Why do you assume the others have same ethical compass as you? I hope everyone has the same compass but we have seen again and again trust being broken.

[delayed]

ISPs talk to each other, and people move jobs between them. It's not a uniform community but you certainly get a sense of the general spread of opinions after a while.

There are of course outliers but most people I know in the field care as much about personal rights & freedom as anyone else. Maybe even a small bit more.

She was looking up a torrent site which specialises in porn.

I'm guessing that's the reason.

What's wrong with downloading porn?

Could be that porn is banned, or could but that the problem is the torrent side, not the porn side.

That is incorrect. It's a generic torrent site.

Why she? Karthikey is a male name and the youtube streams show a male face. (Of course it's just a weak signal that can be overriden with an autor's declaration!)

[delayed]

Huh, tried this on my phone and I get an error "DNS points to local or disallowed IP" page from Cloudflare. Either they've experienced some sort of nameserver registry level takedown or they've messed up their DNS.

this is valid, in NL most DNS is also heavy monitored and intercepted to do blocks if mandated etc. if you want to get around it u can tunnel ur tlsdns thingy to another place and they essentially cannot intercept it, they can still block the IPs it resolves to so its hit and miss depending on how the other end is implemented.

its usually not nefarious, that is just the simpelest (and usually, not always) wrong explanation.

people who think this is not normal probarbly didnt experience what kind of shit u could find on the pre google pre monitored internet. for sure shit u do not want your kids to find. if u dont understand, then likely u dont have kids and very weird fetishes...

I'm pretty confident ISPs do want hijack DNS since they've been doing it for decades in order to push ads to their customers.

Examples?

Deutsche Telekom (largest ISP in Germany) did this, not sure if they still do or were ordered to stop by court yet

There were certainly a number of ISPs in the UK that tested ways to inject ads in content in the 2000s, there was quite a hoo-hah about it in some forums. This was usually by modifying HTML content in transit via transparent proxies though, not DNS poisoning. This is one of the reasons that HTTPS-everywhere is a good idea even if you aren't concerned about snooping in general.

An example I remember is when Virgin Media replaced any DNS queries returning NXDOMAIN with their own "search page" plastered with ads.

https://shkspr.mobi/blog/2021/03/advanced-network-error-sear...

Ah, yes, I forgot the NXDOMAIN hijacking.

Verisign tried this trick too.

https://dn.org/the-sitefinder-debacle-that-shook-the-interne...

AT&T still does this, if you're using their (intentionally terrible) standard gateway device the default DNS will return a "search page" instead of NXDOMAIN which predictably has all sorts of negative impacts on non-browser devices but the wastes of oxygen responsible for this don't care as long as they see that delicious ad revenue.

AT&T definitely used to do this ~14 years ago.

Some mobile phone network carriers would inject certain PII (such as your mobile number) into HTTP request headers sent to ad networks. I'm sure they still do it, but by requiring the site to have some extra request to be made instea.

Some carriers also passed info in these headers to be used to make billing calls to the Telco, such as subscribing to premium services with minimal (if any) consent from the user.

I got stung by this years ago. An ad for mobile ringtones showed up on some news site I visited on my phone, I scrolled past without clicking. Next minute I get a text telling me I've subscribed signed up to a (iirc) $25/month ringtone plan and that it'd show up on my phone bill. It took an hour on the phone to my carrier to block the charges and get a refund. The ringtone company kept messaging me for a year that I needed to contact them and "fix" the issue.

Insanity that people used to pay more for goofy little midi files than they do now for Netflix.

I dunno what was in a ringtone subscription. I used to work at a ringtone company, and it was $1-$3 per ringtone ($1 for monophonic, $2 for polyphonic and $3 for wav/mp3/whatever; which yeah, is more than a high quality download from iTunes... But $25/month is a ton of money.

Even with free ringtones, I'd send myself about three if I got a new phone. These days, I just keep a copy of the Nokia dubstep ringtone on hand in case I turn the ringer on, but it doesn't happen.

As someone who was sometimes using http as a back end transport for "edi" data (hey at the time it was usually ftp in that industry so no worse, but at least http got around nat problems than even pasv didn't), one time in the mid 00's I was in a coffee shop and just speechless flabbergasted outraged to discover the contents of a random web page I happened to know the contents of get some extra html and js injected into it from the isp (the isp not the coffee shop).

"WHO THE F gave them the right to modify the data in my tcp session!!!!".

Spying on it I assumed but modifying one byte of it? A naively written edi that did not expect that would be completely destroyed.

Probably shouldn't have been so stupid for 15 years already by that point. There is no such thing as the right, there is only the ability.

If someone has the ability to do something, they will. Reputation, right & wrong, none of that actually exists or matters.

That's one of the reasons we now have HTTPS in most places.

It's another thing to point out when someone (who used to include myself) says "but this site doesn't have anything sensitive".

Time Warner Cable used to do it. I haven't checked since they became Spectrum.

Comcast and/or verizon did it in the 2010s, there was literally an opt-out in the account dashboard.

It's sort of an absurd question, the prevalence of such things by ISPs was the literal impetus for DoH and DoT.

Last I checked Verizon FIOS still has the opt-out. You have to go into your account preferences and manually disable it because spying is on by default.

This is a good reminder to login and take a look, I wouldn't put it past them to change the setting name and reset the default.

You should be NATing outbound 53 to a local resolver that upstreams to DoH/DoT. Relying on such an opt-out is rather optimistic.

I don't use their resolver at all. Their opt-out was more of an all-encompassing "let us take whatever data we can manage to get" than DNS specifically.

Yep, I've been in Verizon online account purgatory for awhile now. They merged my mom's with mine and nothing works to reset or restore online account access for even bill pay. I have to push their payment out via billpay. I really need to move that phone number over to voip, I kept the classic POTS line as a type 1 diabetic I like that it stayed on during both NYC blackouts in 2003 and 2012. But now I'm in a fiber only building and that redundancy is mostly moot.

Thank you for this. Just opted out. They certainly made that page as hard as possible to find. Figuring out how to change my routers DNS server was also made needlessly complex.

IIRC, early into ATT’s US fiber / gigabit rollout, they wanted an additional $40 / month to forgo collecting and selling your browsing history (DNS queries).

RCN definitely was doing it for a while, so was Comcast. I learned quickly to override this garbage

AT&T has been well-known to do this, since they are violently opposed to net neutrality and they want to force you to only use their approved paid partners for everything. They do this on all their internet services.

Netflix has always listed AT&T as their number one worst offender when it comes to net neutrality.

So, I always run VPNs that I can trust.

I hijack DNS in my LAN and block popular DoH servers so they would have to fall back to my DNS. It is a good way to block ads for smart TVs and services that try to use DoH to bypass DNS level ad-blocking.

Do you use a dynamic list of IP addresses to block ?

Cool story

If you're a UK ISP owner, you're almost certainly a RIPE NCC member, given the UK is within its regional scope. Therefore, you've probably spoken to other RIPE NCC members via mailing lists or meetings at least once. Since I also represent a provider that is a RIPE NCC member, I can object that not everybody shares the same ideology you noted. There are some providers that actually speak in favor of such over-regulation and censorship. Everybody can read and/or participate in the RIPE Discussion List, though, and you will be amazed by some responses from ISPs that speak in favor of such measures.

But the good news is that at least the majority (for now) is against it.

I speak for another RIPE NCC member when I say that that ideology is limited to a very small minority.

Even outside ideology, plain business sense makes ISPs not want to deal with censorship & co. It's work to do that, hence costs money. But there are also ISPs resisting out of ideology and civic duty.

I've lived in countries where the isps voluntarily block sites out of ideology and what they call civic duty.

One massive reason is they redirect requests for videos to closer (or local) caches of videos for netflix (directly from youtube placing it with a large enough ISP), or local caching at the ISP level so less traffic hits the internet.

If you've ever been hit with a "webpage isn't updating" issue when someone else can see it, often it's different DNS servers.

It's best to never use the ISP's DNS servers, regardless of the reason why they might do what they do.

> It's best to never use the ISP's DNS servers, regardless of the reason why they might do what they do.

But providers overwriting DNS packets regardless – this is the topic of the article :)

P.S.: And yes, there are ways around this like DNSsec etc.

For sure, I read the article.

Introducing what ISPs do with DNS information is helpful to understand how encompassing DNS self-hosting needs to be thought about - DNS requests are important to consider the appropriate encryption for.

From the homelab side, increasingly with the automated attacks on systems, it seems wise to keep all services off the internet directly and put it behind one or more service to keep them safe. From that perspective, setting up something like Tailscale can also help mitigate this kind of issue.

A reminder that the average consumer device doesn't actually validate DNSSEC in its default configuration: it relies on its recursive resolver to set a bit on the response saying "I validated DNSSEC, things are all good". In that configuration, DNSSEC gets you no protection against this.

One of the reasons a variety of providers have been pushing for DoH is because DoH fully closes the risk of ISP MITM without needing individual site operators to do anything. This is why you're seeing folks like Firefox and Chrome enable DoH by default.

DoH is fine if a bit complicated. The problem is who the DoH provider is. Usually it's Cloudflare.

> One of the reasons a variety of providers have been pushing for DoH is because DoH fully closes the risk of ISP MITM without needing individual site operators to do anything.

... by replacing it with Google/Cloudflare MITM with whom the user doesn't even have a business relationship or even shared jurisdiction.

The business relationship most home users have with their ISP explicitly permits that ISP to harvest data from their DNS requests.

I'm glad you know everyones ISP terms of services as well as the local laws that restrict which parts of them are worth a damn.

Do you actually disagree with my claim, or is your concern purely that you don’t like my generalization?

They don't mess with DNS to do that. The video provider points them to the appropriate cache. And it's usually only for video content, not the whole web app.

Streaming provider edge optimisation is usually done using one of BGP or specific streaming provider config, depending on the platform, and is a positive in everyone’s interest