Google Launches Public DNS Resolver 540
AdmiralXyz writes "Google has announced the launch of their free DNS resolution service, called Google Public DNS. According to their blog post, Google Public DNS uses continuous record prefetching to avoid cache misses — hopefully making the service faster — and implements a variety of techniques to block spoofing attempts. They also say that (unlike an increasing number of ISPs), Google Public DNS behaves exactly according to the DNS standard, and will not redirect you to advertising in the event of a failed lookup. Very cool, but of course there are questions about Google's true motivations behind knowing every site you visit."
I guess it is good news... (Score:5, Interesting)
> They also say that (unlike an increasing number of ISPs), Google Public DNS behaves exactly according to the DNS standard.
Congratulations, this would then be the first free service that I know of which doesn't do redirect ! ;-)
I setup my own DNS but I guess it is a little overkill for the common every day user. Setting your own DNS means you have to go to the network (e.g. internet) less often because your locally hosted DNS caches the already visited sites for a TTL period of time. This is especially true if you have several computers and that they tend to visit the same sites.
Let me add that if your ISP or firewall intercepts requests to port 53, you will still be stuck with it ;-(
Re:I guess it is good news... (Score:5, Insightful)
Congratulations, this would then be the first free service that I know of which doesn't do redirect ! ;-)
I guess they're using that as a selling point and to come of "nicer". If they're just after datamining the DNS requests, this service can happily run on negative income, because it improves Google's other things and provides them even more data.
Google is datamining everywhere and everything already.
Better Google than your ISP (Score:5, Insightful)
Google is datamining everywhere and everything already.
When I first read about this, I immediately thought about datamining. But after another second, I figured that I would prefer Google to have this information than Verizon (where my caching DNS server currently forwards to). It is true that Google is better at datamining, but do keep in mind that whoever is providing your DNS service has the information about your DNS requests.
Another difference between Google and your ISP is that your ISP knows who you are from your IP address. So they can link DNS resolution requests to specific, named, customers. Google can't do that directly.
Re:Better Google than your ISP (Score:4, Interesting)
Re: (Score:3, Insightful)
What makes you think Verizon isn't doing packet inspection to datamine regardless?
It takes leaving a default setting unchanged to have logs of all DNS requests that Verizon's servers answer. The effort spent: zero. The data volume: minimal (only DNS requests.)
It takes a lot more to inspect all packets (TCP and UDP) that may be related to DNS. It has to be bought, then connected to the main data link(s), then configured to log what you want, then maintained. On Verizon's scale it's some serious money ri
Re:I guess it is good news... (Score:4, Interesting)
Yeah, but so is my ISP.
Virgin Media keep extensive logs of DNS requests, as the government requires them to, for at least one year. Google keep your IP address logged for 24 hours, then remove it and keep the other DNS request data for an indefinite period.
What is more concerning to me is that my ISP knows who I am. They can easily link up DNS requests with my account and billing details. Google probably could link it up with their other data pools if they wanted to, but they don't require you to have a Google account to use their servers so you don't have to provide them with any more details than your current IP address. E.g. you could use Yahoo for all searches and never send Google any more than just an IP address.
What it boils down to is that I trust Google a lot more than I trust Virgin Media. At least Google publishes what they do with your data and doesn't sell it to third parties.
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
They're not doing any datamining with the resolvers, beyond keeping an eye out for performance and abuse issues. From their privacy page [google.com]:
Re:I guess it is good news... (Score:5, Informative)
If they're just after datamining the DNS requests, this service can happily run on negative income, because it improves Google's other things and provides them even more data.
This is untrue. From the Google DNS privacy page [google.com], linked from the blog post (emphasis added):
Google Public DNS stores two sets of logs: temporary and permanent. The temporary logs store the full IP address of the machine you're using. We have to do this so that we can spot potentially bad things like DDoS attacks and so we can fix problems, such as particular domains not showing up for specific users. We delete these temporary logs within 24 to 48 hours.
In the permanent logs, we don't keep personally identifiable information or IP information. We do keep some location information (at the city/metro level) so that we can conduct debugging, analyze abuse phenomena and improve the Google Public DNS prefetching feature. We don't correlate or combine your information from these logs with any other log data that Google might have about your use of other services, such as data from Web Search and data from advertising on the Google content network. After keeping this data for two weeks, we randomly sample a small subset for permanent storage.
That page also details exactly what features are logged. Does your current upstream DNS provider document their logging policies?
Disclaimer: I work for Google, but I will cite my sources.
Re:I guess it is good news... (Score:5, Funny)
This is a good think
It's also double plus ironic.
Re: (Score:3, Insightful)
Read 1984. Not just to get my joke, but it's also a great book. Plus you'll understand what people mean by Big Brother (it's *much* more sinister than just someone else taking care of you).
So, are you volunteering? (Score:5, Insightful)
No, but we're smart enough to realize that no one is going to pay out of pocket to provide all the services that Google does for free with no revenue model at all, not even to pay for the infrastructure servers and network necessary to do it.
I'll make you a deal. Multi-billionaire technology philanthropist that you seem to be, you set up a company to compete with Google, one that provides all that they do and that has exactly zero sources of revenue, and I'll willingly become your fanboy.
The practical situation is that there ain't no such thing as a free lunch. When Google came along, we were headed towards every web site--especially search engines and directories--pushing out more and more pop-ups, pop-unders, interstitials, graphics-heavy, annoying ads, and they changed that. God forbid any of them actually contribute back to the community in the form of numerous open source projects and free services.
Google changed all that by providing a much more customer-friendly "less is more" philosophy, and their customers have supported their efforts in a very free market-friendly way. So while you can take potshots at targeted advertising if you want, I honestly can't think of a less obtrusive and relatively harmless revenue model that can support all that Google does and how much they are contributing to advancing technology.
While I'd love for someone to volunteer to do all that Google does without making money for it, given that that's not going to happen, yeah, targeted advertising is about the least annoying way I can think of to get the bills paid and continue providing service.
Re: (Score:3, Informative)
Those aren't personally targeted ads, they're just matched well to the demographic and geographic in which they're placed.
They may not be individually targeted, but they *are* targeted.
Re:I guess it is good news... (Score:4, Insightful)
I think that Google gets the free pass because they have so far shown themselves to be the least intrusive, paternalistic and/or come the closest to giving us what we want. And they stand out a fair distance from the rest of the bunch.
Most of us acknowledge that there isn't a free lunch, so Google *so far* has been enabling the internet to function on its technical capabilities while making a profit. Surely you recognise that a lot of business models block the capabilities of technology to bolster their profits? Google seems to take the opposite approach. This often leads to businesses complaining about their methods, but consumers/customers/collaborators are enabled.
Re: (Score:3, Funny)
My browsing history would likely result in spammy poppups.
*sigh*
Why not do both? (Score:5, Insightful)
Set up your own DNS server and point it at google's.
Then you can take advantage of your cache and their cache.
google could do us a great service by also making it available on some other port, that way we can get around the ISP interception of DNS requests.
Re:Why not do both? (Score:5, Funny)
Re:Why not do both? (Score:5, Interesting)
Definitely this. My ISP changed their upstream provider and *their* network was intercepting requests on port 53. Luckily, I also administer DNS on another network so set up a bypass on port 54. Personally, I think providing false DNS information should count as fraud.
Re:I guess it is good news... (Score:5, Informative)
4.2.2.2 and their ilk are free and non-redirecting. You can use 4.2.2.1 4.2.2.2 4.2.2.3 4.2.2.4 4.2.2.5 or 4.2.2.6
They are run by L-3 and sitting on major backbones, and the ip addresses are pooled, so that you will likely get a server that is geographically near you when you use one of those addresses.
Re: (Score:3, Insightful)
4.2.2.2 and their ilk are free and non-redirecting
Yes, but who is gtei.net?
Good question (Score:3, Informative)
spliffy@localhost:~$ whois gtei.net
Registrant:
Verizon Trademark Services LLC
Verizon Trademark Services LLC
1320 North Court House Road
Arlington VA 22201
US
domainlegalcontact@verizon.com +1.7033513164 Fax: +1.7033513669
Re:I guess it is good news... (Score:5, Informative)
Brief history lesson:
DARPA asked BBN to build the arpanet. They built and owned Autonomous System Number 1. (ASN1)
BBN split into BBN Technologies and BBN Networking. BBN Technologies went of and did their own thing. BBN Networking kept ASN1 and grew into a tier 1 ISP.
GTE bought BBN Networking and renamed the division GTE Internet ( aka GTEI )
Southern Bell bought GTE but wasn't allowed to keep all of it due to monopoly laws put in place during the Ma Bell breakup. They renamed the Telco part Verizon and spun off the infringing internet bit as Genuity.
Genuity was funded through a 'guaranteed' $2B revolving credit line by Verizon.
Verizon lobbied enough people to overturn enough of regulations such that they no longer needed Genuity at all, and dumped the loan.
Genuity's remaing assets were sold in bankruptcy to Level 3 Communications, including ASN1, the 4.0.0.0/8 and 8.0.0.0/8 ARIN allocations and the gtei.net name.
Re:I guess it is good news... (Score:5, Interesting)
Re: (Score:3, Informative)
link [circleid.com]
I've seen a bunch of other comments like that from people who seem to know tech people over at L3, combined with the behavior we saw after these comments started popping up and I have to assume that L3 was intentionally introducing the delay to wakeup non-customers to switch off them.
Re: (Score:3, Informative)
> this would then be the first free service that I know of which doesn't do redirect
Well, there are *tons* of them. And fast. Download this program (if you're on Windows), run it, and see which are good for you. Redirecting and "strict" are marked with different colors.
http://www.grc.com/dns/benchmark.htm [grc.com]
Re: (Score:3, Interesting)
Yup, I run my own DNS - in part because I also want to have local hostnames and a bit more control over dhcp/etc.
It also is nice to be able to blackhole any domain I like and kill 80% of the ads and intrusive cookies out there. When I'm browsing on wi-fi from the cellphone I'm amused to see all the banner ads go away desipte it not having an ad blocker.
Re:I guess it is good news... (Score:4, Funny)
Of course you can still have cache misses.
You: Gimme goat.se
Google: That's not in my cache, hold on.
Google: Hey auth DNS gimme goat.se
Auth: K, here.
Google: Hey you, here.
You: K.
Your mom: Gimme goat.se:
Google: Yeah, I have that, here.
Your mom: K.
Your dad: I NEED the goat.se !
Google: Yeah I have that, but I need to recache it. Here's what I already have, it's probably still good.
Google: Hey auth DNS gimme goat.se
Auth: K, here.
Your dad: WTF? Where's the gaping anus?!
Google: Yeah, looks like the one I gave you before was wrong. No worries, this one is fresh.
Your dad: Sweet mother of corn holes.
Updating your cache early doesn't solve anything. You get less of a chance of misses only because you've checked more frequently. This comes at a performance cost on Google's end. Any DNS provider can cache anything for however long they want and return whatever result they think is valid.
The obvious thing to do is return your most recent authoritative result for cached domains or get one if it's not a cached domain. Choosing to empty out your cache after something has expired vs. refreshing it from auth is a performance decision. As is choosing whether or not to dump something when updating, or keep it around in case you get requests for it while you're updating. As is the overall frequency with which you update your cache.
No magic, brilliance, or good will on Google's part here - just horsepower and the willingness to operate at a financial loss in order to mine more data.
Re:I guess it is good news... (Score:4, Interesting)
Re: (Score:3, Interesting)
Besides 8.8.8.8 and 8.8.4.4 it looks like there's 4.3.2.1
$ whois 4.3.2.1
Level 3 Communications, Inc. LVLT-ORG-4-8 (NET-4-0-0-0-1)
4.0.0.0 - 4.255.255.255
Google Incorporated LVLT-GOOGL-1-4-
DDoS attacks (Score:4, Interesting)
But I thought open recursive DNS servers were bad -- haven't you heard of DNS DDoS amplification attacks? Why would Google's open recursive DNS service be any better in this regard?
Re:DDoS attacks (Score:5, Informative)
Google's DNS service defends against DDoS amplification attacks by using rate-limiting techniques. From Google: [google.com]
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
I'm no expert on DNS DDoS amplification attacks, but reading up on them (including what Google has to say about them) I don't know what makes you say they only apply to consumer lines.
First of all, even if it were impossible to overwhelm Google's bandwidth, that wouldn't stop an attacker from using Google's open resolver in an amplification attack against some other target; in that regard, it woudl be better if Google were running it from an employee's basement.
Besides, it appears this type of attack has be
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
DNS is simple?
BIND has what, 200 releases in the 9.x branch alone? There are more BIND releases than there are Linux kernels, and that's saying something!
Re: (Score:3, Informative)
That's indicative of the fact that DNS is a fundamental piece of the internet framework and those who develop it realize security issues must be fixed as soon as possible. I can't tell you how many BIND releases have been to only address one security issue.
At least they have a clear privacy policy (Score:5, Informative)
They state very bluntly that IP addresses are expunged from the logs after 48 hours, and that no data is shared with Google Accounts or other Google services. They still get to play with a lot of aggregated data, but this seems like a fairly non-evil way to do it. Good for them. http://code.google.com/speed/public-dns/faq.html#privacy [google.com]
Re: (Score:3, Insightful)
Add to that the fact that some IP addresses are shared by a lot of virtual sites which makes statistics about as precise as the slashdot polls.
Re:At least they have a clear privacy policy (Score:5, Insightful)
Re: (Score:3, Insightful)
mod parent up!
the current google is somewhat evil; we have no idea what happens LATER when, uhh, the TOS get changed (somehow...)
"the first one is free". remember that phrase. it applies here, too, in concept.
Re:At least they have a clear privacy policy (Score:4, Interesting)
Re: (Score:3, Insightful)
Other companies, perhaps. But when has Google ever made their ToS more evil?
As far as I'm concerned, Google has done nothing to undermine our trust in their sincerity. If you have examples, though, I'm more than willing to dig in to it.
Re: (Score:3, Insightful)
I don't see any reason Google (or any other for profit company) would offer a service like this and say that they will never ever look at any of the data.
Oh they'll look at the data. They'll just pseudonymize it first.
Don't get me wrong, I love Google. (Score:5, Interesting)
Re:Don't get me wrong, I love Google. (Score:4, Funny)
Yeah, Google knows everything about me... except who I am!
Re:Don't get me wrong, I love Google. (Score:5, Funny)
Underwear and t-shirt? Why would I need underwear and a t-shirt?
Re:Don't get me wrong, I love Google. (Score:5, Insightful)
There is a lot of amazing advantages to having your data aggregated the way that Google has it, and it's not rocket science to manage the downsides.
Re: (Score:3, Interesting)
I'm hoping the current leadership is/will be smart enough to put some kind of clever legal strictures in place that ties the hands of whoever may run the company after them in such a way as to enforce the "don't be evil" ethic.
Re: (Score:3, Funny)
"What I search for, where I surf to, with my Droid where I navigate to, my e-mails, my documents. WOW."
They follow your world of warcraft account? That's going too far.
Re:so? (Score:5, Funny)
fEEL FREE TO OPT OUT AT ANY TIME.
They have a great program [theonion.com] for that!
Why? (Score:5, Insightful)
But why would one change to use Google's DNS? If you're technical enough and care about such, you're way better off setting up your own recursive DNS server.
Google is just datamining from DNS requests here, it's another source of information. At least with your own ISP you can reasonably think that theres no datamining going on (excluding US ISP's, of course, who serve ads on non-existing domains for their users anyway)
Re:Why? (Score:4, Insightful)
Re:Why? (Score:5, Insightful)
You know what? If I did what comcast has done with intercepting DNS requests and corrupting DNS responses, I would be committing 2 or more federal felonies, for profit no less. I would like some justice.
Re: (Score:3, Informative)
Because it's not a crime when some big faceless company does it.
Re:Why? (Score:5, Funny)
Re: (Score:3, Insightful)
Because setting up and maintaining your own recursive DNS server is a pain in the ass? (Especially compared to the workload of "here, just change this one setting and it will go faster")
Re: (Score:3, Interesting)
But really, I have been running servers of all sorts for years now and the only ones that require any significant amount of maintenance are the HTTP ones due to their content going stagnant (gopher does not count here as its OK to have stagnant content, makes it look more 'nostalgic' if it hasn't been updated in years I suppose)
A
Re: (Score:3, Insightful)
Why would I invest two hours and a spare machine into setting up my own DNS server when I can spend thirty seconds changing a setting on my router?
As for maintenance... Why should I invest time updating the software that runs these servers every time a new security vulnerability is discovered? Why should I even have to check for updates, when someone else is doing it all for free? Why should I pay for the electricity to run the additional machine? (You're going to say "run it on your desktop", but what i
Re:Why? (Score:5, Insightful)
That depends on whether you're running a Linux box at home in a "reliable enough" way to be functioning as a server. And in the example you give, as your primary machine as well. While I realize that many /. users do this, I would certainly say that most people don't.
I actually stopped doing it several years ago. I concluded that I have to maintain enough complex systems at work; I don't see any need to be a sysadmin for a complex system that requires nonstop patching and understanding of 30-year-old system internals at home, too. Plus the desktop environment was frankly primitive compared to modern machines. So I ditched it and started running OS X. (And I should say that I'm an experienced Linux sysadmin and engineer professionally, so this was not the "I don't know how to use it and it appears to have been designed by badgers" issue)
It's definitely true that, if you're already doing all of the work to run your own system at home, adding a DNS server isn't a big deal. But that's really a hobbyist thing to do. If your home system is primarily for the purpose of getting things done, rather than for playing with systems, it's an enormous amount of extra work. Yet having faster DNS lookups is still a win.
Maybe They Just Want People To Access Their Site (Score:3, Interesting)
Re:Why? (Score:4, Informative)
While the OpenDNS name resolution service is free, people have complained about how the service handles failed requests. If a domain cannot be found, the service redirects you to a search page with search results and advertising provided by Yahoo!. A DNS user can switch this off via the OpenDNS Control Panel but will lose content filtering ability. This behavior is similar to that of many large ISP's who also redirect failed requests to their own servers containing advertising. [12]
In 2007, David Ulevitch explained that in response to Dell installing "Browser Address Error Redirector" software on their PCs, OpenDNS started resolving requests to Google.com. Some of the traffic is handled by OpenDNS typo-correcting service which corrects mistyped addresses and redirects keyword addresses to OpenDNS's search page, while the rest is transparently passed through to the intended recipient.[13]
Also, a user's search request from the address bar of a browser that is configured to use the Google search engine (with a certain parameter configured) may be covertly redirected to a server owned by OpenDNS without the user's consent (but within the OpenDNS Terms of Service).[14] Users can disable this behavior by logging in to their OpenDNS account and unchecking "OpenDNS proxy" option.[15] Additionally, Mozilla users can fix this problem by installing an extension[16] or by simply changing or removing the navclient sourceid from their keyword search URLs.
This redirection breaks some non-web applications which rely on getting an NXDOMAIN for non-existent domains, such as e-mail spam filtering, or VPN access where the private network's nameservers are consulted only when the public ones fail to resolve.
Re: (Score:3, Insightful)
> if you think a business is not going to collect
> all the information they can about their
>customers, you are quite deluded.
``We don't run any sort of transparent proxies or other systems to covertly log what you do on the internet, and do not sell data to anyone.''
That's from my ISP. Doesn't yours say something similar?
If not, change.
8.8.8.8/4 (Score:4, Insightful)
"To try it out:
Configure your network settings to use the IP addresses 8.8.8.8 and 8.8.4.4 as your DNS servers..."
Simple enough to remember which is great. Also - could this be used to circumvent some of the internet security at some workplaces where they seem to run a blacklist of specific sites?
Re:8.8.8.8/4 (Score:5, Funny)
Would be interesting to know how much Google paid for those two 256 ranges to Level 3. One would think simple ip's like 8.8.8.8 would cost some nice amount too.
Or maybe they should had used the coolest ip on the net, aka
> host 69.69.69.69
69.69.69.69.in-addr.arpa domain name pointer the-coolest-ip-on-the-net.com.
Re:8.8.8.8/4 (Score:4, Informative)
Anyone running Windows Server as their internal DNS server is probably forwarding DNS requests to an external name server. The workstation DNS settings are most likely controlled with DHCP, and if the admin has half a brain (I know, that's a big assumption), the users don't have rights to change the network settings.
Most internet security applications are usually proxy servers, or something like a Websense box. Those filter all traffic regardless of where the name resolution takes place. In fact, Websense can be configured to block DNS requests to non-approved / external servers (as can any firewall, etc).
Do your network admins a favor and use your work computer for work. Don't try to get around their access controls. Most of the time they'd love to give you free access to the internet, but the reality is that they are responsible for keeping Windows boxes secure. That isn't an easy job. What you might perceive as network admin Nazi behaviors is really just them protecting you from yourself... or your co-workers from themselves, etc.
Re:8.8.8.8/4 (Score:5, Informative)
Not everyday (Score:4, Insightful)
Forget everyday use, but on public wifi, I'm all about this!
Re: (Score:3, Informative)
Mod parent up - DHCP on a public node can make dragons fly out of your nose.
Questions? (Score:5, Insightful)
...but of course there are questions about Google's true motivations behind knowing every site you visit.
No there aren't. You'd have to have been living under a rock for the past decade to have any questions about their motives. It's dead simple - they want to know what people are looking at so that they can better target people with advertising thereby increasing the value of their service. In return for offering various free services, all they ask for is some information on you so that they can better target advertising that interests _YOU_. It's not rocket science - it's just incredibly effective marketing.
Re: (Score:3, Informative)
From the page:
We don't correlate or combine your information from these logs with any other log data that Google might have about your use of other services, such as data from Web Search and data from advertising on the Google content network.
Re:Questions? (Score:5, Informative)
Except in this case, they claim your IP will be gone from their logs in 24 hours, and it'll never be associated with anything else you do at Google.
My guess is, they want broad statistics like the most popular domains visited, maybe even traffic patterns of which domains people tend to go to after which other domains.
So you're right, the motives are quite transparent. Except in this case, I have no idea why I wouldn't want to participate. It's likely to be a hell of a lot more responsive than my ISP's DNS.
Re:Questions? (Score:5, Interesting)
"My guess is, they want broad statistics like the most popular domains visited, maybe even traffic patterns of which domains people tend to go to after which other domains."
I'd go further. Given the announcement of Chrome OS, I wouldn't doubt they want to test a huge number of DNS requests and tweak the system to be as fast as possible to speed up Chrome. Google knows latency is an issue with web apps, and is trying to do all they can to reduce this. I think this is just another step in that direction.
Re: (Score:3, Insightful)
Re:Questions? (Score:5, Insightful)
And sorry, but just to complete the thought, there's a very good reason why Google would want to do this even if they don't get any data mining or ad revenue in any direct way: Think about all the other services (OpenDNS or ISPs) that redirect failed searches to their own search page. Every time that happens, that's a search that doesn't go through Google. As far as Google is concerned, you getting a proper response of "This page doesn't exist" is good for them, because they know your next stop will be Google.com.
Google was going to hire DJB to make this work (Score:5, Funny)
Why all the paranoia over Google? (Score:4, Interesting)
Look.. Google's in the advertising and data aggregation business, yes. But ... there is a level of suspicion and fear directed at Google that just seems extreme. Has Google actually done something "Evil" that I missed? Or it is just paranoia? I personally think that it's much more likely that OpenDNS or my ISP would do something crazy with this sort of information than Google.
Re: (Score:3, Insightful)
"But ... there is a level of suspicion and fear directed at Google that just seems extreme. Has Google actually done something "Evil" that I missed?"
They might have. Would we be able to know, at this point, if they did? Do we still have third parties able to compete with them and provide checks and balances over the information they feed us?
The problem with Google (and the other big players, such as the social networks) is that they are increasingly *centralising* control over the data we see. In the 1990s,
Re: (Score:3, Insightful)
Any intelligence service that doesn't have at least one mole in Google is worthless.
No IPv6 records :-( (Score:4, Informative)
They don't publish own IPv6 records via this resolver :-(
NTP pool & GeoIP (Score:5, Informative)
Re: (Score:3, Interesting)
Re:NTP pool & GeoIP (Score:4, Interesting)
Re:NTP pool & GeoIP (Score:4, Interesting)
Re: (Score:3, Informative)
Even though there may be several Google DNS servers around the world, I'd guess they're interconnected so they share the same cache. Obviously Google could choose to have a global cache for most domains, but have a local cache fo
motives (Score:3, Insightful)
Very cool, but of course there are questions about Google's true motivations behind knowing every site you visit.
Nonsense.
They want to cut the ISPs and other DNS providers out of their (dishonest) ad revenue streams. For a lot of competitors, this is virtually the only straw left (AOL, anyone? I know at least in Germany if they hadn't forced the marketing of the "Alice" ISP to add such a DNS-misdirect, their portal and search space would be able to count its visits in "hits per hour").
It hurts their competitors while giving Google an image plus. And the amount of overhead and traffic is neglectable if you already operate on the scale that Google does.
It is not the fastet DNS, at least not for me (Score:3, Informative)
I guess for me it's clear: I'll skip it for now.
Re:It is not the fastet DNS, at least not for me (Score:5, Informative)
(Min | Avg | Max | Std.Dev |Reliab%)
My university:
Cached Name | 0.001 | 0.002 | 0.003 | 0.000 | 100.0
Uncached Name | 0.008 | 0.060 | 0.225 | 0.065 | 100.0
DotCom Lookup | 0.181 | 3.984 | 4.203 | 0.633 | 100.0
OpenDNS (208. 67.220.220)
Cached Name | 0.005 | 0.006 | 0.008 | 0.001 | 100.0
Uncached Name | 0.008 | 0.066 | 0.190 | 0.053 | 100.0
DotCom Lookup | 0.009 | 0.131 | 0.198 | 0.064 | 100.0
Level 3 (4. 2. 2. 3)
Cached Name | 0.024 | 0.025 | 0.028 | 0.001 | 100.0
Uncached Name | 0.026 | 0.071 | 0.206 | 0.056 | 100.0
DotCom Lookup | 0.025 | 0.081 | 0.191 | 0.058 | 100.0
Google (8.8.8.8)
Cached Name | 0.044 | 0.061 | 0.206 | 0.038 | 100.0
Uncached Name | 0.048 | 0.144 | 0.322 | 0.075 | 97.9
DotCom Lookup | 0.069 | 0.158 | 0.261 | 0.051 | 100.0
Re:Yet another privacy risking tool I won't mind u (Score:4, Informative)
8.8.8.8, 8.8.4.4.
Re: (Score:3, Interesting)
So not only as memorizable, but explicitly public, whereas 4.2.2.2 and 4.2.2.1 are both technically being abused when you do that.
Re:OpenDNS (Score:5, Interesting)
OpenDNS hijacks Google searches [opendns.com], which could be part of Google's motivation also.
Re: (Score:3, Informative)
If you register with OpenDNS, you can opt out of the hijacking. Basically turn off all additional services (like malware checking, keywords and typing correction) and OpenDNS works just like any normal DNS server out there. The problem is that you have to submit your IP, or their server's won't recognize you; this can be done either by your router or with a Windows app that periodically submits the IP (not sure about Linux or MacOS).
Re: (Score:3, Informative)
and there's the other motive for Google. (Score:4, Insightful)
If you're on $garbage_DNS and you're served an advertisement/search page instead of NXDOMAIN, you (or your browser's auto-search) won't search Google. For that matter, just having something like this around will discourage $garbage_DNS.
Google cares about the Internet. It's where they make their money.
Go for it... (Score:3, Informative)
I just tried it and it's *WAY* faster than my ISP - web pages start loading a couple of seconds sooner than before.
Re:SPDNSY (Score:5, Informative)
everything resolves to Google's proxies.
Really?
You, sir, are a liar.
Cue *whoosh* in 3..2.. actually, I still don't get it. Either you're trolling because you hate Google, or there's some obscure joke that I still don't understand. I really don't get how your list of crap it requires (most of which doesn't exist or doesn't apply to DNS) is funny -- are Google known for requiring random stuff like that?
I mean, they don't even touch NX:
That's more than you can say for most ISP-level resolvers.
Re:What's their motivation? (Score:5, Informative)
RTFA [google.com]:
Google Public DNS stores two sets of logs: temporary and permanent. The temporary logs store the full IP address of the machine you're using. We have to do this so that we can spot potentially bad things like DDoS attacks and so we can fix problems, such as particular domains not showing up for specific users.
We delete these temporary logs within 24 to 48 hours.
In the permanent logs, we don't keep personally identifiable information or IP information. We do keep some location information (at the city/metro level) so that we can conduct debugging, analyze abuse phenomena and improve the Google Public DNS prefetching feature. We don't correlate or combine your information from these logs with any other log data that Google might have about your use of other services, such as data from Web Search and data from advertising on the Google content network. After keeping this data for two weeks, we randomly sample a small subset for permanent storage.
So in other words, for less than two days, their DNS log, and nothing else, will know that a particular request was made from a particular IP. Other than that, they'll know that someone from your ISP, or perhaps from your whole fscking city, made that request -- maybe. I'm guessing they'll be looking at overall trends.
Re: (Score:3, Insightful)
"So in other words, for less than two days, their DNS log, and nothing else, will know that a particular request was made from a particular IP."
So they say. You have more than their word for that?
Oh right. A big US corporation would never lie, even in the service of compliance with national security and law enforcement directives which require them to.
Re:trying it... (Score:5, Informative)
disregard that, I suck cocks.
Re:OpenNIC has been offering this for years now... (Score:4, Informative)
Re: (Score:3, Informative)
"Google Public DNS stores two sets of logs: temporary and permanent. The temporary logs store the full IP address of the machine you're using," the company said. "We have to do this so that we can spot potentially bad things like DDoS attacks and so we can fix problems, such as particular domains not showing up for specific users. We delete these temporary logs within 24 to 48 hours.
"In the permanent logs, we don't keep personally identifiable information or IP information. We do keep some location information (at the city/metro level) so that we can conduct debugging, analyze abuse phenomena and improve the Google Public DNS prefetching feature. We don't correlate or combine your information from these logs with any other log data that Google might have about your use of other services, such as data from Web Search and data from advertising on the Google content network. After keeping this data for two weeks, we randomly sample a small subset for permanent storage."