Hacker News

points by j45 2 days ago | 0 comments

One massive reason is they redirect requests for videos to closer (or local) caches of videos for netflix (directly from youtube placing it with a large enough ISP), or local caching at the ISP level so less traffic hits the internet.

If you've ever been hit with a "webpage isn't updating" issue when someone else can see it, often it's different DNS servers.

It's best to never use the ISP's DNS servers, regardless of the reason why they might do what they do.

[–] simonjgreen 1 day ago

Streaming provider edge optimisation is usually done using one of BGP or specific streaming provider config, depending on the platform, and is a positive in everyone’s interest

[–] xiconfjs 2 days ago

> It's best to never use the ISP's DNS servers, regardless of the reason why they might do what they do.

But providers overwriting DNS packets regardless – this is the topic of the article :)

P.S.: And yes, there are ways around this like DNSsec etc.

[–] j45 2 days ago

For sure, I read the article.

Introducing what ISPs do with DNS information is helpful to understand how encompassing DNS self-hosting needs to be thought about - DNS requests are important to consider the appropriate encryption for.

From the homelab side, increasingly with the automated attacks on systems, it seems wise to keep all services off the internet directly and put it behind one or more service to keep them safe. From that perspective, setting up something like Tailscale can also help mitigate this kind of issue.

[–] akerl_ 2 days ago

A reminder that the average consumer device doesn't actually validate DNSSEC in its default configuration: it relies on its recursive resolver to set a bit on the response saying "I validated DNSSEC, things are all good". In that configuration, DNSSEC gets you no protection against this.

One of the reasons a variety of providers have been pushing for DoH is because DoH fully closes the risk of ISP MITM without needing individual site operators to do anything. This is why you're seeing folks like Firefox and Chrome enable DoH by default.

[–] cowlevel 2 days ago

DoH is fine if a bit complicated. The problem is who the DoH provider is. Usually it's Cloudflare.

[–] account42 1 day ago

> One of the reasons a variety of providers have been pushing for DoH is because DoH fully closes the risk of ISP MITM without needing individual site operators to do anything.

... by replacing it with Google/Cloudflare MITM with whom the user doesn't even have a business relationship or even shared jurisdiction.

[–] akerl_ 1 day ago

The business relationship most home users have with their ISP explicitly permits that ISP to harvest data from their DNS requests.

[–] account42 1 day ago

I'm glad you know everyones ISP terms of services as well as the local laws that restrict which parts of them are worth a damn.

[–] akerl_ 1 day ago

Do you actually disagree with my claim, or is your concern purely that you don’t like my generalization?

[–] cowlevel 2 days ago

They don't mess with DNS to do that. The video provider points them to the appropriate cache. And it's usually only for video content, not the whole web app.