Another example is bell Canada who used to mine your DNS queries to profile you for ads, or ISPs that high jack the nxdomain result to send you sponsored results of vaguely similar sounding websites.

In fact, in many cases Google itself "suggests" to ISP that they host a few GGC servers.

They are directly monitored by Google, and the ISP has basically no say in how they are run. Capacity is managed by Google directly.

It appeared to work by inspecting DNS packets and replying with overrides if necessary. I didn’t like it but I could understand that.

What I did not agree with was the fact that this also happened for other DNS services. Google DNS and OpenDNS both experienced the same issue, as did a few other “famous” DNS providers. Random little ones wouldn’t return the caching servers, and also enabling encrypted DNS for Google/OpenDNS would stop it happening too. I’m fairly sure it was some badly thought out deep packet inspection.

Also, I think that virtually every ISP with more than a few tens of thousands users is hosting a GGC instance nowadays (and a Netflix OpenCache, etc. etc.).

Nowadays, the vast majority of the transit&peering of ISPs is not going to the Internet, but to a few racks of local caching servers managed by OTT operators.

Bandwidth-wise, at least in prime time, the Internet is much less connected/realtime than people think :)

If you can reproduce a bad experience, and right click on the player, click "Get Debug Info", and share that result, it's the most helpful thing for us to dig into problems.

Get your own at http://hnreplies.com/ - built by Dan Grossman

Are YouTube videos not served using https? Sounds like it's google/YouTube servers but they're underprovsioned

I don't think ISPs pay much for peering in Europe.

A competent ISP operating in good faith will execute and expand peering agreements when it makes economic sense to do so.

When there's a competition this often equates with making customers happy so they will stick with the ISP and perhaps more will switch from competitors.

When there's no competition and customers have no choice who to use it's purely all about squeezing as much money as they can. This means raising prices for the service and reducing cost by paying less to others services even if it would reduce quality of service. The goal is to have service that's good enough to keep people still use them (I mean there is price point and/or quality that people would just not to have service at all).

If a specific action that ISP with monopoly does and it improves quality for customer that's just a coincidence.

That's probably the funniest thing I've read all year

As an anecdote of how bad ISP caching can hurt you, I am a web developer and I was debugging an issue in a legacy system. I had fixed the stuff and deployed a new version. Erased all the caches in my machine, refreshed the page, broken. I thought that maybe I fixed the wrong thing and started fixing more... now rinse and repeat over five hours before you realize that the cache is happening at ISP level and that things are fine in the live version on the real internet. This ISP is called PredialNet, web developers from the city call it PredialCache...

I know this is about DNS and not HTTP but their cache servers will also cache DNS requests, so moving some domain to a new machine and IP is also a quest under their network. For a while I paid PIA so that I could side-step their cache servers.

Naturally, it can't be disabled.

This filter list is implemented through DNS, making third-party DNS services the most practical workaround.

So privacy is why many of the people who use a different recursive nameserver are doing so... In order for that to work, you need to use one of the ones which support link-level encryption, like Quad9 (DNS-over-TLS) or OpenDNS (DNScrypt). Other reasons are performance (which at least in Quad9's case should be no worse than your ISP for real-world queries, since it's back-to-back with many of the authoritative servers already, and all of them will give you a large pool of other users sharing the same cache, which helps performance immensely), and security... Going back-to-back with the authoritative servers also collapses the attack surface between them, minimizing the possibility for MITM attacks between the recursive and authoritative servers.

Accusing government officials of mismanagement or outright theft of public funds is an easy way to get your domain black holed over here. That, piracy, and porn. Though I wouldn't be surprised if the latter two were thrown in solely to make the program look more legit.

https://cilisos.my/8-sites-the-malaysian-gomen-blocked-in-20...

Perhaps most ridiculously, Medium.com is blocked for simply hosting an article posted by a censored website. Yes, you read that right; they banned an entire domain, the vast majority of which covers nothing even remotely related to Malaysia, over a single article.

I try to be grateful they are as inept at censorship as they are oversensitive to criticism.

Source: I've yet to see this on any ISP I've used anywhere, sans free airport wifis. Travelled pretty much every continent on earth.

> I've yet to see this on any ISP I've used anywhere, sans free airport wifis. Travelled pretty much every continent on earth.

I guess you've never been to Turkey.

Hardly “most” ISPs as claimed in the post I replied to. Not even a fraction.

https://en.m.wikipedia.org/wiki/DNS_hijacking#Manipulation_b...

EDIT: lots of ISPs do it, in fact: https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_...

That’s hardly evidence if any.

> "That's hardly evidence if any"

I'm sorry what?

I don't have Comcast anymore (not even available in my area), I can't tell you if it's current practice.

It is possible to turn off this feature, But it is set by a cookie and once that cookie is deleted you have to do it all over again.

I'm pretty sure I had a previous ISP that did it too, but I can't remember which one now.

Whether or not it's noticeably faster, I'm not sure, but I've always used xmission's dns servers without fault for the past 10 years.

--- 8.8.8.8 ping statistics ---

4 packets transmitted, 4 packets received, 0.0% packet loss

round-trip min/avg/max/stddev = 17.763/18.264/18.803/0.425 ms

--- 198.60.22.2 ping statistics ---

4 packets transmitted, 4 packets received, 0.0% packet loss

round-trip min/avg/max/stddev = 2.906/3.457/3.871/0.408 ms

8.8.8.8 is consistent and easy to remember, and now so is 1.1.1.1

Also, as others mention, they can and do monkey with the results.

In other words, here, your ISP is in part a hostile entity. At least, in my perception -- and I'm not alone.

P.S. Of course, there's the argument against giving Google all your DNS usage, as well... I use a different DNS service from a company with a good reputation that says it's not collecting usage data. Even then, and with the state of our State, who knows...

When I upgraded my WiFi equipment at home a month ago I thought it was defective. Multiple times every day I'd seem to lose connectivity to the internet. After two weeks it occurred to me that my previous router was configured to do a couple things for me, one of which was overriding what DNS servers were assigned with DHCP. I reconfigured my new equipment to use those DNS servers and suddenly everything works normally.

To answer the question asked: Spectrum.

I have Spectrum and have been fighting this exact problem for months. Trying out your steps now and hoping for success.

I ran the provided script, added my own local resolver, and after the first run, got incredibly fast results.

                   test1   test2   test3   test4   test5   test6   test7   test8   test9   test10  Average 
    cloudflare     35 ms   38 ms   39 ms   33 ms   34 ms   39 ms   28 ms   33 ms   28 ms   39 ms     34.60
    cloudflare2nd  34 ms   27 ms   34 ms   34 ms   34 ms   27 ms   34 ms   28 ms   28 ms   28 ms     30.80
    google         42 ms   27 ms   27 ms   40 ms   28 ms   40 ms   28 ms   40 ms   40 ms   28 ms     34.00
    google2nd      42 ms   27 ms   28 ms   43 ms   41 ms   39 ms   28 ms   41 ms   41 ms   28 ms     35.80
    quad9          65 ms   64 ms   54 ms   65 ms   63 ms   53 ms   59 ms   52 ms   60 ms   53 ms     58.80
    opendns        45 ms   32 ms   56 ms   51 ms   29 ms   74 ms   32 ms   48 ms   45 ms   32 ms     44.40
    norton         92 ms   73 ms   56 ms   152 ms  48 ms   144 ms  68 ms   40 ms   77 ms   83 ms     83.30
    cleanbrowsing  33 ms   28 ms   33 ms   28 ms   33 ms   35 ms   28 ms   32 ms   33 ms   29 ms     31.20
    yandex         174 ms  174 ms  185 ms  178 ms  184 ms  179 ms  179 ms  199 ms  176 ms  186 ms    181.40
    adguard        143 ms  147 ms  146 ms  142 ms  148 ms  143 ms  130 ms  130 ms  138 ms  137 ms    140.40
    neustar        62 ms   63 ms   70 ms   80 ms   40 ms   74 ms   73 ms   151 ms  58 ms   65 ms     73.60
    comodo         60 ms   137 ms  59 ms   60 ms   59 ms   59 ms   64 ms   62 ms   60 ms   59 ms     67.90
    localhost      0 ms    0 ms    0 ms    0 ms    0 ms    0 ms    0 ms    0 ms    0 ms    0 ms      0

But what do I know? Apparently I'm in the minority for running my own infrastructure (DNS, web, mail).

I don't know why they faired as poorly as they did, but once I realized some network issues could be pinned against DNS packet loss / terrible performance spikes, I changed over to 9.9.9.9 and 8.8.8.8 as the fall back. Home network has been a bit more stable since the change over.

Prior to third-party DNS servers being blocked a lot of tech-savvy people were using either Google's DNS or OpenDNS anyway since they tend to be more reliable than the local ISP's (even before they started filtering).

I'm no longer in Indonesia, but I could imagine the results people are posting here would be useful to folks back home so they can adjust their DNScrypt config.

Reasonably speaking I don't need very much from a DNS provider: <15ms latency, basic DNS security features and the ability to display an error rather than redirect me to a sponsored results page. I can do without the extra filters, but as long as I can get those three things, then I would rather use a different service than my ISP.

I do try to use VM dns, but I periodically have to reverse to Google and often forget to switch back post-outage.

I use my ASUS router's DHCP to teach all my dynamically configured network devices how to find the bind9 DNS caching server.

All the statically configured ones just have 192.168.1.22 hard coded with 1.1.1.1 as backup.

Any ISP that tries to redirect me to an ad-filled half-baked web search whenever I run into an inactive domain would definitely fall into my "so bad that I want to use external services" bucket.