4 ms·

Comcast isn't doing anything to your DNS. They're the largest ISP in the country, there'd be a huge uproar if they were doing something like that. There are ple

Comcast isn't doing anything to your DNS. They're the largest ISP in the country, there'd be a huge uproar if they were doing something like that. There are plenty of experts who are subscribers who'd be able to figure out exactly what's going on.

wizzwizz4 5y ago
There's already a huge uproar around Comcast. But Comcast isn't losing any customers, because they have monopolies.
- jaywalk 5y ago
  Yeah, uproar around prices and speeds and stuff like that. Nothing like screwing with third-party DNS requests.
  - wizzwizz4 5y ago
    Actually, I have heard that claim more than once, about various providers (up to, and including, “when I changed my DNS settings and the traffic slowed down, the tech got me to change them back, and the traffic sped up”). It's less common, I think, because more people know how to check their speed than change their DNS.
    - jaywalk 5y ago
      The only way I can think of that working is if the provider is intercepting DNS requests for popular speed tests to redirect to an internally-hosted version that would be faster. Otherwise, I can't think of any realistic way DNS settings can affect actual throughput.
      - wizzwizz4 5y ago
        If the ISP is checking for DNS lookup of speed test websites, then allocating higher bandwidth to the connection for a brief period of time? Or, somehow more cynically, the ISP makes money from selling the data collected from DNS, so punishes people who use a different DNS provider. (DNS is plaintext-by-default, so I don't quite see how this would work, but it's possible.) Or perhaps the system uses DNS lookups as a proxy for “is a human browsing the web”; if there aren't enough, it's clearly some kind of automated computer program that doesn't deserve internet access.
        jaywalk 5y ago
        Your first example would be dead simple to detect and take advantage of to get those boosted speeds all the time. Your other two examples are a bit wild.
        wizzwizz4 5y ago
        The first example is a real-life example. The other two are speculative, because I've heard a case where it wasn't the first example.
      - tialaramex 5y ago
        So, suppose I'm Huge Video Streaming Corp X, and I get a DNS request asking me for the address of my servers. Well I have over a thousand servers around the globe, which one do you need? Any of them would work, but you likely want the fast nearby one, right? So I can try to guess based on the IP address the query came from... I know the best answer for a Comcast DNS server in New York is the server I physically installed in a New York Comcast rack, but when a public DNS server asks me from Paris, maybe I suggest a London server, 'cos that's pretty close to Paris, shame that New York isn't. EDNS Client Subnet is a feature that lets a DNS server say OK, I'm asking on behalf of somebody from 10.20.30/24 and so my system can do the same trick with ECS. But doing this unwinds most of the privacy benefit of using a public service, so several famous public DNS servers explicitly do not use ECS. Obviously the cheap bulk host used for some Single Serving site like "Is pizza rat mayor of New York yet?" isn't affected, that is only one server and it is wherever it is, but somebody like Netflix absolutely is affected by this because they have their machines close to the customers to deliver better performance and if they don't know where the customer is that inteferes. QUIC has an optional feature called Connection Migration to help improve this, the remote server is like "Um, now that you're connected to www.example.com here in Glasgow, Scotland, I notice your IP address is from Tokyo, Japan, and this is just a suggestion, but maybe talk to my identical twin also named www.example.com in Tokyo, Japan for better performance? Here is the IP address to try"
        jaywalk 5y ago
        That's not what I meant by "actual throughput." The fact that a download is slower from a server halfway around the world versus one in the same datacenter where my ISP has a peering agreement near me isn't because my connection slows down when I'm hitting the far away server.
        tk75x 5y ago
        This explanation makes a lot of sense. It also has a slight feeling of Hanlon's Razor, although there isn't necessarily incompetence involved (unless you count the technology's inability to find the absolute fastest/closest server [for whatever reason] as incompetence).
_jal 5y ago
"Come on, what are you worried about? I'm sure it's fine, somebody must have inspected it."
- jaywalk 5y ago
  Well, I can tell you that I'm a Comcast customer who doesn't use their DNS, and I have no issues. If I did have issues, I also have the expertise to figure out what's going on.
- gruez 5y ago
  While absence of evidence isn't evidence of absence, some guy's anecdote isn't really evidence of existence.
selectodude 5y ago
I find Comcast’s fuckery to be limited to their business practices. Their actual IP network seems to be very solid.
- jaywalk 5y ago
  100% agreed. And I've been a Comcast customer long enough to have seen the days when that certainly wasn't the case. They've made some pretty big mistakes in the past, but they seem to have learned their lesson.
unknown_error 5y ago
Weren't they the ones who pioneered DNS hijacking of unknown domains to serve their own recommendations and ads?
- jaywalk 5y ago
  No, that was VeriSign back in 2003: https://www.icann.org/en/announcements/details/advisory-concerning-verisigns-deployment-of-dns-wildcard-service-19-9-2003-en https://www.icann.org/en/announcements/details/advisory-conc...
  - unknown_error 5y ago
    Ah, OK. I didn't realize verisign did that too. Comcast followed not long after... https://arstechnica.com/tech-policy/2009/08/comcasts-dns-redirect-service-goes-nationwide/ https://arstechnica.com/tech-policy/2009/08/comcasts-dns-red...
    - jaywalk 5y ago
      Comcast used to do a lot of messed up stuff. As I mentioned in a comment somewhere close to here, I've been a customer long enough to have seen those bad days and how they've managed to change since those days.
      - unknown_error 5y ago
        Have they really though? They still do DNS hijacking and bandwidth caps and speed boost for a few seconds only and automatic price increases and worthless bundles and such, don't they? They were so bad they had to rename to Xfilthy or something but their practices didn't really change as far as I can tell. What are some examples of things they've improved? That's aside from all the political shenanigans they pull, trying to kill municipal broadband and net neutrality. There's scarcely a more evil ISP. I switched away from Comcast as quickly as I could, and never had trouble with either smaller cable companies or fiber providers.
addingnumbers 5y ago
That couldn't be more wrong. They literally published an IETF draft standard on how they do it. https://datatracker.ietf.org/doc/html/draft-livingood-dns-redirect-00 https://datatracker.ietf.org/doc/html/draft-livingood-dns-re...
- jaywalk 5y ago
  That draft is referring to the operation of their own DNS servers, not messing with third-party DNS.
  - addingnumbers 5y ago
    "... except in reasonable and justifiable cases where a user has been placed into a so-called "walled garden" for reasons of abuse, security compromise, account non-payment, new service activation, etc." Their own words
    - jaywalk 5y ago
      What's your issue with that? In that scenario, the user doesn't even have Internet access. If they didn't force the DNS to specific servers, the user would only see that their service isn't working with no indication as to what's going on. It's clearly not something they do with normal, functional users and I never said that they didn't have the capability to do it.
      - addingnumbers 5y ago
        That was a pretty rapid shift from "Comcast isn't doing anything to your DNS" to "So what if they are? There are times when they should!"
        jaywalk 5y ago
        Yeah, wow I guess I should have included the caveat "Comcast isn't doing anything to your DNS... except when you literally don't have Internet access and couldn't reach a third-party DNS server anyway"

wizzwizz4 5y ago

There's already a huge uproar around Comcast. But Comcast isn't losing any customers, because they have monopolies.

jaywalk 5y ago
Yeah, uproar around prices and speeds and stuff like that. Nothing like screwing with third-party DNS requests.
- wizzwizz4 5y ago
  Actually, I have heard that claim more than once, about various providers (up to, and including, “when I changed my DNS settings and the traffic slowed down, the tech got me to change them back, and the traffic sped up”). It's less common, I think, because more people know how to check their speed than change their DNS.
  - jaywalk 5y ago
    The only way I can think of that working is if the provider is intercepting DNS requests for popular speed tests to redirect to an internally-hosted version that would be faster. Otherwise, I can't think of any realistic way DNS settings can affect actual throughput.
    - wizzwizz4 5y ago
      If the ISP is checking for DNS lookup of speed test websites, then allocating higher bandwidth to the connection for a brief period of time? Or, somehow more cynically, the ISP makes money from selling the data collected from DNS, so punishes people who use a different DNS provider. (DNS is plaintext-by-default, so I don't quite see how this would work, but it's possible.) Or perhaps the system uses DNS lookups as a proxy for “is a human browsing the web”; if there aren't enough, it's clearly some kind of automated computer program that doesn't deserve internet access.
      - jaywalk 5y ago
        Your first example would be dead simple to detect and take advantage of to get those boosted speeds all the time. Your other two examples are a bit wild.
        wizzwizz4 5y ago
        The first example is a real-life example. The other two are speculative, because I've heard a case where it wasn't the first example.
    - tialaramex 5y ago
      So, suppose I'm Huge Video Streaming Corp X, and I get a DNS request asking me for the address of my servers. Well I have over a thousand servers around the globe, which one do you need? Any of them would work, but you likely want the fast nearby one, right? So I can try to guess based on the IP address the query came from... I know the best answer for a Comcast DNS server in New York is the server I physically installed in a New York Comcast rack, but when a public DNS server asks me from Paris, maybe I suggest a London server, 'cos that's pretty close to Paris, shame that New York isn't. EDNS Client Subnet is a feature that lets a DNS server say OK, I'm asking on behalf of somebody from 10.20.30/24 and so my system can do the same trick with ECS. But doing this unwinds most of the privacy benefit of using a public service, so several famous public DNS servers explicitly do not use ECS. Obviously the cheap bulk host used for some Single Serving site like "Is pizza rat mayor of New York yet?" isn't affected, that is only one server and it is wherever it is, but somebody like Netflix absolutely is affected by this because they have their machines close to the customers to deliver better performance and if they don't know where the customer is that inteferes. QUIC has an optional feature called Connection Migration to help improve this, the remote server is like "Um, now that you're connected to www.example.com here in Glasgow, Scotland, I notice your IP address is from Tokyo, Japan, and this is just a suggestion, but maybe talk to my identical twin also named www.example.com in Tokyo, Japan for better performance? Here is the IP address to try"
      - jaywalk 5y ago
        That's not what I meant by "actual throughput." The fact that a download is slower from a server halfway around the world versus one in the same datacenter where my ISP has a peering agreement near me isn't because my connection slows down when I'm hitting the far away server.
      - tk75x 5y ago
        This explanation makes a lot of sense. It also has a slight feeling of Hanlon's Razor, although there isn't necessarily incompetence involved (unless you count the technology's inability to find the absolute fastest/closest server [for whatever reason] as incompetence).

_jal 5y ago

"Come on, what are you worried about? I'm sure it's fine, somebody must have inspected it."

jaywalk 5y ago
Well, I can tell you that I'm a Comcast customer who doesn't use their DNS, and I have no issues. If I did have issues, I also have the expertise to figure out what's going on.
gruez 5y ago
While absence of evidence isn't evidence of absence, some guy's anecdote isn't really evidence of existence.

selectodude 5y ago

I find Comcast’s fuckery to be limited to their business practices. Their actual IP network seems to be very solid.

jaywalk 5y ago
100% agreed. And I've been a Comcast customer long enough to have seen the days when that certainly wasn't the case. They've made some pretty big mistakes in the past, but they seem to have learned their lesson.

unknown_error 5y ago

Weren't they the ones who pioneered DNS hijacking of unknown domains to serve their own recommendations and ads?

jaywalk 5y ago
No, that was VeriSign back in 2003: https://www.icann.org/en/announcements/details/advisory-concerning-verisigns-deployment-of-dns-wildcard-service-19-9-2003-en https://www.icann.org/en/announcements/details/advisory-conc...
- unknown_error 5y ago
  Ah, OK. I didn't realize verisign did that too. Comcast followed not long after... https://arstechnica.com/tech-policy/2009/08/comcasts-dns-redirect-service-goes-nationwide/ https://arstechnica.com/tech-policy/2009/08/comcasts-dns-red...
  - jaywalk 5y ago
    Comcast used to do a lot of messed up stuff. As I mentioned in a comment somewhere close to here, I've been a customer long enough to have seen those bad days and how they've managed to change since those days.
    - unknown_error 5y ago
      Have they really though? They still do DNS hijacking and bandwidth caps and speed boost for a few seconds only and automatic price increases and worthless bundles and such, don't they? They were so bad they had to rename to Xfilthy or something but their practices didn't really change as far as I can tell. What are some examples of things they've improved? That's aside from all the political shenanigans they pull, trying to kill municipal broadband and net neutrality. There's scarcely a more evil ISP. I switched away from Comcast as quickly as I could, and never had trouble with either smaller cable companies or fiber providers.

addingnumbers 5y ago

That couldn't be more wrong. They literally published an IETF draft standard on how they do it. https://datatracker.ietf.org/doc/html/draft-livingood-dns-redirect-00 https://datatracker.ietf.org/doc/html/draft-livingood-dns-re...

jaywalk 5y ago
That draft is referring to the operation of their own DNS servers, not messing with third-party DNS.
- addingnumbers 5y ago
  "... except in reasonable and justifiable cases where a user has been placed into a so-called "walled garden" for reasons of abuse, security compromise, account non-payment, new service activation, etc." Their own words
  - jaywalk 5y ago
    What's your issue with that? In that scenario, the user doesn't even have Internet access. If they didn't force the DNS to specific servers, the user would only see that their service isn't working with no indication as to what's going on. It's clearly not something they do with normal, functional users and I never said that they didn't have the capability to do it.
    - addingnumbers 5y ago
      That was a pretty rapid shift from "Comcast isn't doing anything to your DNS" to "So what if they are? There are times when they should!"
      - jaywalk 5y ago
        Yeah, wow I guess I should have included the caveat "Comcast isn't doing anything to your DNS... except when you literally don't have Internet access and couldn't reach a third-party DNS server anyway"