10 ms·
What DNS do you hardcode? Google's? Or do you advice the use to set it up himself? I am very suspicious of the push for https and the like. I feel it is mainly
by rightbyte 6y ago
What DNS do you hardcode? Google's? Or do you advice the use to set it up himself?
I am very suspicious of the push for https and the like. I feel it is mainly about hiding the payload from me not any third party.
- EvanAnderson 6y agoYou're right to be suspicious. The DNS-over-HTTPS model favors those who run the servers (because they get exclusive access to monetizable end user name resolution data) and those who control the resolvers. You might control the resolver on your personal computer (for now). You probably don't control it on your phone. You most likely won't control it on your embedded devices.
- t0astbread 6y agoThe root evil here is that you can't change the root certificates in such devices. Even if you controlled its DNS, the device could still just be programmed to fail if it doesn't reach its analytics/ad/whatever server.
- GekkePrutser 6y agoThe Amazon Fire TV does this already :( If it doesn't see internet it just blocks itself and goes to a screen "Oops I have no internet". So you can forget about watching movies from your local server using the VLC app as well. Ridiculous.
- moonbug 6y agomakes it utterly useless in an IPv6+NAT64 environment, incidentally.
- tguvot 6y agoYou can go to settings > installed application and lunch VLC or anything else directly from there
- GekkePrutser 6y agoI'm pretty sure the last time my internet was down I couldn't get into anything but the wifi settings. But I'll try it next time, thanks for the tip!
- tguvot 6y agoYou can go back from network settings back to settings or something like this. just poke around. Discovered it when comcast went down for 4 days and wanted to run kodi on firetv
- hda2 6y agoAmazon also tends to hide options until you "try" connecting to your network. My device refused to work without internet until I "tried" connecting to my network using an incorrect password. When I did that and the device failed, an option to skip network setup appeared. In small font at the bottom of the screen, of course.
- mstade 6y agoThe IKEA Tradfri "smart" lighting gateway will stop responding to commands if it can't phone home to some IKEA server. I noticed this when I changed my router to use NextDNS, which blocked the IKEA lookups. I was ready to return the device as broken until I realized this. I've also had issues with Bang & Olufsen speakers in the past, and inclined to believe it's for the same reasons. I think it's insane that devices can effectively be bricked if they can't phone home. It's nothing short of waste, and I think environmental legislation should require device manufacturers to supply ways of disabling or overriding these mechanisms such that devices can continue to operate regardless of whether home servers are blocked or otherwise out of reach, e.g. company goes belly up, censorship etc.
- benttoothpaste 6y ago> I was ready to return the device as broken until I realized this. Actually you probably should return such devices as broken.
- mstade 6y agoI’m inclined to agree, frankly.
- m463 6y agoI did just that with a DJI Mavic. It was kind of hard to send back a really nice device that I had just opened up and was ready to fly. Thing is, some companies just use it as a way to fire their customers.
- CamperBob2 6y agoI tend to cut DJI a break, because customer (non-)compliance with no-fly zones is a class-1 existential threat to their business selling consumer drones. Pinging DJI servers to check for altitude restrictions at every power-up cycle is intrusive, but I honestly don't see that they have much choice. However, they are also playing these sorts of games with other types of devices, where no such justifications exist ( https://www.eevblog.com/forum/eevblab/eevblab-83-dji-pocket-2-camera-registration-bullshit/msg3351256/#msg3351256 https://www.eevblog.com/forum/eevblab/eevblab-83-dji-pocket-... ) That needs to be answered by returning the product as defective.
- throwaway201103 6y agoThen you return the device as defective and demand a refund. What you chose to pay for is up to you.
- pickledcods 6y agoI believe that Google pushed DoH to track your cross-site browsing. TLS hides your URL, and blockers can break adsense tracking and/or any other call-home backlinks. Using DoH, especially one served by an advert company is just signing up to be their open book.
- sp332 6y agoChrome didn't change the resolver, though. It just enables DoH if it's on a whitelist of known DoH-capable resolvers. It doesn't send your data to Google unless you already used Google's DNS.
- deleted 6y ago[deleted]
- sp332 6y agoI still prefer DoH giving "exclusive" access to resolvers, because the alternative is sending that data in plaintext for everyone along the path to read?
- folmar 6y agoIf your ISP is large enough it is only sent to ISP's name server which probably has everything you need cached, and if it isn't it might blend in with other queries. And your ISP can sniff SNI or guess target domains from target IPs already.
- judge2020 6y agoWhich is also being worked on via esni (now ECH for encrypted client hello) - https://crbug.com/boringssl/275 https://crbug.com/boringssl/275
- dralley 6y ago> The DNS-over-HTTPS model favors those who run the servers (because they get exclusive access to monetizable end user name resolution data) Hold up. You are claiming that the fact that DoH prevents DNS requests from being visible in cleartext network traffic is a bad thing? ...what? In a world where the choice is between one party (the DNS provider) having access to my DNS requests and everyone on the network including my DNS provider having access to my DNS requests, I'll choose "DNS provider having exclusive access" every single time.
- dec0dedab0de 6y agoHold up. You are claiming that the fact that DoH prevents DNS requests from being visible in cleartext network traffic is a bad thing? It is when its my network. If they cared about people sniffing they would use DNSSEC, but still use the network DNS server. DNS over HTTPS is just a way for shady companies to hide what they're doing.
- _-___________-_ 6y agoDNSSEC provides authenticity, not confidentiality.
- theamk 6y agoUh, DNSSEC is only signatures, it has no encryption.
- praptak 6y agoDNS over secure channels is actually good - it limits bad behavior by ISPs. The problem of shitty devices on your private network is a different one.
- rmrfstar 6y agoAt this point it is really tough to find devices that don't leak data like a sieve. I recently bought a car, and could not find one without a cellular modem and microphones. Removing the modem voids the warranty. The period where you can opt out is mostly over.
- sokoloff 6y agoThe Magnuson–Moss Warranty Act of 1975 ensures that’s not the case in the US. I suspect something similar is true in EU. For the manufacturer to avoid a warranty claim due to a modification or aftermarket part, they must show that the defect was linked to the part or modification. They might have to show that it was caused by, but in any case, if your paint fails prematurely, they can’t say your warranty is void because you disabled the cell connection.
- deleted 6y ago[deleted]
- Dahoon 6y agoTo get 5 stars by EuroNCAP (and AFAIK EU law demands it too) the car have to call 911/112 automatically if it detect a crash. I doubt you can remove telemetry without also disabling this. If you do the car is illegal.
- Zhenya 6y agoIllegal to sell by the OEM or illegal to drive? Two very different things.
- 6y ago
- jon-wood 6y agoCurrently we’re using both Google and Cloudflare’s DNS, providing resiliency against one or the other being unavailable, but I’m looking at potentially using our own resolvers just to reduce the amount of data being exposed to third parties.
- qwertox 6y agoSo the company you work for will be fighting for my privacy? I'd rather have a PiHole doing that. These devices do usually have an UI. Why not provide some options to the user? Let him choose among different types and providers. I'd set mine to use the one provided by DHCP or enter the address of my resolver manually.
- Kalium 6y agoHave you ever had to do technical support for someone who changed settings they didn't understand? Or maybe someone who decided to "clean up" a bunch of system files that they thought were wasting space? In my experience, product design is generally done with a well-meaning attempt to protect the average user from themselves. People who can and do manage their own networks in sophisticated ways are, unfortunately, far less common than people who have no idea that their ISP fscks with DNS lookups. Personally, I'd bury this setting pretty deep in an advanced-usage-only tab and behind a notice SCREAMING about how using these settings is unsupported. And then tell support staff that they are not obligated to support whatever crazy configurations people cook up for their home networks. I understand not doing it at all. A few people will complain, but the number of people who will refuse to buy a TV because it doesn't play nice with their pihole is almost certainly too small to register on any material financial statement, and attempting to please them will generally run into some other point they are unwilling to budge on. The number of people who screw up an advanced setting they don't understand will show up in support costs.
- syshum 6y agoSo if I have a firewall level block to both 8.8.8.8 and 1.1.1.1 your devices will not work for me at all?
- mikro2nd 6y agoClosest 2 servers in OpenNIC.
- bborud 6y agoMy company makes IoT systems to support low power devices that use mobile (NB-IoT and LTE-M) connectivity and we have some similar problems having to do with mobile networks and APNs. The way we solve this is that we assume any knowledge the device has about the outside world can become obsolete, so we do we have a two layer approach. The bottom layer is that we have a set of semi hard-coded fallback values that are likely to work in the forseeable future. Updating these fallbacks requires an over the air firmware upgrade which isn't a terribly big deal since we regularly upgrade firmware over the air. The goal of these values is to make sure we can get the device online and direct it to somewhere where we can trigger firmware updates. The second layer is that one or more times per day we ping a config server that sends a packet with configuration data to the unit. This is typically API endpoints etc. The configuration data is essentially a prioritized list of resources, so if one won't respond it will go to the next on the list (while still trying to determine if a higher priority resource becomes available). Last week we got a chance to see how this failed over beautifully as multiple resources were removed and a fleet of devices just adapted as they should. (The shutdown of these resources were planned, but presented a good opportunity to do a fire drill).