6 ms·

Google DNS servers suffer brief traffic hijack

45 points by lelf 13y ago

th0br0 13y ago
"internet performance metrics analyst firm Renesys" - now that's a long company type.
bjerun 13y ago
I'm using 8.8.8.8. Does this mean I might have a problem now (virus or similar)?
- MertsA 13y ago
  You wouldn't have been affected at all if you aren't in Brazil or Venezuela.
  - davb 13y ago
    That's not how I read it. It seems as though all traffic (globally) to those net blocks was rerouted to Venezuela, for a brief period.
    - thejosh 13y ago
      The rerouting affected networks in that country and Brazil for 22 minutes, BGPMon said.
josteink 13y ago
Why anyone would use a DNS server hosted by an ad & tracking-company on another continent instead of just using the one provided to you by your ISP one hop away is beyond me. In what bizarro world is that supposed to improve performance, security or anything?
- majke 13y ago
  > Why would anyone use a mail service hosted by an ad & tracking company? How about: because it's better?
  - josteink 13y ago
    Merely saying something "better" is hardly a well formed argument, now is it? If it is indeed better, which would be counter-intuitive, you should probably not have any problem digging up evidence that it is so? And by evidence, I mean metrics, measurements and stuff like that. You know, scientific standard and all. If I have DNS server 10ms away, you can bet your ass (and house) I can expect a smaller latency than from one hosted 6000 kilometres away across an Atlantic ocean and then some. And for me lower latency means faster, and faster means better. And being on the same network as me, I can expect much higher reliability than something halfway across the internet, no matter who hosts it. To me higher reliability is also better. What definition are you using, and where is your data to prove it? Unless your ISP's DNS server is a 486 collecting dust next to the janitors toilet, chances are you better served with that than doing continental-hopping network-traffic for every domain you need resolved.
    - icebraining 13y ago
      If I have DNS server 10ms away, you can bet your ass (and house) I can expect a smaller latency than from one hosted 6000 kilometres away across an Atlantic ocean and then some. You should look into "anycast". The Google DNS servers are located all across the globe. For example, I get 60ms from Portugal (just +30ms than I get to my ISP's server). And Google's servers, due to higher use, are much more likely to have the records in cache, reducing the overall latency when compared to a server than needs to issue a recursive query for every less commonly used domains.
    - JoshTriplett 13y ago
      > If I have DNS server 10ms away Ah, if only my ISP's DNS server were 10ms away, and reliably up, and not serving ads instead of NXDOMAIN results. Not that I'm deeply trusting of 8.8.8.8, but it definitely wins on each of those points. (I use a different "public" server.)
- VMG 13y ago
  because I've had worse experiences with my ISPs
  - josteink 13y ago
    One guy having issues with one ISP hardly makes a universal argument though.
    - VMG 13y ago
      I'm not making a universal argument, I'm answering your question
    - danpoage 13y ago
      People have explained, multiple times, why Google's DNS is better than their local ISP's (it is for me as well). Why do you continue to be antagonistic in your responses? A considerate person would acknowledge that they were misinformed (or failed to do a simple google search before trolling), instead you seem to have doubled-down on being obnoxious. Why?
- nyrina 13y ago
  Because my ISP (TDC) has been ordered by the Danish court to DNS block certain websites, such as the pirate bay.
- rowyourboat 13y ago
  Apparently I'm living in your bizarro world, because Google's DNS servers consistently outperform my home ISP's by a factor 2 or 3, spiking to 10, in terms of measured response time. So yes, my ISP sucks.
- eli 13y ago
  Unless they're lying about what they collect (https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy) I'm pretty comfortable with those terms. I would not be at all surprised if my ISP's DNS server is tracking me far more cloesly.
- acdha 13y ago
  See https://developers.google.com/speed/public-dns/ https://developers.google.com/speed/public-dns/ and in particular https://developers.google.com/speed/public-dns/docs/performance https://developers.google.com/speed/public-dns/docs/performa... and https://developers.google.com/speed/public-dns/faq#nxdomains https://developers.google.com/speed/public-dns/faq#nxdomains. You might have an ISP where they have professional DNS admins, significant failover and a massive deployment of local DNS caches in each neighborhood. Unfortunately, many people have ISPs where they have two servers for an entire timezone maintained by the owner's brother-in-law and, to the extent that they think of DNS at all, it's only for questions like “Can we sell advertising on NXDOMAIN replies?”
  - josteink 13y ago
    So basically, if we assume that everyone in the world except Google knows how to run a DNS-server, using their DNS-servers makes sense. I agree. But that's an absurd assumption, and I seriously disagree with it. And coming from a part of the world where we actually have ISPs compete (I know!), I find the premises plain laughable. I'm not saying there aren't ever a reason to use their DNS server, but I fail to see why people would chose to recommend theirs as a general rule (as I've seen lots of places, reddits, etc) and how Google with a straight face think they can claim it will make things "faster", or even worse, more "secure". Simply said: I call bullshit.
    - serf 13y ago
      I use it because every ISP i've used in North America hijacks shit and feeds it through their own search portal, driving me nuts in the process. I'd rather it get hijacked into a potentially useful Google query plus 8.8.8.8 is extremely easy to remember.
      - skyebook 13y ago
        And, at this point at least, it isn't getting hijacked. You just end up on a page that says there's nothing to see.
      - 13y ago
- bluedino 13y ago
  I've found many ISP's to have terrible DNS servers. They update slowly, they might hijack requests, etc.
- pbhjpbhj 13y ago
  I used a nameserver tester to compare my ISP's servers with Google and OpenDNS's. OpenDNS came out on top for me at that time and I was interested in their filtering ability too so I went with that. IIRC it was https://code.google.com/p/namebench/ https://code.google.com/p/namebench/ that I used for the speed comparison. Just using it now I see it does a comparison with the popular global DNS providers as well as optionally local providers - it also can test for censorship. There are many DNS benchmarking tools; https://www.grc.com/dns/benchmark.htm https://www.grc.com/dns/benchmark.htm looks quite good.
- ithkuil 13y ago
  I don't think it's served from another continent. It's an anycast address and I guess it's served from many replicas with global coverage.
jfoster 13y ago
A few days prior to this Google App Engine apps that were using custom domains started redirecting to google.com for about 3 - 4 hours. (Google hasn't acknowledged that publicly yet, but did set a security flag on one of the issues on the appengine issue tracker) https://code.google.com/p/googleappengine/issues/detail?id=10699 https://code.google.com/p/googleappengine/issues/detail?id=1... Potentially related, perhaps?
orvtech 13y ago
Leaving politics and ideology aside, there are precedents to consider... back in 2012 Malaysia had a similar situation but the outage was wider and more pronounced. A different precedent is the fact that phishing sites for social networks have been found on Venezuela's government-operated ISP servers not that long a go http://orvtech.com/en/general/gobierno-venezolano-elecciones-proxy-twitter/ http://orvtech.com/en/general/gobierno-venezolano-elecciones...

45 points by lelf 13y ago

th0br0 13y ago

"internet performance metrics analyst firm Renesys" - now that's a long company type.

bjerun 13y ago

I'm using 8.8.8.8. Does this mean I might have a problem now (virus or similar)?

MertsA 13y ago
You wouldn't have been affected at all if you aren't in Brazil or Venezuela.
- davb 13y ago
  That's not how I read it. It seems as though all traffic (globally) to those net blocks was rerouted to Venezuela, for a brief period.
  - thejosh 13y ago
    The rerouting affected networks in that country and Brazil for 22 minutes, BGPMon said.

josteink 13y ago

Why anyone would use a DNS server hosted by an ad & tracking-company on another continent instead of just using the one provided to you by your ISP one hop away is beyond me. In what bizarro world is that supposed to improve performance, security or anything?

majke 13y ago
> Why would anyone use a mail service hosted by an ad & tracking company? How about: because it's better?
- josteink 13y ago
  Merely saying something "better" is hardly a well formed argument, now is it? If it is indeed better, which would be counter-intuitive, you should probably not have any problem digging up evidence that it is so? And by evidence, I mean metrics, measurements and stuff like that. You know, scientific standard and all. If I have DNS server 10ms away, you can bet your ass (and house) I can expect a smaller latency than from one hosted 6000 kilometres away across an Atlantic ocean and then some. And for me lower latency means faster, and faster means better. And being on the same network as me, I can expect much higher reliability than something halfway across the internet, no matter who hosts it. To me higher reliability is also better. What definition are you using, and where is your data to prove it? Unless your ISP's DNS server is a 486 collecting dust next to the janitors toilet, chances are you better served with that than doing continental-hopping network-traffic for every domain you need resolved.
  - icebraining 13y ago
    If I have DNS server 10ms away, you can bet your ass (and house) I can expect a smaller latency than from one hosted 6000 kilometres away across an Atlantic ocean and then some. You should look into "anycast". The Google DNS servers are located all across the globe. For example, I get 60ms from Portugal (just +30ms than I get to my ISP's server). And Google's servers, due to higher use, are much more likely to have the records in cache, reducing the overall latency when compared to a server than needs to issue a recursive query for every less commonly used domains.
  - JoshTriplett 13y ago
    > If I have DNS server 10ms away Ah, if only my ISP's DNS server were 10ms away, and reliably up, and not serving ads instead of NXDOMAIN results. Not that I'm deeply trusting of 8.8.8.8, but it definitely wins on each of those points. (I use a different "public" server.)
VMG 13y ago
because I've had worse experiences with my ISPs
- josteink 13y ago
  One guy having issues with one ISP hardly makes a universal argument though.
  - VMG 13y ago
    I'm not making a universal argument, I'm answering your question
  - danpoage 13y ago
    People have explained, multiple times, why Google's DNS is better than their local ISP's (it is for me as well). Why do you continue to be antagonistic in your responses? A considerate person would acknowledge that they were misinformed (or failed to do a simple google search before trolling), instead you seem to have doubled-down on being obnoxious. Why?
nyrina 13y ago
Because my ISP (TDC) has been ordered by the Danish court to DNS block certain websites, such as the pirate bay.
rowyourboat 13y ago
Apparently I'm living in your bizarro world, because Google's DNS servers consistently outperform my home ISP's by a factor 2 or 3, spiking to 10, in terms of measured response time. So yes, my ISP sucks.
eli 13y ago
Unless they're lying about what they collect (https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy) I'm pretty comfortable with those terms. I would not be at all surprised if my ISP's DNS server is tracking me far more cloesly.
acdha 13y ago
See https://developers.google.com/speed/public-dns/ https://developers.google.com/speed/public-dns/ and in particular https://developers.google.com/speed/public-dns/docs/performance https://developers.google.com/speed/public-dns/docs/performa... and https://developers.google.com/speed/public-dns/faq#nxdomains https://developers.google.com/speed/public-dns/faq#nxdomains. You might have an ISP where they have professional DNS admins, significant failover and a massive deployment of local DNS caches in each neighborhood. Unfortunately, many people have ISPs where they have two servers for an entire timezone maintained by the owner's brother-in-law and, to the extent that they think of DNS at all, it's only for questions like “Can we sell advertising on NXDOMAIN replies?”
- josteink 13y ago
  So basically, if we assume that everyone in the world except Google knows how to run a DNS-server, using their DNS-servers makes sense. I agree. But that's an absurd assumption, and I seriously disagree with it. And coming from a part of the world where we actually have ISPs compete (I know!), I find the premises plain laughable. I'm not saying there aren't ever a reason to use their DNS server, but I fail to see why people would chose to recommend theirs as a general rule (as I've seen lots of places, reddits, etc) and how Google with a straight face think they can claim it will make things "faster", or even worse, more "secure". Simply said: I call bullshit.
  - serf 13y ago
    I use it because every ISP i've used in North America hijacks shit and feeds it through their own search portal, driving me nuts in the process. I'd rather it get hijacked into a potentially useful Google query plus 8.8.8.8 is extremely easy to remember.
    - skyebook 13y ago
      And, at this point at least, it isn't getting hijacked. You just end up on a page that says there's nothing to see.
    - 13y ago
bluedino 13y ago
I've found many ISP's to have terrible DNS servers. They update slowly, they might hijack requests, etc.
pbhjpbhj 13y ago
I used a nameserver tester to compare my ISP's servers with Google and OpenDNS's. OpenDNS came out on top for me at that time and I was interested in their filtering ability too so I went with that. IIRC it was https://code.google.com/p/namebench/ https://code.google.com/p/namebench/ that I used for the speed comparison. Just using it now I see it does a comparison with the popular global DNS providers as well as optionally local providers - it also can test for censorship. There are many DNS benchmarking tools; https://www.grc.com/dns/benchmark.htm https://www.grc.com/dns/benchmark.htm looks quite good.
ithkuil 13y ago
I don't think it's served from another continent. It's an anycast address and I guess it's served from many replicas with global coverage.

jfoster 13y ago

A few days prior to this Google App Engine apps that were using custom domains started redirecting to google.com for about 3 - 4 hours. (Google hasn't acknowledged that publicly yet, but did set a security flag on one of the issues on the appengine issue tracker) https://code.google.com/p/googleappengine/issues/detail?id=10699 https://code.google.com/p/googleappengine/issues/detail?id=1... Potentially related, perhaps?

orvtech 13y ago

Leaving politics and ideology aside, there are precedents to consider... back in 2012 Malaysia had a similar situation but the outage was wider and more pronounced. A different precedent is the fact that phishing sites for social networks have been found on Venezuela's government-operated ISP servers not that long a go http://orvtech.com/en/general/gobierno-venezolano-elecciones-proxy-twitter/ http://orvtech.com/en/general/gobierno-venezolano-elecciones...