3 ms·

Yes, this! I even wonder how else you would do this. By the way I worked with many IoT devices that do not use your dhcp dns but just hardcode quad 8 or similar

cj 2y ago
We recently had a developer join our team and he got stuck setting up his dev environment. We use a .dev domain as a localhost alias, and turns out his ISP’s DNS wouldn’t resolve 127.0.0.1 (or whatever it is) for the .dev domain. Changing his resolver at the network level to 1.1.1.1 fixed it. I imagine there are lots of difficult support tickets for app devs, and at a certain point they just hardcode the DNS to remove one variable from the equation when debugging bug reports.
- X-Istence 2y ago
  Not resolving 127.0.0.1 or RFC1918 addresses or even ULA for IPv6 is done to avoid DNS rebinding attacks. For most end users that is probably the correct move.
  - lxgr 2y ago
    My home router even seems to inspect any UDP/53 traffic and redact any responses containing local/private A entries, so not even switching to a public resolver bypasses the protection. I agree that it’s usually the right behavior.
    - cj 2y ago
      Interesting. I hadn’t considered it might be a security feature of his router!
      - lxgr 2y ago
        In case you want to look into it further: My router actually allows adding exemptions to this policy on a per-hostname basis! Sometimes I wish it would allow wildcards, but honestly that's probably just another way for users to shoot themselves in the foot (e.g. by adding '*').
        RulerOf 2y ago
        > Sometimes I wish it would allow wildcards pfSense for example uses unbound, and while it doesn't have a switch for disabling rebind protection, it does allow injecting arbitrary unbound config, which can disable rebind protection for any depth of a DNS zone or IP space. E.g.: server: private-address: 192.168.0.1/24 private-domain: plex.direct
- troyvit 2y ago
  Wayyyy back in 1995 or '96 I was working for a non-profit called "Next Generation Magazine" and our goal was to have young people write content for web sites to get their names out there. Back then it was all local ISPs, so we went to our ISP and asked for ngm.org and were stoked when we got it! We built out the site (Thanks to Building Killer Websites of course) and it looked awesome! Only problem was that nobody in my family out of state could see it. It took awhile to realize realize that we never bought that domain. Our local ISP just added it to their DNS records, and since we all hooked into them we thought we were live across the 'net.
  - jonhohle 2y ago
    That’s incredible! I remember one of the first times I used the Internet and opened my local radio station’s website from several states away. It was incredible to me that it worked and I also wondered why anyone across the country would care. The early internet was amazing.
admax88qqq 2y ago
Most isp resolvers are shit and broken
- egberts1 2y ago
  That’s why it is imperative (at least, for a homelab hobbyist) to host your own DNS servers in your own VSP.
  - admax88qqq 2y ago
    Totally, but most IoT customers are not homelab hobbyists, so I think its defensible for IoT vendors to just hard code known good DNS in their devices instead of relying on broken ISP resolvers. Related story, there was a period of time where my ISP's resolver that would replace hostnames with no DNS record with their own ad filled garbage page. So you mistype google.com to foofle.com or something and instead of getting "host not found" you get... ads. Disgusting behaviour IMO.

cj 2y ago

We recently had a developer join our team and he got stuck setting up his dev environment. We use a .dev domain as a localhost alias, and turns out his ISP’s DNS wouldn’t resolve 127.0.0.1 (or whatever it is) for the .dev domain. Changing his resolver at the network level to 1.1.1.1 fixed it. I imagine there are lots of difficult support tickets for app devs, and at a certain point they just hardcode the DNS to remove one variable from the equation when debugging bug reports.

X-Istence 2y ago
Not resolving 127.0.0.1 or RFC1918 addresses or even ULA for IPv6 is done to avoid DNS rebinding attacks. For most end users that is probably the correct move.
- lxgr 2y ago
  My home router even seems to inspect any UDP/53 traffic and redact any responses containing local/private A entries, so not even switching to a public resolver bypasses the protection. I agree that it’s usually the right behavior.
  - cj 2y ago
    Interesting. I hadn’t considered it might be a security feature of his router!
    - lxgr 2y ago
      In case you want to look into it further: My router actually allows adding exemptions to this policy on a per-hostname basis! Sometimes I wish it would allow wildcards, but honestly that's probably just another way for users to shoot themselves in the foot (e.g. by adding '*').
      - RulerOf 2y ago
        > Sometimes I wish it would allow wildcards pfSense for example uses unbound, and while it doesn't have a switch for disabling rebind protection, it does allow injecting arbitrary unbound config, which can disable rebind protection for any depth of a DNS zone or IP space. E.g.: server: private-address: 192.168.0.1/24 private-domain: plex.direct
troyvit 2y ago
Wayyyy back in 1995 or '96 I was working for a non-profit called "Next Generation Magazine" and our goal was to have young people write content for web sites to get their names out there. Back then it was all local ISPs, so we went to our ISP and asked for ngm.org and were stoked when we got it! We built out the site (Thanks to Building Killer Websites of course) and it looked awesome! Only problem was that nobody in my family out of state could see it. It took awhile to realize realize that we never bought that domain. Our local ISP just added it to their DNS records, and since we all hooked into them we thought we were live across the 'net.
- jonhohle 2y ago
  That’s incredible! I remember one of the first times I used the Internet and opened my local radio station’s website from several states away. It was incredible to me that it worked and I also wondered why anyone across the country would care. The early internet was amazing.

admax88qqq 2y ago

Most isp resolvers are shit and broken

egberts1 2y ago
That’s why it is imperative (at least, for a homelab hobbyist) to host your own DNS servers in your own VSP.
- admax88qqq 2y ago
  Totally, but most IoT customers are not homelab hobbyists, so I think its defensible for IoT vendors to just hard code known good DNS in their devices instead of relying on broken ISP resolvers. Related story, there was a period of time where my ISP's resolver that would replace hostnames with no DNS record with their own ad filled garbage page. So you mistype google.com to foofle.com or something and instead of getting "host not found" you get... ads. Disgusting behaviour IMO.