supremely expensive. This is especially true in the hardware IoT space under discussion. Some large fraction of any semi-successful hardware company will exist to field a constant onslaught of support emails, handling returns, warranties, and social media. It’s a big money sink. Margins are already razor thin in hardware, so yeah anything that can be done to reduce your support costs is welcomed.
  - GekkePrutser 6y ago
    I worked in support a long time and yes it's expensive. A few support cases will destroy your margin on a product sold. However, these IoT companies add these features mainly to benefit from selling the acquired data. The users are not asking for this. They're making it difficult for themselves.
  - wang_li 6y ago
    > Yes, support is supremely expensive. I agree. I have support costs too. Which is why every company that sells a product with a hard coded DNS server configured but doesn't advertise said aspect prominently in all advertising, so I can know to avoid their intentionally defective product, should pay me $10000 for the time I wasted buying their product, discovering their product is secretly and intentionally broken, and then return their product.

jon-wood 6y ago

I’m responsible for a bunch of IoT hardware, and every firmware spec I write includes a note on not using the DNS servers provided via DHCP. While sure there are companies explicitly doing this to avoid filtering, at least in my case it’s because a significant proportion of DHCP servers are configured to send DNS to your ISP, and ISP provided DNS is almost universally terrible. They’ll ignore TTLs, rewrite NXDOMAIN responses into the IP address of their ad-laced web search, and occasionally just highjack every single query to send you to a page saying you’re approaching your bandwidth quota. In the face of that sort of behaviour you inevitably end up with technical support having to field angry customers who just don’t get that it’s not our fault the hardware isn’t working, and the response to that is hardcoding a set of known good DNS servers which we can rely on. Please, if you have a Pihole, redirect all DNS through it as described in the article. Just be aware DNS over HTTPS is a thing now, and while the devices I’m responsible for aren’t going to try and evade your redirects, the companies that are trying to make sure ads get delivered will absolutely switch to DoH which will be much more difficult to work around.

foxtrottbravo 6y ago
Wow, thanks for breaking established standards then...
- Avamander 6y ago
  Go beat your ISP first.
intricatedetail 6y ago
There is no justification for bypassing users network settings, and especially doing it for your own convenience. At very least it should be opt in. If you want to violate customer privacy to save money on support, then I don't know why this is worth even discussing.
rightbyte 6y ago
What DNS do you hardcode? Google's? Or do you advice the use to set it up himself? I am very suspicious of the push for https and the like. I feel it is mainly about hiding the payload from me not any third party.

yeswecatan 6y ago

I appreciate the article for bringing this to my attention. That being said, and maybe it's just my severe lack of knowledge around DNS, but I didn't walk away with a greater understanding of what is going on and how to fix it (outside of using pfSense). I'm using OpenWRT and created a guest network which I configured to use certain DNS servers. All of my smart devices are connected to it. How can I check that those devices are actually using the DNS servers assigned at the router level?

willcipriano 6y ago

> Smart devices manufacturers often “hard-code” in a public DNS server, like Google’s 8.8.8.8, and their devices ignore whatever DNS server is assigned by your router - such as your PiHole. Going to be a sad day for those advertisers when the DNS project gets killed by Google. Hopefully they are smart enough to set a alternate as well.

willis936 6y ago
I don’t understand the downvotes. Google has a long history of killing projects. Of all the public DNS to trust, why does anyone have confidence in Google? Because they’re big? Fool me once, shame on you. Fool me 1500 times...
- xyst 6y ago
  https://killedbygoogle.com/ https://killedbygoogle.com/ Per this site that tracks dead google projects, thus far they are at 220.
- beisner 6y ago
  There are two classes of Google products: ones that are small user applications, and ones that are core infrastructure internally and externally. As far as I know, only the former have a reputation for being EOLed. DNS is the latter. Google’s RSS reader was the former.
  - willis936 6y ago
    The future is uncertain. Google has a history of canceling services and gives no signs of changing their behavior. Even if they made public acknowledgments hand waving “oh it’s these services not those other ones”, why would I fee any better? Google needs to spend a lot of time building trust. They don’t have it.
    - beisner 6y ago
      Any service they have Enterprise contracts for they are extremely unlikely to shut down.

stiray 6y ago

(downvoters #1, what about telling me what you think is wrong with my post :) , I love to see that I am wrong at something as this teaches me new things) (downvoters #2: still cant understand why are you donvoting, explanations are vague - I dont care about karma, but do allow me to understand what you dont like/understand) It can probably ignore it, but it cant ignore my router forbidding all external dns communications except for it. And anyway, I am blocking all my "IoT" devices accessing internet or rather, every network communication is forbidden unless I explicitly allow it. And in this case it goes trough mitm transparent proxy where communication is examined and cut. I dislike dns based blocking anyway, it is a patch, not a solution. I prefer "owning" my communication. Not to mention I dont buy a toaster if it requires 3rd party servers and it is not rootable (my roborock is playing Sepultura while cleaning, I dont know how much time the "beeper" will but feels good. :D). Vote with your money (!), no one will protect you from your behavior but yourself and once you figure out that the device is ignoring your network rules, return it. Or soon all the devices will be like that. It is 2020. Peak of surveillance capitalism was ~5 years back. Why anyone would allow its devices freely roam the internet is beyond my understanding. aaomidi: Sure. Then I wont buy the device. It is that simple. That means "vote with your wallet". If this is the society that everyone wants I wont join it. And legislation is always on the side of capital. Have you seen this "shit"? https://ec.europa.eu/digital-single-market/en/news/proposal-regulation-european-data-governance-data-governance-act https://ec.europa.eu/digital-single-market/en/news/proposal-... GDPR havent even started to fly yet and the EU commission is already undermining it with help of industry ("think of the children"... eee.. or covid in this case). Voting with your wallet is the only option. And if people are incapable of doing it, I will just stop buying devices - they are just toys as I like to tinker but I have yet to find any device that is so useful that I cant live without, more or less they are leveled with toaster with internet connection. GekkePrutser: then you are living in wrong universe (and so do I). You cant help if people are oblivious to what is going on so use your time wisely and inform people. I have personally helped a lot of people to get rid of google and facebook adiction (even serving my own searx instance to them and hosting a few for free email). And the one that is making the hardware CANT change the stance if you dont allow the device to internet. Firmware was updated and this is not what you have bought (do you get the hint ;) ? ) so make the life of the seller a living hell. And if you are living in EU you surely can. CraneWorm: Nope. I wont buy such a device. Kiro: I dont use reply function as they are abusing it to take a revenge on non agreeable opinion (please DO something about it, if you sting one particular person - rust threads are a good example - they will downvote everything from you). Anyway I am provoking this debate as seems like people dont want to hear the facts. And they need to be heard - there is noone that will bother with legislation and they will fail at the end. The only solution is to educate normal people like they were educated to use firefox instead of internet explorer and later to use chrome instead of firefox (which was bad idea). Dahoon: Not really. If the device doesnt have access to the internet, no "dns over http*" will help it.

EvanAnderson 6y ago

Another step in the silly device manufacturer / device owner arms-race. As long as people keep rewarding device manufacturers who treat owners as tenants it will progress. I wish people would just stop buying this garbage. They won't, though-- they see the features but not the down-side. The next step will be hard-coded DoH server IPs. Sly owners will NAT those to a transparent MiTM proxy. Then device manufacturers will counter with certificate pinning for DoH. That will be "game over", and the device manufacturers win. (It'll be a double-win, actually. It will put a hard "expiration date" on the device's functionality when a link in the PKI chain expires.) I believe the owner of a device has right to control the device's network traffic (and, more generally, control of the code running on the device). Business models that rely on taking away an owner's control of their rightfully-purchased general purpose computing devices are really rental models and should be handled as such. I eschew these kinds of devices, use or create self-hosted solutions where I can, and just do without when I can't. It does make me a little sad that I can't get some of these cool "living in the future"-type devices, but I'd be sadder to have my home festooned with manufacturer-controlled surveillance and advertising delivery devices. I wish there was a way to convince the average non-technical person of the merits of owner control. Given the enthusiastic responses in favor of allowing device manufacturers to mistreat owners I see from the Hacker News community, though, even convincing technical people is a lost cause. It feels like most people really want to be subjugated. It doesn't seem ratioinal. I do recognize that the Hacker News community also includes some of the people who profit from subjugation of device owners. Their motivation seems rational (if not sociopathic).

black3r 6y ago
> It will put a hard "expiration date" on the device's functionality when a link in the PKI chain expires. If you're certificate pinning an IP address for use with your own software, you can just create a self-signed cert with expiration date set to 2999 or some commonly ridiculous date you don't expect your devices will live to.
- wang_li 6y ago
  Why would they do that when they can force you to update your firmware by setting the expiration to a year or even less. This way you are guaranteed to be communicating with the mothership and the devices will incorporate any new malfeatures the manufacturer conceives.

CraneWorm 6y ago

Just don't buy smart TV, or any of that IoT crap. It is possible to buy 58 inch dumb TV, connect that to a machine you own.

mojo982 6y ago
Is it? I’m still holding onto my TV from 2014 because it doesn’t have “smart” functionality. Every time I look at new ones I can’t find good dumb ones.
- tga 6y ago
  Aren’t all smart TVs dumb if you don’t connect them to the internet? I wouldn’t be surprised if manufacturers start selling TVs that need to be activated online before first use, but I don’t know of any that do that already.
  - dspillett 6y ago
    Mine quite happily works as a dumb TV without a connection, and I know many others who do the same. Though I hear stories of TVs being annoying to use without a connection (timing out waiting for a server response that can never come, before falling back to an ad free menu, or just constantly nagging, even while content is playing, about the lack of connectivity).
    - comprev 6y ago
      My 'smart' TV has no internet connection configured as I use a Chromecast for streaming services and beaming local content.
      - Dahoon 6y ago
        That you know of.. Alexa auto-connects to other Alexa networks (like your neighbors). Some TVs have Alexa built-in. Bingo, telemetry.

choeger 6y ago

We need legislation against this kind of crap. It is only a matter of time until these "smart" devices share childporn or host darknet drug shops. Let's face it, the devs implementing these devices run a scrum process, features get stacked upon features and no one cares about, let alone understands the security of the whole tool stack. It is only a matter of time before we have a bot net of smart tvs and roombas. And network owners will be held responsible.

dkdbejwi383 6y ago
I wouldn't be surprised if such a thing already exists

x87678r 6y ago

I'm not sure if its worth posting, but I just installed pihole and its great. You dont actually need a pi, you can run it in docker. its nice that you can see all the dns queries that are happening.

caymanjim 6y ago
I think you meant to say that you don't actually need a Pi. It's unfortunate that they named it that way. Never name things after the technology involved in making them work, because if your thing is any good, it'll spread to other devices/languages/operating systems.
- x87678r 6y ago
  You're right, I've corrected.
- hutzlibu 6y ago
  Maybe they found the name to be funny?
yeswecatan 6y ago
Can you recommend a guide for setting it up on something like a mac?
- x87678r 6y ago
  I dont know much about macs, but googling this looks like it should work for you. https://pawelurbanek.com/pihole-local-computer https://pawelurbanek.com/pihole-local-computer, though I'd try to use the official compose instead of his version on github. https://github.com/pi-hole/docker-pi-hole https://github.com/pi-hole/docker-pi-hole

jaimex2 6y ago

Honestly there is no scenario where your TV should have Internet access. Setup Kodi and you're done.

sildur 6y ago
What about Netflix? Can I have Netflix in Kodi (in a raspberry)? Honesty asking.
- DarthGhandi 6y ago
  Yes you can. It can stream a bunch of things along with regular tv.
- tyrion 6y ago
  Not sure about raspberry, but I use Kodi to watch Netflix all the time and it works well :) See: https://github.com/CastagnaIT/plugin.video.netflix https://github.com/CastagnaIT/plugin.video.netflix
  - summm 6y ago
    But no 4K, due to stupid DRM restrictions.
    - sildur 6y ago
      Yeah, I saw that. And then they wonder why people pirate movies...
- jaimex2 6y ago
  Yep, hardware matters though. You need one that can work with the DRM.
Angostura 6y ago
Great. I've set up Kodi on my Mac. Of course, there's no way to get the content from my machine in the office, to the actual TV that I can see. So that doesn't really solve any problems. Unless you mean buy a separate box, put Kodi on it and attach that to the TV

imglorp 6y ago

Are we not going to talk about the TV uploading 60 mb/day?

nbzso 6y ago

In this point in time everything is compromised. It is a business function not user oriented design. If you affect the bottom line you actively making a statement in this. Don't buy smart IoT shit, don't buy new phones, don't use entertainment services. This is how you will make a difference. Waiting for legislation to remove corporate malpractice is absurd. Politicians are fighting who will get "retirement" benefits. The only voting mechanism in our disposal is money, voting with your money always counts.

hutzlibu 6y ago
Or support open hardware.

sgt 6y ago

Is there a way to avoid YouTube ads on a Smart TV with PiHole? Those ads are becoming more pervasive each month.

kristofferR 6y ago
Not with pi-hole, but on Android TV you can install ad-free clients like SmartTubeNext at least: https://github.com/yuliskov/SmartTubeNext https://github.com/yuliskov/SmartTubeNext
- sgt 6y ago
  But that sounds like something that will eventually be stopped by YouTube.
hanklazard 6y ago
I don’t think so. The source of the ads is through YouTube servers as opposed to some separate ad network like on web pages.

2Gkashmiri 6y ago

Jio (India) is super obnoxious in the fact that their own router is locked down hard. Now you cant even change your DNS. I have suggested few people to bypass this limitation by removing the router as dhcp and using pihole for that. That works but don't know for how long. The pathetic thing is their router does not even allow bridging mode. Fuck jio.

DarthGhandi 6y ago
While not for the average consumer, most routers are easily jailbroken. They aren't locked to anywhere near the extent a mobile phone is.
- 2Gkashmiri 6y ago
  https://www.reddit.com/r/india/comments/czl1f1/jio_fiber_router_is_security_nightmare/ https://www.reddit.com/r/india/comments/czl1f1/jio_fiber_rou...
jacob019 6y ago
You can always put your own router in front of the ISP provided crap, pretty common to have to do that.
- 2Gkashmiri 6y ago
  Agreed. But that is another expense and essentially you are telling millions of people to buy a second device when the first one is capable of doing just that. Only the ISP has locked shit down. The idea should be to force ISPs to keep stuff open, unless the devices are junk and you definitely need a replacement. That is not the case here. Their router is pretty capable, they just want to control people. Thats bad

tux 6y ago

Thank you for the article! Very uselful! Most smart TVs have built in web browsers, you can also try website like https://www.dnsleaktest.com/ https://www.dnsleaktest.com/ to check your DNS.

datanut 6y ago

These shenanigans are exactly why Universal IPv6 only access still fails.

tsjq 6y ago

not long before every TV comes with a built-in SIM card and a whispernet-like arrangement . I hope computer monitors at 40-50inch size reach affordable prices.

judge2020 6y ago
https://www.amazon.com/Amazon-Sidewalk/b/?node=21328123011 https://www.amazon.com/Amazon-Sidewalk/b/?node=21328123011
- tsjq 6y ago
  oops. this is not even a SIM card. can this be disabled? will the devices override user preference and still continue to communicate .
  - judge2020 6y ago
    If you have a device that tries to use sidewalk, you could put tinfoil around the device or desauter the bluetooth chip/900mhz radio (and hope the device works without them in there), but that's really it if these devices come out without a setting to disable sidewalk. If you have an Echo/sidewalk-capable device already, you can opt-out of allowing other devices to use your sidewalk in the Ring or Amazon app https://support.ring.com/hc/en-us/articles/360032524592-Opting-In-and-Out-of-Sidewalk https://support.ring.com/hc/en-us/articles/360032524592-Opti....

ksec 6y ago

May be we start detaching the Smart into a separate box, or basically buying a large Monitor? Is there such thing as 55" Monitor? The whole TV industry needs some new thinking and innovation. Right now it is race to the bottom and everyone is trying to get some extra revenues from Data gathering. There are also a huge oversupply from LCD panel maker.

asutekku 6y ago
That's why I have an Apple TV attached to a Television I have not connected to an internet ever.
- Dahoon 6y ago
  >Apple TV You don't connect your TV but use Apple devices instead. Uhm... okay. You should see the IDS log I'm looking at here. Apple !== no telemetry. All you are doing is putting all your eggs in one basket.
  - albntomat0 6y ago
    An alternative view is that the parent commenter is being deliberate about which device(s) have access, and decided on Apple over whomever made the TV.
grishka 6y ago
I heard that you can buy a dumb 55" monitor if you call it digital signage. Though these things are expensive because they're made for businesses. Another option is to simply never give your smart TV any kind of network connection.
- therealx 6y ago
  Sadly, some will look for other open wireless netorks and connect. In the future, I'm sure all will have a 5g connection.
  - 6y ago

bitlevel 6y ago

They appear to not be trustworthy to be on our networks - so we should: 1. Not join them to our networks 2. Stop buying 'Smart TV's' 3. Get panels and a smart box that you can control I'm lucky enough to be able to direct ALL DNS through my router first. Nothing gets out without my say so. Not everyone has that capability, sadly, with home routers. The solution provided by the OP is a solid one - another would be to purchase a decent router (such as a Mikrotik) and learn how to use it - much more powerful device for the same price, or sometimes lower, as a regular 'home' router.

Dahoon 6y ago
>I'm lucky enough to be able to direct ALL DNS through my router first Even DNS over HTTPS? Do you do packet inspection? Just blocking ports doesn't do much any more. I run an IDS/IPS and it blocks lots of DoH to Google. Apple devices are even worse.
- sbarre 6y ago
  Would you mind sharing a bit more detail on your setup?
  - ianai 6y ago
    I’m interested too.
  - low_key 6y ago
    I'm not sure what the commenter's setup is, but I have one that (at least mostly) achieves the same thing. It is a combination of a few things: 1. Redirect all outbound DNS traffic to your own local DNS server (as described in the link in this post) 2. Return NXDOMAIN for well-known DoH domains [1] (as well as "use-application-dns.net" for well-behaving software like Firefox [2]) 3. Block traffic to well-known DoH providers by destination IP address [1] [1] https://github.com/bambenek/block-doh https://github.com/bambenek/block-doh [2] https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...

newscracker 6y ago

Getting people to add another device like a Pihole or a separate router with better filtering capabilities isn’t going to be an option that most people can handle by themselves. This solution would definitely not work for DNS Over HTTPS (DoH), which I’m guessing will soon become prevalent in many devices. It also seems like DNS Over TLS (DoT) isn’t going to get as much traction exactly because it’s easier to block. As other comments have said, (for those who’re able to do it) not configuring any connection for the device sounds like a good start, but even that has caveats about the device connecting to nearby open networks. So the best thing to do instead is to connect it to a network but not allow any communications to the Internet.

WarOnPrivacy 6y ago
>It also seems like DNS Over TLS (DoT) isn’t going to get as much traction exactly because it’s easier to block. DoT is upticking, albeit at a non-boosted rate. The number of servers supporting DoT has doubled in the US (as in from 3 to 6).

myrandomcomment 6y ago

2 steps: 1. Do not setup your TV, do not except EULA. 2. Get other setup, PC, AppleTV and use TV as dumb screen. Issue solved.

atum47 6y ago

I'm ditching my smart tv. I've disable it's wifi and put a raspberry pi with a external hard drive on it.

guiambros 6y ago
> I've disabled it's wifi and... For now. Wait until Amazon Sidewalk takes off. https://www.amazon.com/Amazon-Sidewalk/b?node=21328123011 https://www.amazon.com/Amazon-Sidewalk/b?node=21328123011

deleted 6y ago

[deleted]

stiltzkin 6y ago

Is PiHole the best all around solution for network filtering?, last i tried to setup one i did not find it user friendly.

grawlinson 6y ago
A few years ago, I tried using ansible to automate setup of PiHole. That did not go well because it's essentially a poorly coded hobby-level project. I've since switched to BIND (named) & it's fantastic implementation of DNZ RPZ[0]. [0]: https://dnsrpz.info/ https://dnsrpz.info/
- mik3y 6y ago
  One of my incomplete-but-functional quarantine projects tries to tackle this "raspberry pi project" problem: How to reproducibly set up these community-maintained projects, with homebrew-like simplicity. https://github.com/berrypatch/berrypatch https://github.com/berrypatch/berrypatch (I guess I've reached the inevitable "build your own package manager" stage of one's hacking career..)

erentz 6y ago

I’m kind of surprised there isn’t an OpenWRT style project out there to provide a replacement OS for common Smart TVs. At least I couldn’t find one. I’m obviously lacking in understanding the massive difficulties such a project would likely face. But it sure would be very nice to be able to replace my TVs firmware with something open source. I don’t want a dongle or extra box or extra remote. There’s a perfectly good computer in my TV. And all the Roku’s or FireTVs are rubbish and intend to invade your privacy just the same.

elsjaako 6y ago
We've come to expect open replacements of everything, but even OpenWRT didn't start out as an open source project. Linksys used Linux on one of their routers, and was thus forced to release their modifications to the kernel for their device.
solarkraft 6y ago
I agree, it's also something I would like. I've looked a bit into this regarding Android TVs and found out that most TVs are using similar Amlogic chipsets. What made me give up on the search for alternative software is that there doesn't even seem to be a place in which any manufacturer's models are even listed, much less anything resembling a community.
DaniloDias 6y ago
Smart TVs have hardware backed security solutions to protect DRM keys. Anyone who undertakes your proposal is going to have problems staying ahead of any jailbreaking mitigations when the companies motivation for security is maintaining relationships with content service providers.
deno 6y ago
No one’s going to target DRM-locked & proprietary (custom motherboard & SOC) Smart TVs when you can get everything you want here (except extra box) targeting an Amlogic s905 or similar box with HDMI CEC[1] that anyone can get for less than 50 USD and is 4K capable and works with absolutely any TV. See: LibreELEC. Your “perfectly good computer” is in fact not yours (it has DRM so you are not the user, you are renting it), and it’s not perfectly good if it can’t run the software you want. [1] This let’s you get away with just one remote including for powering on/off

LeoPanthera 6y ago

I've always wondered why you couldn't resolve all the hostnames in the DNSBL of your choice into IPs, and then block packets to those IPs. Maybe some routers simply don't have that functionality but it seems pretty trivial for pfSense. Is there some reason why that's a terrible idea that I've overlooked?

amelius 6y ago

If you can spare the money, buy a Smart TV and send it to the FCC accompanied by a letter saying that you have no use for a TV that is invading your privacy and there are no alternatives on the market. If they get enough TVs, perhaps they will take action. (If you have less money to spare, buy the TV and return it to the manufacturer for a refund, make sure you state the reason.)

ozaark 6y ago
FCC doesn't seem to be on consumer side - at least until Pai and his ilk are out unfortunately. They showed that with NN repeal despite mass public disapproval.

Havoc 6y ago

Will they respect a gateway setting on a router though?

Spivak 6y ago
You don’t really get a choice on that. If you try to throw packets at something not the gateway they likely won’t go anywhere.

brandonr49 6y ago

Is there a reason no group has popped up to jailbreak the few major TV "OSes"? Given how prevalant this issue is it seems like a reasonable use of time akin to jailbreaking/rooting cell phones.

verisimilidude 6y ago
I imagine most people capable of rooting a TV would already have better alternatives at hand: an Apple TV, an Nvidia Shield, a PlayStation, etc. There’s not much daily incentive to tinker.
- ant6n 6y ago
  All of these still require a Display.
  - judge2020 6y ago
    And the respective TVs work without internet - the only possible attack vector (by the manufacturers) is if they start trying to connect to random unprotected wifi networks, or god forbid the Amazon Sidewalk network[0]. 0: https://www.amazon.com/Amazon-Sidewalk/b/?node=21328123011 https://www.amazon.com/Amazon-Sidewalk/b/?node=21328123011
  - verisimilidude 6y ago
    Personal example. I already have an nVidia Shield. It works out of the box, it's nice, and it already does everything I want. Even if I jailbroke my TV's smartness, then said TV's smartness probably still wouldn't work as well as the Shield. And if the Shield ever messes with me, I can just replace it with a Roku or AppleTV or Chromecast or whatever. There's just no strong motivation to try to root my TV. I don't like my smart TV but I don't need to, because the smart parts can be "replaced" by any number of external devices. My point is that I suspect many would-be TV hackers are in the same happy situation.

xurukefi 6y ago

I always found it puzzling that DNS blacklisting for adblocking purposes works at all. I mean I'm not a webdev or anything like that, so what I'm saying might be a bit native, but couldn't you simply serve your ads using the same domain you use for your content? This immediately defeats things like PiHole completely.

scrps 6y ago
Sadly that is already happening, luckily there are ways to defeat cname cloaking. https://blog.apnic.net/2020/08/04/characterizing-cname-cloaking-based-tracking/ https://blog.apnic.net/2020/08/04/characterizing-cname-cloak...
- judge2020 6y ago
  This has been happening for a century with first-party advertisements and "sponsored content" that is baked into the content being consumed.
Ekaros 6y ago
To me it really sounds like trivial to serve adds from exactly the same address and even full URL as the content. Then again maybe adblocking isn't yet having such big effect that companies want to do that.
- ev1 6y ago
  There's no honour among thieves and whatnot; advertisers do not trust publishers to report data or log impressions truthfully without money-signs-on-bags running away with stolen money. Which, honestly, will 100% happen, considering the sheer amount of weird "adsense click fraud rings" you can find on the shitty, awful part of the internet, like SEO forums.
ufmace 6y ago
It's related to how the internet ad market has evolved. Initially, sites would run their advertising side kind of like newspapers do - have in-house departments to sell ads directly to the companies that want to advertise, then place the ads on their pages manually and serve them from the same servers. It works, but it's a ton of overhead to have all those ad sales people and find companies one at a time willing to set up a direct relationship with your site and deal with direct billing etc. It was kind of a revolution to set up these advertising middlemen. Site owners just sign up to show ads and set up their site to load an ad from the ad company's server. Advertisers buy their ad time from the middlemen too. Nobody has to maintain those high-overhead direct relationships. Huge boon for the little-guy sites on both sides. That's the good part. There's plenty of bad parts too, including monopolization of the market, abuse, poor behavior of anti-abuse mechanisms, etc. It's what we've got though, until somebody comes up with something better.

wishinghand 6y ago

Not a smart TV, but the Youtube app on my Playstation 4 and iPhone. I never see an ad on Youtube when on Firefox with Pihole and uBlock Origin, but almost every video will have a preceding ad and then more if it's longer than 4-5 minutes on non-PC platforms.

WarOnPrivacy 6y ago

>Fortunately, with a few simple firewall rules, you can intercept these hardcoded DNS queries and redirect them to your PiHole. These instructions are for pfSense I can see running pihole instead of a pfSense+pfBlocker rig. But if you've already got pfSesne at the edge, why not just polish it off with pfBlocker/DNSBL instead of erecting a separate pihole machine?

muststopmyths 6y ago
I have pfsense with pfblockerng/dnsbl and it lets in way more ads than pihole. I could be doing something wrong, but I have no idea what.
- WarOnPrivacy 6y ago
  Likely somewhere in the lists. IIRC, we can use pihole lists with DNSBL. That should add full pihole blocking to DNSBL.

swiley 6y ago

At this point I don't want things with nonfree firmware in my house.

loraa 6y ago
You have that choice,but probably not for the price you want. People want the cheapest things and then wonder why they're not the most feature packed with 24/7 American tech support.
zbrozek 6y ago
Nice sentiment, but hard to deliver. You have a dishwasher and a fridge, right? They've been running firmware you don't get to inspect for a couple of decades already. Luckily they don't have network access.
- bigbubba 6y ago
  How many years is 'decades'? About 4 or 5 years ago I took apart a freezer that was about 10 years old. The compressor seemed to be switched by a thermostat; I found nothing that would have firmware.
  - rovr138 6y ago
    That freezer is 1.5 decades.
    - bigbubba 6y ago
      Yes, and wouldn't really surprise me if freezers with the same design can still be found in stores today.
      - fingerlocks 6y ago
        They can, but they will lack features like vacation mode, cleaning mode, fault sensors, and door ajar audio notification.

supertrope 6y ago

Hard coding DNS removes a troubleshooting variable and decreases customer support load and return rates. Some ISPs hijack DNS to serve up search ads (when it’s not down or slow). Some routers are part of botnets so DNS is not to be trusted.

ecf 6y ago
Perhaps companies should hire more talented customer service representatives who have a technical background instead of continuing to make their products shittier.
- zeta0134 6y ago
  Having worked in this kind of customer support, the issue isn't that technician doesn't understand DNS, but rather that the end user frequently hadn't even heard of it. It's a massive pain to troubleshoot something like that remotely when the caller is non-technical. Not impossible of course, but frustrating and requiring a great deal of patience on both ends.
  - zbrozek 6y ago
    I'm sure that's quite common, but so is the reverse. Almost universally, CSRs have no idea how the product works or have any technical knowledge whatsoever.
  - kevingadd 6y ago
    Also, if their ISP-provided router got owned by a virus and is now part of a botnet, how is the end user going to fix that? Many of those devices are locked down. It may not be a problem they can solve without manually configuring every device to use 8.8.8.8, so now every device needs to have a full flow for configuring its DNS servers. I'm personally in favor of every device having that option but it's also the case that the vast majority of people will not benefit from their TVs and lightbulbs having customizable DNS.
- loraa 6y ago
  It's hard when you buy the cheapest product you can get and wonder why it can't compare to the most expensive products from the best brands.

williesleg 6y ago

When do I get to own my data?

quaffapint 6y ago

My TLC Roku TV definitely is using my PiHole. I can see the ridiculous number of requests to roku that I have to block which really skews my stats.

sys_64738 6y ago

These smart TVs sound pretty dumb.

TwoNineA 6y ago
Maybe they don't want you to block spying/ads on them.
kstrauser 6y ago
I prefer the term “sly”. They’re clever, but not in ways that benefit me.

freedomben 6y ago

I use a standard CentOS box to serve local DNS and act as my gateway router. I'm pretty familiar with basic firewalld configurations but I'd love to see some instructions for doing this with firewalld. Does anyone know of such a thing?

Bud 6y ago

This isn't difficult: TVs should not be "smart". TVs should be incredibly dumb. They should be screens for displaying stuff. That's it. Nothing else. No network connection of any kind, no apps, no software beyond that necessary to do basic setup of how that screen works: brightness, input selection, etc.

stingraycharles 6y ago
I own several smart TVs but use none of the smart functionality. They don’t even have internet. TV makers are horrible software developers, for the same reasons that mobile manufacturers were horrible mobile OS developers until Android came along. We have similar solutions for televisions in the form of Apple TV and Chromecast. I honestly feel I’m wasting my money when I’m buying a smart TV these days, but you just narrow your choice so much if you only look for dumb phones, you’re almost forced into buying one.
- 8ytecoder 6y ago
  Both LG webOS and Sony Android TV come across as polished. If not for the fact that I hate advertisement and tracking with a vengeance, I'd gladly use them.
  - RedComet 6y ago
    Yeah, the latest Android TV (Sony) update has ads at the top of the screen that you can't disable.
  - Bud 6y ago
    Will they come across as polished in 10 years, when they haven't had an update in 9 years, and yet the TV itself is still perfectly useful? I doubt it.
- 1stranger 6y ago
  I'm surprised to say but the latest Samsung interface and remote is quite good. Good enough I feel no need to put an Apple TV on it (which happens to have an awful remote).

adriancr 6y ago

If I use a pihole then Samsung TVs will use 8.8.8.8 as backup (even if not configured) I had to firewall all dns requests as well... I assume in the future they will put DNS over https and it will be harder to block - at which point a Linux media player and tv disconnected will make sense... Doing this because of their crappy spying - sending frames of video to identify what you are playing.

wirthjason 6y ago
FYI - This article was linked in another HN post about smart TVs ignoring PiHole. See the original article about how to make sure the TV follows your PiHole. “Your Smart TV is probably ignoring your PiHole” https://news.ycombinator.com/item?id=25313776 https://news.ycombinator.com/item?id=25313776

jeffbee 6y ago

I'm pretty surprised that Google (YouTube, presumably) is so much more represented in the flow census than Netflix. I thought Netflix would have been bigger.

pmalynin 6y ago

It is not. My network is configured to block DNS traffic from anything that isn’t the PiHole. Tbh, when I saw how much traffic the TV was spewing out I just blackholed it all together.

ChuckMcM 6y ago

I read this and yeah, pretty much. Its nice though because I can black hole their DNS lookups in my Pi-Hole and keep my TV from reporting on what it does. The only tricky part was having the 'firmware update page' (which was an HTTP! request) to return 200 OK so it won't complain about firmware.

bborud 6y ago

I'm probably going to get downvoted for this, but I couldn't help but note that 16 year old me would have been utterly baffled (and intrigued) by that headline. Read it out loud a few times and imagine yourself in the VHS era.

Abishek_Muthian 6y ago

Smartphones too! OnePlus hardcodes Google DNS as secondary DNS & I'm sure many others do it too[1] . Forcing DNS requests to Pi Hole is the easiest option to defeat this. [1] https://www.reddit.com/r/oneplus/comments/e0htyg/remove_google_dns_on_wifi/ https://www.reddit.com/r/oneplus/comments/e0htyg/remove_goog...

kiwijamo 6y ago
Is this an Android-wide thing or really specific to OnePlus?
- Abishek_Muthian 6y ago
  There's a mention of Google telling that this was not their doing in a thread somewhere about this.

leshenka 6y ago

Can you just set up your router to forward all dns requests that originate from LAN to pihole (excluding pihole itself)? Wanna use 8.8.8.8? Too bad!

mmglr 6y ago

If I understand correctly using "Nat Rule 1" a network can be configured to ignore my choice of dns server while my device is on their network? What is the mitigation of this? DNSSEC or DNS over HTTPS or DNS over TLS?

tptacek 6y ago
DNSSEC does nothing to address NAT interception of DNS, but DoH does: your network can't spoof a TLS certificate for your chosen DoH recurser (though, with some effort, they can just block you from the network if you don't comply with their DNS policy).

samgranieri 6y ago

Time to setup a pihole and experiment with vyatta config settings on my Ubiquiti security gateway. This will be fun

ThePhysicist 6y ago

I haven't been able to verify this yet but I think my (2015) Samsung SmartTV tries to ping a specific Samsung domain to determine whether the device is connected to the Internet. Last weekend something must've happend to that domain because the TV told me it wasn't connected to the Internet and refused to start any app. The Internet connection (as well as the local Wifi connection), however, was perfectly fine. So I expect the device (at least the "smart" functionality) to be bricked as soon as Samsung takes that domain down for good. In fact Samsung already removed 80 % of the gimmicks and remote features the TV came with, some of them didn't even last two years.

oh_sigh 6y ago
The worst part is that there isn't just a couple super popular models of TVs that people could develop custom firmwares for, there are thousands of skus for televisions and each of them may behave in a different manner meaning that at their end of life it is unlikely that any group is going to go through the effort to free them from death.
- ThePhysicist 6y ago
  Yeah it's annoying. But at least they still have a normal HDMI input, so I could still buy a smart TV stick to plug into that (or use a laptop). That seems more and more attractive as well since after a recent software update my TV now takes around a minute to boot to its smart OS, I suspect because the old hardware can't keep up with the new software.
  - tylergetsay 6y ago
    And with CEC you can control the TV, I particularly like my scripts to turn off the TV's when I leave.
    - octoberfranklin 6y ago
      It really sucks that most GPUs don't have CEC. Even the high-end ones. The price for CEC-USB dongles is outrageous too.

syntaxing 6y ago

Do DNS have a specific protocol? Is it possible to block any DNS query on my network that doesn’t ask my pihole?

rovr138 6y ago
Look at the link here https://news.ycombinator.com/item?id=25313776 https://news.ycombinator.com/item?id=25313776 More specifically, https://labzilla.io/blog/force-dns-pihole#force-all-dns-queries-through-pihole https://labzilla.io/blog/force-dns-pihole#force-all-dns-quer...
gruez 6y ago
>Is it possible to block any DNS query on my network that doesn’t ask my pihole? ...until they force all dns requests through DoH.
1over137 6y ago
DNS is on port 53. So block outgoing port 53 except to your own DNS server. Likewise for DNS Over TLS (DoT), on port 853. The problem is DoH, which uses the same port as https (443) and so is harder to block.

jms703 6y ago

I'd be fine with hardcoded DNS if the devices would fail back to DHCP provided DNS. Then I can just block certain destination IP address. But a NAT redirect is working fine for now.

BooneJS 6y ago

I connected my LG B9 to wireless so I could get firmware updates to enable new framerates for PS5 games that support it. Then I disconnected it again.

jancsika 6y ago

Any reviews of the (beta) ad blocking that comes with raspap, esp. with regard to this?

twblalock 6y ago

I highly recommend that anyone who buys IoT devices, including smart TVs, gets a router or access point that supports multiple SSIDs and VLANS. You can segregate your IoT devices from the rest of your stuff. You can even give a VLAN per device if you really want to, although it's probably not worth the effort. I have 3 VLANs: one for my home network where my computers are, one for my security system, and one for the rest of my IoT devices. I don't even trust my Roomba on my home network! I have a Unifi Dream Machine, but there are a few other consumer products that can achieve this kind of setup. If you have basic knowledge of how to use a computer, you can follow some YouTube tutorials about how to set up VLANs and firewall most of your devices from reaching your home computers.

nicolas_t 6y ago

Is there a list of which game console hardcode DNS settings? I know that the nintendo switch doesn't but I'm curious of the exact devices...

Fiahil 6y ago

I wish I could set a DNS redirect, however I have a Netgear router and the only option I know would be to install a custom router firmware. That's not something I have already done. Does someone have a good walkthrough and recommendations on the choice of firmware ?

bigphishy 6y ago
Well the first step would be to decide which router software you would like to use. There are a number of feature rich and secure opensource router software to choose from DDWRT/VyOS/pfsense etc. I would recommend pfsense. Once you choose your preferred OS, search online for some tutorials on stackoverflow. Alternatively, you can always stick a firewall in between your home network and your netgear, and do your filtering on that.
milofeynman 6y ago
I have the masquerade and other rules setup on a ubiquiti edgerouter that eats anything trying to go out on port 53 and sends it to pihole. My experience has been one of annoyance when the DNS server breaks randomly or after a power outage it can be a pain of resetting VMs occasionally. But 99% of the time it works well and I'm glad I did it. However DNS over HTTPS is going to kill this method.

zxcvbn4038 6y ago

I bought a new TV for the first time in fourty years and never considered the “smart” TV aspects - I was just focused on image quality and number of inputs. In the end I picked out an LG tv which had a great picture - but it’s app support really sucks if you want something more then Netflix and Hulu. I ended up getting a Fire stick and an Apple TV to go with it so I can access content. If I did it all again I wouldn’t even bother setting up the networking for the TV - it’s just one more vector for advertising - and just plan on having the other devices day one. They are updated much more frequently and get the streaming apps that nobody bothers to develop for the TV itself. Downloading firmware updates for the TV takes hours. I’m pretty sure the server is under somebody’s desk and every LG tv in the world hits it at once so the throughput is bytes per second - they should use an S3 bucket or something instead.

xxpor 6y ago
LG and Samsung both have nasty habits of hosting their downloads in South Korea, where while their internet connectivity within the country is amazing, their access to the outside leaves a lot to be desired. They're in a tough spot to serve geographically since they're effectively an island and the closest big country (China) isn't somewhere you'd want to have your cables going though. My understanding is IIRC they largely connect to Japan and perhaps Singapore. But yeah, if they just used a CDN this wouldn't be an issue.

1vuio0pswjnm7 6y ago

"Nearly 70% of smart TVs and 46% of game consoles were found to contain hardcoded DNS settings - allowing them to simply ignore your local network's DNS server entirely. " To be fair, Pi-Hole hardcodes "default" (suggested) DNS settings, too. While the user can change defaults, it is well-known that in most cases, the majority of users do not change them. curl -s https://raw.githubusercontent.com/pi-hole/pi-hole/master/automated%20install/basic-install.sh |grep -C3 8\.8\.[48]\.[48] IMO, the best DNS-based solution for controlling the HTTP requests that applications can successfully make, e.g., to ad servers/trackers, is not to point them (directly or indirectly) at third party DNS caches. Sending the user's DNS queries to an online ad services company (Google) is a interesting default for a project whose raison d'etre is the existence online ads. Perhaps if the online ads industry began to fade, so too would the need for Pi-Hole. After decades of running own root and other authoritative servers on localhost, I would still do it even if online ads were not a problem. I like the speed, reliability and control.

mataug 6y ago

This is precisely the reason I do not connect my TV to my home network. I use a AppleTV for streaming content. Once in a while I check the manufacturer's page, and if there's a firmware update, I factory reset my TV to remove any cached info about my usage, and then update the firmware via ethernet, and immediately remove it from the network. A while ago I noticed that my old Insignia TV refused to use the pi-hole connected to my network, and it was constantly phoning home, that's when I decided that I'm never connecting a TV to the network. Thankfully I've been able to confirm that the Apple TV does not bypass my pi-hole, since it doesn't load anything when the pi-hole is down. I know at some point I need to trust some entities with my data. I prefer choosing those entities to the best of my ability, rather than leaving that choice upto my TV manufacturer.

seandoe 6y ago
Yea, I just use my tv like a monitor for a Linux box I have in the living room. I like the bluetooth keyboard with track pad a lot better than any remote clicker. We use vlc and a browser for all our video entertainment. It's nice to have all sorts of desktop apps as well... Spotify, transmission, etc.
- mataug 6y ago
  I tried that, but everyone besides me found the interface annoying to use, they preferred the Smart TV's slow and crappy UI over a computer desktop. So the AppleTV has been a nice compromise, plus support for various media formats such as Dolby Vision, and HDMI-CEC are really nice to have.
divbzero 6y ago
Keeping the TV disconnected from the network is a good idea, and using it as a dumb disconnected screen could mean that those firmware updates aren’t critical anyway.
- mataug 6y ago
  Sometimes firmware updates fix bugs in the TV's OS, which can improve the user experience. https://www.forbes.com/sites/johnarcher/2018/02/14/lg-oled-tvs-receive-dolby-vision-bug-fix-or-at-least-some-do/?sh=52c59a933516 https://www.forbes.com/sites/johnarcher/2018/02/14/lg-oled-t... You're correct in general though, I'm not worried about security flaws on the TV.

k4rli 6y ago

Where does this 72% come from? Is there a list of TVs which behave like this?

dghughes 6y ago

This is the exact situation I ran into trying to block ads with a pihole on a Samsung smart TV. The ads were very specific highly localized to my small province. Not something that could be random or generic. I thought I was doing something wrong since the TV absolutely refused to accept the DNS settings I was inputting.

Nacdor 6y ago

Why did the HN mods arbitrarily change the title of this article? It's not the correct title and it's harder for the uninformed user to understand. If you told me about hard-coded DNS settings I would say "Ok, what does that mean and why does it matter?". If you said "Smart TVs ignore piholes" (the original title) I would know exactly why that's important.

recursive 6y ago
The new title seems more descriptive to me. How many people know what a pihole is, but not DNS? I understand DNS a lot better than pihole, which I've barely heard of.
- Nacdor 6y ago
  I see pihole recommended constantly as a way to block ads. > I understand DNS a lot better than pihole Unless the mods did a survey this doesn't justify the title change. It's just as likely that more people are familiar with pihole than DNS, and if the mods don't know (which they don't) then they should leave the title as the author wrote it.

cynoclast 6y ago

It's not a "Smart TV" it's a dumb computer that spies on you.

OJFord 6y ago

I use OpenWRT, (not pfSense as in TFA) struggle with both its UI and `iptables`, but I figured it out eventually... In case it's of use to anyone else: pihole_addr='YOUR.IP.GOES.HERE' for p in tcp udp; do iptables -t nat -A prerouting_lan_rule -p "$p" ! --source "$pihole_addr" ! --destination "$pihole_addr" --dport 53 -j DNAT --to "$pihole_addr" done in http://openwrt.lan/cgi-bin/luci/admin/network/firewall/custom http://openwrt.lan/cgi-bin/luci/admin/network/firewall/custo..., or whatever file it saves to, /etc/firewall/something I think.

oars 6y ago

Will redirecting all DNS as described in the article work if the Smart TV is using DNS over HTTPS?

tiew9Vii 6y ago

DoH is unfortunate. I run my own custom openbsd router and use IP masquading to re-route any traffic on port 53 to my local dns server. My local server does caching, ad blocking, DoH resolution. Obviously with applications using their own DoH resolution this breaks as my local dns server gets bypassed. Any application ignoring dns in a dhcp lease are bad net citizens unless the app gives the option to explicitly turn this on or off. It’s also planed obsolescence, what happens when the hard coded dns servers get turned off? Everything just breaks.

fartcannon 6y ago

I recently bought a dumb TV (Proscan something or other, 4K) where I watch Netflix, Prime Video, Youtube and Crave TV in a modified version of Chromium (https://blog.vpetkov.net/ https://blog.vpetkov.net/) on a Raspberry Pi 4. Additionally I stream my Steam Library using the Steam Link deb in the raspbian repos and a set of Steam Controllers via the dongle (the SC bluetooth connection kinda sucks on the RPI4) For best perforance, use a wired ethernet connection, and a bluetooth dongle for your non-Steam controllers and bluetooth headset. Works flawlessly and it's a delight to have a full Linux distro on my TV.

aquaticsunset 6y ago

Strangely enough, my 2018 Samsung TV honors my LAN's DNS preference (set to an internal IP for pihole). It breaks app and system updates, but that's an okay price to pay :)

piracy1 6y ago

That is how linux works by default...

octoberfranklin 6y ago

Routers just need to treat packets to 8.8.8.8 as "send this to the DNS server". Seriously. IPv4=8.8.8.8 means "this goes to the DNS server". The DNS server helps you find all the other IP addresses you need, which is why this one is special. One DNAT rule, one SNAT rule, and you're done. IMO IP should have had this feature from day one.

BorisMelnik 6y ago

on a separate note I think smart TV's are either going to completely die or a massive operating system consolidation is about to happen. I work with a lot of consumers directly and so many of them just hate their smart TVs and opt to use a roku/fire stick/apple TV instead. add to that most major cable providers have so many streaming services baked into their own cablebox OS and there is a lot of redundancy.

herbst 6y ago

For anyone who too hates the software of his smart tv. Get a pi and kodi to experience the freedom some of us are used too.

qwerty456127 6y ago

Every person who cares about their privacy, should run a real firewall (NAT is not a firewall, DNS/hosts is not a firewall either) to control everything what goes in and out of their home network. Unfortunately packet filtering is considerably obscure and most of the people (including most of the programmers and other techies who don't specialize in network administration) are afraid of approaching it.

adikhan01 6y ago

Before going with the conspiratorial take note that Mozilla shipped DoH early and both Microsoft and Apple implemented it. Untrustworthy ISPs are a real problem even if Google deservedly gets suspicion about their motives. This isn’t another

adikhan01 6y ago

What DNS do you hardcode? Google's? Or do you advice the use to set it up himself?

shr00by 6y ago

This is a great article! I am wondering how to test this nslookup command with my smart TV. Has anyone got this working with a Unifi Security Gateway (USG3)?