Hacker News Reader

Comment by alias_neo | Hacker News Reader

It's not new, and but limited to Chromecast Ultra, I detected this from several Android devices (phones) pre-Pie and configured my firewall to redirect those requests to my own DNS.

Regardless of their reason, many of us don't want to use Google DNS and the just using their control over these devices to force people to 8.8.8.8/8.8.4.4.

I haven't checked how Pie behaves yet but it provides an option in the UI to specify private DNS.

Also, I found some time ago, and am not sure if it's still the case, but some of their first-party apps hard coded Google DNS, so seeing one at the system level was irrelevant.

View on HN

Google's business is built on web services, and we know for a fact that ISP occasionally try to inject bullshit into their customers browsing sessions via all kinds of dirty tricks. Their DNS is also designed to be faster than typical DNS. I wouldn't be surprised if Google sees this as a way to ensure the proper function of their devices.

I'm not arguing with that, but lots of us can and do run our own DNS for various reasons, it should respect that, or provide a power-user way to override the default DNS.

By all means offer fall-backs to Google DNS if it's not behaving correctly, for the reason you mention.

I've found it's also, quite poorly implemented, particular on CC Audios, I had an instance last year where my internet connection went down at my ISP, my DNS saw 10s of thousands of DNS queries per-device from each of my Chromecast Audio devices in the time I was out at work. It was almost 40k DNS queries in ~12 hours, per device.

Almost everything else on my network behaved normally, but the Google devices just went mental spamming the network with insane numbers of impossible requests, back-offs are a thing, they should use them.

DNAT

This is what I've done, I mentioned it in another comment, but we shouldn't have to resort to that.

At least until Google starts DNS over TLS with cert pinning.

This is an incredibly generous reading of the situation that, as far as I can tell, has no basis in reality. Google is circumventing how the internet works at pretty basic level by not respecting users' DNS preferences in favor of their own.

The consumer of the DNS is the Chromecast. Its preference is 8.8.8.8 .

A Chromecast isn't an agent with free will and intentions, the user is. When I set my DNS settings to a different DNS server than Google's, my preference is just that: different from Google's.

I think your humor detection algorithm needs some enhancement.

Chromcasts are sentient now? Wow, that should be the headline!

I'm clearly meaning the choices made by the Chromecast via the product and service owners and creators. The thing is a consumer IoT device with a lot of blackbox going on. It's consuming the DNS service to provide another service to the end user. How that happens is trivia to most people.

I think it's fine to want that configurable and maybe, maybe even expect or ask for it.. But I believe concocting conspiracy and assigning malicious intent so readily, as many are, displays either an ignorance of how products get built for the mass market or a feigning of such. As others who have worked on IoT devices have pointed out, there are rather valid user experience concerns behind baking these "preferences" into the products.

Obviously, I knew what you meant. You just expressed it in a humorous (and, I think, not entirely valid) way, granting agency to the device rather than people.

> As others who have worked on IoT devices have pointed out, there are rather valid user experience concerns behind baking these "preferences" into the products.

Which is something that I have not denied. What I assert is that there absolutely needs to be a way to change that behavior if users wish. The lack of that ability is, in my opinion, something that is harmful, both technically and socially.

The owner of the Chromecast decides which DNS to use, unless we decide that Google keeps owning it and the sale is not a sale.

The internet does not work on top of DNS. DNS works on top of the internet. Nothing about IPv4 was circumvented here, and IPv6 is even built to not need/use DHCP at all.

There is no mandate or expectation that all DHCP clients always use the advertised DNS settings. If there was than alternate DNS services like 1.1.1.1 or 8.8.8.8 wouldn't even exist in the first place, as your ISP would be in complete control of your DNS settings unless you splurged for a static IP.

The cast client decided to use its own DNS settings as many clients do - you can override the DHCP settings on just about any general purpose OS, for example. Even though they are DHCP clients. Do you call Linux allowing you to specify a DNS server as "circumventing how the internet works at a pretty basic level", too?

Do you call Linux allowing you to specify a DNS server as "circumventing how the internet works at a pretty basic level", too?

There's a vast difference between "users can configure it to what they want" and "it's hardcoded and can't be changed".

In both cases the client software ignored the network's settings. It's identical in behavior to the network.

Either that's circumventing how the internet works or it isn't.

Sounds like you agree that it's not, in fact, circumventing how the internet works?

The critical difference is whether it is under control of the user.

That's a critical difference which has nothing to do with "how the internet works".

I suspect it's to keep people from using Pi-holes or other DNS level adblockers. A non-ultra chromecast will totally ignore the routers preferred DNS unless you blackhole 8.8.8.8 and 8.8.4.4, then it'll fallback to the DNS server you actually want it to use.

Transparent DNS proxy is a thing, plenty of ISPs have been using them for more than a decade. I know mine does because occasionally they hit a snag and setting your DNS to 8.8.8.8 wont help because any request over port 53 is silently intercepted.

Like somebody said below, this is pretty much a non issue unless google starts to force DNSSEC and certificate pinning.

It should obey DHCP or static dns settings like any normal network device. It's so typical of google's attitude of "know better" and imposing arbitrary rules of their own just because they can. This "proper function" actually breaks any function on firewalled network. So paint it as failed.

I wonder if 8.8.8.8 still has a per-IP rate limit, and what the consequences for people behind a CGNAT would be.

Still 2 years ago that rate limit was pretty easy to hit by accident with a Selenium browser farm accessing through single public IP.

Reply on news.ycombinator.com