Systemd: Don’t fallback to Google NTP and DNS

https://github.com/systemd/systemd/issues/12499

163 229 6 years ago

falcolas12• 6 years ago

I will block discussions here now, since I don't think we need the input from the script kiddie peanut gallery here.

How not to interact with your community 101.

Defaults matter, because even if they are changeable via a build-time flag, most of the time they won't (how many people knew this was a default before now?)

threatofrain2• 6 years ago

This isn't something normally set by the end-user but by vendors, and I do presume that distro teams absolutely have enough opinion and energy to set DNS defaults.

raverbashing• 6 years ago

Does it matter now (that the maintainers can't dialogue with the community)?

In one side major linux distros took in systemd (as, ok, granted, the "less worse" of the options) so the point is moot. I mean everybody should know how LPs management of the project works.

At the same time I can understand trying to cut down on drama in online discussions (though I agree that default might make more sense as a run-time configurable, not as a build-time one).

(And yes defaults are important)

falcolas12• 6 years ago

Systemd being the default init system in the distro, and google being a default resolver in systemd, are separate issues.

Yes, it does matter. It's being pushed out as the init system for a lot of linux systems, and I believe it's perfectly reasonable to expect that your fallback DNS resolver is not set to a for-profit data-collection organization.

yadco• 6 years ago

Whoever knows how to build systemd should know about this build-time flag

falcolas12• 6 years ago

I have to picture that systemd has hundreds, if not thousands, of build time flags. Is it reasonable to expect all non-systemd builders to grok every flag? My opinion is that it is not - that pushing it back on the individual distros is a cop out on Red Hat's side.

EDIT: 172 distinct build-time options, in today's master. Not all appear to be used as part of the build, since the build script only references 142 of the options set in meson_options.txt.

packetlost4• 6 years ago

Defaults matter, but he's right to say each distro should be the ones setting the default. Most people aren't compiling systemd themselves, they're using the one compiled by their distro maintainer(s). I don't think this is anything to worry about and he's right to shut out pointless conversation from people who misunderstand the actual situation. Accusations of being paid by Google (or any other entity) is ludicrous and can easily be interpreted as insulting too.

vonmoltke• 6 years ago

Defaults matter, but he's right to say each distro should be the ones setting the default. Most people aren't compiling systemd themselves, they're using the one compiled by their distro maintainer(s).

In that case, the final comment in the discussion is correct: systemd itself should not have a default, and should require the distro maintainer to explicitly set these values to whatever default they want to use.

Kaze4042• 6 years ago

There were no accusations. Someone asked a fair question. The maintainer clearly overreacted.

mrighele• 6 years ago

If the distro is supposed set a default, don't provide one.

megous7• 6 years ago

(how many people knew this was a default before now?)

Pretty much everyone who ever opened /etc/systemd/resolved.conf

munchbunny2• 6 years ago

Pretty much everyone who ever opened /etc/systemd/resolved.conf

That's a vanishingly small percentage of people who use systemd.

falcolas12• 6 years ago

Did you know that there are at least four different file locations that resolvers can be set in for systemd-resolved?

The defaults being in a commented-out section in one of these four locations (and in a file whose name does not match the linux standard of resolv.conf) is, frankly, not a big help in identifying what's really being used.

https://jlk.fjfi.cvut.cz/arch/manpages/man/systemd-resolved....

hedora10• 6 years ago

If you are correct, Poettering doesn’t understand how to configure the last resort fallback.

He says the easiest way is to recompile systemd from source.

Presumably he knows more about systemd then the average Linux user.

akerro2• 6 years ago

This is why Linux and SystemD will struggle to find maintainers in the future: https://www.theregister.com/2020/06/30/hard_to_find_linux_ma...

offbyone2• 6 years ago

I'm not sure I agree; Poettering isn't being harsh to his collaborators, here. He's protecting them against the implicit accusation of a hostile community member. I'd be _more_, not less likely to want to work on a project with someone who does that.

tomxor• 6 years ago

How not to interact with your community 101.

Maybe, but lowering a discussion to accusations of bribery is also not how to interact with project members.

falcolas12• 6 years ago

No, it's not.

But one person is a paid maintainer for the project, the other an (admittedly paranoid) non-paid user. The standards for a paid employee are (and should be) higher.

theevilsharpie• 6 years ago

How _not_ to interact with your community 101.

On the contrary, I think he handled it perfectly.

I've become exhausted with most discussions on social media, because conversations frequently get hijacked by loud people with strong opinions that don't express them in good faith. Without strict moderation, it can become impossible to have a rational discussion on certain topics. For example, pretty much anything on HN involving Google devolves into worthless noise.

In the case discussed in the OP, Poettering clearly has no intention of changing the default configuration (at least based on the reasons given in the issue), and has provided a way of modifying the configuration for those that care enough to change it. There's no value in further debate, and closing the issue to further discussion keeps Poettering and other contributors from getting distracted/burned out by unproductive conversation.

If people don't like it, they're free to fork Systemd or start up their own competing software project, and then they can handle community interaction for their own project in whatever way suits them.

Frankly, I wish more discussion were handled this efficiently.

KaiserPro4• 6 years ago

Its not really efficiently.

Something like: "we've discussed this a number of times, see #12345" closing now

would have closed the ticket and not made the front page.

By being a top draw dick about it (when the originator was at least being earnest) the debate rolls on.

He had given a full answer, he could have left it there, but chose not to.

its this kind of "rock star" and cheerleaders that give IT a bad smell.

bad_user4• 6 years ago

It is regrettable that this comment got down-voted (at the moment of writing this).

I very much agree — and I would add that there's a strong entitlement complex among loud non-contributors.

If you don't contribute anything but opinions, then be respectful, respect the author's choices, or start your own fork, which is what open source is about.

wtallis8• 6 years ago

In the case discussed in the OP, Poettering clearly has no intention of changing the default configuration (at least based on the reasons given in the issue),

Poettering never even acknowledged that there are privacy concerns. Simply saying "if you don't like the defaults, change it yourself" is in no way equivalent to saying "I don't care about or share your privacy concerns, but here's how to override the defaults if they bother you".

falcolas12• 6 years ago

Handled perfectly would be "No, reference bug #X, closing" and closing/locking the thread. Question gets answered, nobody gets insulted.

Denigrating your community as the "script kiddie peanut gallery" is, at best going to piss off your community and at worse make them less likely to work with you in the future.

michaelcampbell• 6 years ago

Poettering being insulting and smug? Who'd've guessed.

nine_k• 6 years ago

BTW Linus also used to be pretty insulting, but somehow avoided being smug, AFAICT.

hedora10• 6 years ago

Also, “work with your downstream” rings hollow coming from a RedHat employee.

Anyway, per his advice, here is how I worked with my Linux distribution to fix the problem: I switched away, and donated to ones that don’t use systemd.

joana035• 6 years ago

How not to interact with your community 101.

Give Poettering a break! You have no clue what is to be in his shoes. ;)

tobyhinloopen• 6 years ago

It was called for. The commenters were pretty toxic IMO.

Hnrobert42• 6 years ago

Yeah. That was very rude. I’d heard the systemd developers severely lack social skills. The way he went from 0 - EXASPERATED was surprising and uncalled for.

offbyone2• 6 years ago

Almost as if he'd been the target of a nearly-non-stop decade of constant hostility and abuse or something.

finnthehuman3• 6 years ago

Lennart is not that good at the human-facing parts of maintainership. That's fine, he doesn't have to be.

I'm just surprised that people don't see how his communication style (in general and in the linked thread) makes interactions harder than it needs to be for himself and everyone involved.

kd9137• 6 years ago

Why is this repeatedly raised? This is only done like this for development purposes. It has been discussed for years at this point.

Distros/users are encouraged to change these defaults and many do.

Seems pretty clear cut and simple to me.

fartcannon4• 6 years ago

Probably because it shows the character of the systemd devs.

kd9137• 6 years ago

I can imagine it getting a little frustrating to have to constantly reiterate the same point over and over again.

Especially when people are refusing to understand the reasoning and logic explained from last time. It's already been explained, a quick duckduckgo search can show quickly what the reasons are and why the whole privacy argument is irrelevant here.

munchbunny2• 6 years ago

I hope if I were in the maintainer's shoes I wouldn't have raised my hackles quite as quickly, but speaking as anyone responsible for making any decisions that might be unpopular, it does get pretty tiring when someone very quickly reaches for the good old "I'm not saying you're a shill, I'm just asking if you're a shill."

The part of the comment in question:

With the above response, might I ask the developers a question: has this project received any donations from Google?

pas3• 6 years ago

It also shows how many people are coaching from the sidelines so to speak.

Although the decision theoretically affects them, they shouldn't constantly nag the maintainers. (Not respecting their decision is not a sign of great character either.)

wolrah• 6 years ago

Distros/users are encouraged to change these defaults and many do.

Haven't we learned enough over the years from projects like PHP and MySQL that having defaults "for developers" and expecting them to be changed for production use is a terrible idea?

The defaults should be sane, secure, and privacy-forward for the majority of users. If such defaults can't be agreed upon, there should be no defaults and the users should be forced to set it appropriately for their needs.

---

Personally I gave in to the Google monster years ago so it doesn't bother me, but I can certainly see why a lot of people would find these defaults concerning.

Beyond that, I definitely agree with those who are pointing out that the fallback behavior altogether is undesirable. If my chosen DNS servers fail to respond I don't want my system to go out and try some other random servers, I want it to indicate a failure and let me fix it.

wrkronmiller3• 6 years ago

Could someone explain why systemd needs DNS/NTP fallbacks to begin with? Why aren’t these both runtime configs?

EDIT: I assumed there were also runtime configs based on the name "fallback."

My question is primarily why you need compiled-in fallbacks, and secondarily why the fallback configs aren't pulled from config files.

gdamjan1• 6 years ago

it is runtime config. these are defaults in case the distro doesn't change it, or the admin doesn't set it.

sascha_sl• 6 years ago

They are, these are the defaults for unset.

As Lennart says, asking your distro vendor to set defaults or just doing it on your own system is much better. This issue is just being upset on behalf of the people that don't mind or care and just want working infrastructure.

Xylakant• 6 years ago

They are runtime configs. The build-time defaults are fallbacks for when no runtime config is set.

https://www.freedesktop.org/software/systemd/man/systemd.net...

https://www.freedesktop.org/software/systemd/man/timesyncd.c...

louwrentius• 6 years ago

It would better to fail than to use fallbacks that are not desired.

aequitas• 6 years ago

I could imagine if you want to fetch external resources for first boot configuration on embedded or satellite installations. You need DNS for that, and NTP (or hardware time) for https to work. Nowadays even pre-OS processes (UEFI) use internet. For example internet recovery on Mac's.

wrkronmiller3• 6 years ago

interesting point, but I'd think DHCP or a baked-in config file in the system image would do the trick no?

numpad0• 6 years ago

Yeah and if no runtime configs are set why not let it fail? systemd ain’t youtube-dl or awscli.

ori_b• 6 years ago

So that system administrators know they misconfigured it, rather than having it silently do the wrong thing.

ashkante• 6 years ago

If I want my systems to fail in DNS resolution if the DHCP server doesn't give them a DNS server address (by design), I'm essentially SoL then? My option then is to block outgoing TCP/UDP 53 on my firewall, except from my forwarders. Or maybe I should just suck it up and start building systemd in-house an give it a bogus default, with all the maintenance and overhead that involves?

So, in a few months to a few years, when systemd silently switches to DNS over HTTPS, what then? Maintain a (growing) blacklist of public DoH servers?

I'd much prefer my software to fail (and let me know), rather than assume some default someone, somewhere, somewhen thought a good idea.

peterwwillis• 6 years ago

More to the point: does any Linux software at all use a default DNS or NTP server? NSS resolver library doesn't default to using a specific DNS provider, and it's a DNS resolver. NTPd might default to using ntp.org pools, but that might just be my distro's default configs.

To me this is more evidence that Systemd is really just "Poetteringd": whatever he feels like it should have, it has. Really disappointed that distros continue to use this software rather than start a community replacement that addresses its shortcomings.

If I re-did systemd, it would retain the same functionality, but not come enabled by default, and it'd be broken up into independent packages to be installed as needed. It would also use standard interfaces and do away with the binary formats, defer to existing system software rather than default to its own custom versions, de-complicate its awkward filesystem tree and simplify management of service configs, make the command-line interface more sane, and begin integrating more cloud-specific features to replace more complex cloud software (such as for service discovery, cluster management, and HA).

All these fixes would allow the "anti-systemd" crowd (of which I am a card-carrying member) to run a simple init system if they want, or extend it to the full range of systemd functionality. It would remove glaring pain points and user friction, embrace the existing system's default functionality (and backwards compatibility), and extend the software to be more useful in cluster environments. In addition, if this were maintained by the community, all distros could adopt it like they did systemd, and we don't have a half dozen different service systems like before.

Now please somebody reply and tell me why this is a terrible idea...

hedora10• 6 years ago

It more-or-less worked that way for decades (and it worked better), so it’s not a terrible idea.

My theory is that the big distros are intentionally destroying forwards and backwards compatibility on the desktop as much as possible.

The more often window managers, desktop software, etc., stop working, the less their own teams have to compete with existing software. Wayland’s X11-as-a-second-class-citizen and gtk’s elimination of API stability are two other good examples of this.

Also, tearing down established standards is a great way to sabotage the various BSD’s out there.

What they don’t get is that sabotaging the rest of the community is undermining their own market share within Linux, even as it shrinks Linux’s market share.

ghostpepper3• 6 years ago

Please start this project. If it used C or Go I could even contribute.

2trill2spill3• 6 years ago

Christ, what's next? You accuse us of controlling people's minds with vaccinations we get directly from Bill Gates? And that systemd uses 5G to spread CoV-2?
I will block discussions here now, since I don't think we need the input from the script kiddie peanut gallery here.

Ohh my what a toxic open source community. I can't imagine working on a software project where the lead dev/maintainer says things like that to people.

Edit: I suppose with all the downvotes apparently lot's of people here think such responses from the leader of a open source project is acceptable behavior.

grandinj• 6 years ago

More like - that community leader takes an unbelievable amount of flack and is still generately polite and helpful in most of his interactions.

How about we cut them a little slack for occassionally being human?

2trill2spill3• 6 years ago

I wouldn't consider any of those responses as being "generally polite", He could have just said we already discussed this, linked to the old discussion and thanked the people for their concern and closed the issue, no need for him to respond with nasty language.

corty• 6 years ago

Even before systemd, Poettering was one of the more uncaring, abrasive project maintainers, e.g. in pulseaudio. If there is no slack for Torvalds, there shouldn't be for Poettering.

wtallis8• 6 years ago

I'll admit that I don't actively seek out Poettering's online postings, so I pretty much only see his behavior when it's bad enough to make the news. But isn't it a little silly to say he's generally polite and helpful in most of his interactions? What really matters is whether he's capable of being polite and helpful when there's a real disagreement, and especially when he's wrong. His reputation indicates he tends to have a distinctly impolite "my way or the highway" attitude in those circumstances, and examples of it are plentiful. Are there counterexamples where he humbly admits being wrong, or at least acknowledges the validity of criticism when affirming his stance?

simion314• 6 years ago

I would expect that an experienced leader would have learned the lesson that the satisfaction of writing a nasty comment is short but the consequences are much longer, not sure if he just can't control himself or maybe he enjoys the spectacle and making himself a "victim".

The guy is paid for his work so I would have expect he would act more professional, the excuse that he works for free in his spare time does not apply.

hedora10• 6 years ago

I don’t care if Poettering's an a—hole or not. I enjoy reading Torvald’s rants, in fact. They’re usually informative.

I’m upset that he has done more than any other developer to break my machines, and he keeps getting more authority so screw things up.

PulseAudio was bad enough, but at least it only broke one subsystem. SystemD has unapologetically broken: background process management, time keeping, network resolution, pam authentication, screen saver session management, x11 startup, logging, and probably more.

asveikau• 6 years ago

I don't like it either, but Lennart Poettering already has a reputation for this. If you've spent time listening to criticism of systemd and some of his other projects, this is not news.

I think it may be a mistake to extrapolate his attitude to the scale of "open source community", even though it is also fair to say he is not the only one with this problem either.

Edit:

Christ, what's next? You accuse us of controlling people's minds with vaccinations we get directly from Bill Gates? And that systemd uses 5G to spread CoV-2?

A joke occurrs to me. Systemd already does so much. It wouldn't surprise me if that were in there too!

2trill2spill3• 6 years ago

I didn't mean the entire open source community, just the Systemd open source community, sorry for the confusion.

jonathanlydall• 6 years ago

I don't use Linux and have no any opinion on systemd either way, but based on what I saw on Slashdot about it some years back, there are a significant number people out there who acted as if systemd and Lennart Poettering (one of its creators) were one of the worst things to happen since Hitler.

I'm largely ambivalent as to whether or not his behaviour here was acceptable, but I am pretty sure he has received death threats and other types of abuse from systemd haters in the past, so his complete lack of patience at baseless accusations does not surprise me at all.

On a related note, while I still skim Slashdot's front page daily, I just can't stand to look at the comments anymore. I think the trolls, "bitter sysadmins" and bigots have largely frightened away everyone else. For example, if you just mention you're actually alright with Microsoft Windows, then you're accused of being a shill who's life goal is to make everyone else's life miserable.

finnthehuman3• 6 years ago

I can't imagine working on a software project where the lead dev/maintainer says things like that to people.

But have you ever written a unit file? So much better than writing an init shell script. That apparently excuses any other issue with systemd for a lot of people.

yjftsjthsd-h3• 6 years ago

But have you ever written a unit file? So much better than writing an init shell script.

Have you ever added a daemon to OpenBSD? There are better options.

hedora10• 6 years ago

Shell really isn’t that hard to learn, and it’s a skill that transfers to many other problems.

I’ve looked at Unit files in a futile attempt to debug a startup failure. They seem worse (much less debuggable or transparent) than the old init system Linux had in the 90’s and worlds away from modern implementations, like OpenBSD’s.

sam_lowry_• 6 years ago

The original title was much more explicit: "Systemd Fallbacks to Google NTP and DNS".

I guess @dang changed it with good intentions, but he accidentally destroyed the meaning. "We wanted the best, you know the rest."

threatofrain2• 6 years ago

Don't fallback to Google NTP and DNS. #12499

cbsks• 6 years ago

What fallbacks do the major downstream distributions use?

megous7• 6 years ago

Arch Linux for example:

#FallbackNTP=0.arch.pool.ntp.org 1.arch.pool.ntp.org 2.arch.pool.ntp.org 3.arch.pool.ntp.org

different_sort• 6 years ago

What are the 'obvious privacy reasons' to not use google DNS/NTP?

I am being 100% serious when I ask: What bad does someone expect to happen as a result of this.

marcinzm3• 6 years ago

Google can tie the DNS requests you make to your IP address and then tie that to you Google accounts. Google now knows every website you go to and can either monetize the data or sell access to it. It also knows your name.

For fun uses of this data, I recently talked to a company that ties medical conditions derived from your browsing behavior to your online profile and then provides a platform for insurances companies to target you based on it.

xrisk• 6 years ago

I just looked through Google DNS’s privacy policy and what you claim seems incompatible with their claims: https://developers.google.com/speed/public-dns/privacy

Do you have any concrete evidence of what you claim?

ed25519FUUU• 6 years ago

From Google’s DNS privacy page:

We do not correlate or associate personal information in Google Public DNS logs with your information from use of any other Google service except for addressing security and abuse.

https://developers.google.com/speed/public-dns/privacy

rcoveson2• 6 years ago

What bad does someone expect to happen as a result of this.

Google is enriched when it can associate consumer IPs with DNS queries. Collecting that sort of information and compiling it into a advertising profile is part of Google's business. Giving state actors a view of that information part of Google's history.

Some people are just philosophically opposed to Google's information gathering mission. From such people's perspective, anything that directly helps Google learn something (or even make a little money) is bad.

bluecmd• 6 years ago

I mean, could? Sure. They specifically claim not to though: https://developers.google.com/speed/public-dns/privacy

hedora10• 6 years ago

The assumption is that Google will do what it always does, and use your request stream to spy on you.

livre2• 6 years ago

Google logs and stores forever every DNS request (and other info related to it like approximate geolocation), they also temporary store even more information that can identify you (like your IP address).

https://developers.google.com/speed/public-dns/privacy

Edit: let's suppose for a moment that Google is not evil, does not cooperate with the NSA and doesn't make bad use of that information. It's still a liability and any data leak will be a problem for anyone using Google's DNS. Some things are better not being logged at all or at least not permanently.

hedora10• 6 years ago

There’s also the CLOUD Act, which compels them to share the information with law enforcement in the US and abroad. (The latter don’t have to have any due process around the data requests they issue, unless they have other laws requiring it.)

WillPostForFood• 6 years ago

stores forever every DNS request

That’s not what your link says.

The permanent logs are a sampling of the temporary logs

manjalyc5• 6 years ago

This is a breakdown of some issues many people have with Google's Privacy Policy for their DNS.

Temporarily Logs (2 days):

- Google logs the IP address of every device sending a DNS query.

- For DNS-over-HTTPS, logs Content-Type & Accept HTTP headers

Permanently Logs:

- Client's autonomous system number

- User's geolocation within 1 km^2 and 1000 people.

- Timestamp

- Requested Domain Name

- Request Domain type

- Transport Protocol

- EDNS version, option

- and a few more, essentially everything but your IP address.

This is enough permanent information to successfully identify the vast majority of people even if they never permanently log your IP - and that's just by itself, not including if you use other google services. Other services such as Cloudflare DNS or OpenDNS provide a higher degree of privacy and can even be faster than Google's DNS.

Google's DNS policy: https://developers.google.com/speed/public-dns/privacy

Cloudflare's DNS policy: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns...

OpenDNS's policy: https://umbrella.cisco.com/blog/privacy-policy-update

mda• 6 years ago

"This is enough permanent information to successfully identify the vast majority of people even if they never permanently log your IP"

How? I don't think this is true. You also reworded and omitted stuff from the disclaimer.

alibert• 6 years ago

I believe Google's DNS service is used for monitoring DNS traffic from IPs. This is then most likely used for personalisation, which aids Google's mission to take freedom and privacy away from nontechnical and technical users.

Not questioning if Google does it or not but I was made to believe that IP is not really useful for ads targeting because it just doesn't work great with multiples users behind a single IP. Now with CGNAT on both type of networks (fixed and mobile), using IP for targeting does not seem pertinent to me.

hedora10• 6 years ago

Timestamps are usually enough to infer end users, even on much larger data sets. (Researchers used the Twitter firehose to deanonymize a large dataset a few years ago).

marcinzm3• 6 years ago

Christ, what's next? You accuse us of controlling people's minds with vaccinations we get directly from Bill Gates? And that systemd uses 5G to spread CoV-2?

That seems a very aggressive response to a perfectly valid question in modern times. Google pays Mozilla tens of millions to be their default search provider. Companies use money to influence things to their benefit all the time.

edit: Another example was all the extensions that Kite bought out and had their service offering added to (which sent all your code back to Kite servers).

jasondclinton• 6 years ago

Asking someone if they are a shill is never "a perfectly valid question".

yjftsjthsd-h3• 6 years ago

And responding like that is never a valid answer.

kenperkins• 6 years ago

I think it is a valid question when the defaults are google and there is a reasonable suggestion to not use google as the defaults in lieu of community or open-source options. When that question isn't answered (evaded) it's perfectly reasonable ask why.

wtallis8• 6 years ago

Asking someone if they are a shill is never "a perfectly valid question".

It was more of a question whether there is a conflict of interest; "shill" is a more loaded term than what was used. And the answer was actually a qualified yes, so there was at least a sliver of validity to the question.

dbergamin• 6 years ago

So what colour should we paint the bikeshed?

Fair response IMO, this is the type of issue that can attract a lot of noisy opinions so very reasonable to lock comments to contributors.

psanford• 6 years ago

I believe Google's DNS service is used for monitoring DNS traffic from IPs. This is then most likely used for personalisation, which aids Google's mission to take freedom and privacy away from nontechnical and technical users.

The Privacy Policy for Google's public DNS service explicitly says that they don't do that. If you really think Google is doing it then you should take it up with the FTC who would really enjoy making an example out of Google.

njsubedi• 6 years ago

Somehow this is funny.

Nextgrid4• 6 years ago

you should take it up with the FTC who would really enjoy making an example out of Google.

How do you prove it though? Google will not just give you the source code of their DNS infrastructure and even if they did there is no way to prove that it's indeed that code that is running and not a modified version that does collect data?

jeffbee6• 6 years ago

Actually google is one of the few organizations out there with real reproducible builds. If they gave you the sources and the program image, you could prove the latter was derived from the former.

takeda4• 6 years ago

The Privacy Policy for Google's public DNS service explicitly says that they don't do that. If you really think Google is doing it then you should take it up with the FTC who would really enjoy making an example out of Google.

Stop pretending like there's no regulatory capture going on. Otherwise we would already have antitrust cases going on with many of those big corporations.

zaarn2• 6 years ago

This discussion is the worst to have to repeat every time.

This fallback will only be used when:

* You have no DNS and NTP servers assigned via DHCP (your router does by default in 99.99% of cases) * You have no DNS configured in /etc/resolve.conf * Your distro does not change the defaults to nothing or something else (almost every distro does) * You still have internet connectivity (somehow)

In most cases, these conditions would simply not be met because everyone has DNS configured somehow. This isn't a fallback for when your DNS is unreachable, it's for when no DNS has been configured at all anywhere (including by distro upstream) but you still want to use the internet.

So in that rare circumstance, where your distro didn't change upstream defaults and you don't have any DNS configuration, it will fall back to Google DNS.

hansdieter1337• 6 years ago

so... why google and not a privacy-concerning alternative?

kd9137• 6 years ago

Because the privacy concerning aspects are literally irrelevant.

These are set for testing/development purposes. For which the priorities are availability/reliability/speed. For those criteria, Google/Cloudflare are empirically the best worldwide.

This literally is used for test-resolving that at best probably would identify a systemd-dev. Everyone else shouldn't care because it's overwritten by distro maintainers.

riquito• 6 years ago

Google offers better documentation than most, and the privacy aspects are good. [1] Of course you have to trust them but that would be true for any company. Given that the natural default would be even less trustworthy ISP, is not that bad.

https://developers.google.com/speed/public-dns/faq

znpy3• 6 years ago

i set up a bind nameserver for my internal network, and mistakenly i did not set upstream resolvers.

It's working anyway, i think it's resolving off the root nameservers...

I guess... You couldn't go more private than that.

manjalyc5• 6 years ago

/etc/resolve.conf

It’s /etc/resolv.conf, and systemd overwrites it, Network Manager overwrites it (like every 10 minutes), dhcp overwrites it, etc. What do they overwrite it to? Most just get it from the router even if the router has no assigned servers. These days manually managing /etc/resolv.conf by hand requires hooking into every service that overwrites it on most systemd distributions. So really the people this change would affect are those with misconfigured routers.

My issue is why they didn’t go with a more private DNS such as Open DNS or even Cloudfare DNS. Google’s privacy policy is worse than either of the two. It seems the questioner asked in bad faith but I would’ve hoped Poettering would respond to the validity and dismiss the malintent instead of dismissing the whole issue.

rwmj• 6 years ago

I do:

  chattr +i /etc/resolv.conf

on my own servers to stop things from fiddling around with it.

znpy3• 6 years ago

    It’s /etc/resolv.conf, and systemd overwrites it, 
    Network Manager overwrites it (like every 10 minutes),
    dhcp overwrites it, etc. What do they overwrite it to?

I still haven't understood where is the definitive place to set dns nowadays.

/etc/resolv.conf is routinely touched by stuff like NetworkManager and other stuff. Systemd-resolved config seems like the correct place, but I'm not sure how that plays with network-manager.

WGH_• 6 years ago

Are you sure systemd overwrites it? I believe it maintains its own /run/systemd/resolve/{resolv,stub-resolv}.conf file, and it's up to you whether you want to symlink /etc/resolv.conf to one of these or not.

AnIdiotOnTheNet• 6 years ago

The likelihood of this scenario is mind-bogglingly small. You need to have a valid IP configuration for the network you are on, including a default gateway that will route you to the internet, yet somehow do not have any DNS servers configured at all?

Why even bother covering this case? It seems most likely to come up when this situation is created intentionally, in which case you don't want to go and ruin it by trying to be clever.

pas3• 6 years ago

It's used for testing. (At least that was the rationale given for the NTP default setting, I guess the same applies for DNS too.)

It's sort of a sane/understandable default, considering all the context.

Though maybe they could switch to CloudFlare.

kevin_nisbet2• 6 years ago

I agree, I would find it extremely unintuitive. I'm only scanning the issue at a high level like most others, so it really depends on how systemd presents this information. If it sort of happens in the background with the systemd resolver and shows no DNS servers but queries magically work I would be extremely confused, especially since no upstream resolution is a scenario we see in particular networks with our products.

On the other hand, if it does present the servers and it's still configurable, might be a bit of a different story.

AlexandrB4• 6 years ago

This makes it worse. For all those conditions to be met, it would have to be a conscious choice on the part of the user/administrator. And then systemd decides it knows better and resolves using 8.8.8.8 anyways?

zaarn2• 6 years ago

You can configure an invalid DNS server or set the DNSConfig in systemd-resolved. The DNS server option being set at all causes the fallback to not be used, regardless if it's empty or not.

belorn• 6 years ago

The discussion seems to be a logical circle. If the default fallback is such rare circumstance that it doesn't matter, then the best options seems to leave it blank as suggest last in the ticket. Let it fail hard and if any users has a complaint they can direct that towards downstream which should have set a sensible fallback. If the default fallback actually do matter then it seems reasonable to have a discussion about what it should be.

creeble4• 6 years ago

I agree.

In my experience with systemd-resolvd, things happen that make it _believe_ there is no DNS configured, and you end up with something incomprehensible (a "hidden default" or some such).

Please let it just fail so that one at least has a chance of understanding what's happening rather than some magic.

Typical systemd rationalization, imho: "should anything be perceived as wrong, perform hidden magic."

takeda4• 6 years ago

The fallback is just stupid. Make it a hard fail in that case, as you pointed out it is a very uncommon scenario. If you really, really want to have fallback, why not have list of root DNS servers and have the resolver do recursive query. I set up my network that way (don't use google, cloudflare, my ISP or anything else) and used it for years without problem.

But I think hard failure is best approach in this case, because this behavior will also make it harder to troubleshoot issues, let say you are setting up a network and misconfigured your router that doesn't provide DNS now you will be puzzled why Internet works on some machines while it doesn't work on others.

floatingatoll• 6 years ago

It’s not “stupid”, it’s reasoned out based on premises that you disagree with. The rest of your argument is weakened by that opening, even if it’s a point worth considering.

JdeBP7• 6 years ago

The fundamental flaw in your argument is that systemd-resolved is not a resolving proxy DNS server. Many other proxy DNS server softwares indeed are switchable between resolving and forwarding modes, some even doing both at once, but systemd-resolved only provides forwarding proxy DNS service. There is no resolving mode to default to.

Which is in fact the core of the problem. It's actually a fairly rare kind of proxy DNS server software, one for which there isn't really a sensible universal default for the unconfigured case.

johnbrodie• 6 years ago

I've run into this situation at home when setting up some new networking equipment with much more configurability than I'm used to. My system had no DNS, alerting me to the issue, and I fixed it. I don't need nor want my systems to decide for me to use Google's DNS, or any other DNS.

As you mention, this _is_ a rare circumstance, and likely self-induced by some sort of "power user". I assume there are few of those power users who want the choice made for them.

raxxorrax• 6 years ago

Maybe people would have fewer controversy with quad 9?

Would be 9.9.9.9 instead of 8.8.8.8. If this would be better is probably a matter of preference. Google owns many, many servers, so maybe using the underdog eases the mind of some people.

nimbius• 6 years ago

FYSA: you can override Potterings delights in /etc/systemd/resolved.conf.d/fallback_dns.conf by specifying an empty string for the fallbacks.

paulcarroty• 6 years ago

How to delete the fallback Google DNS and setup Cloudflare for example:

/etc/systemd/resolved.conf.d/fallback_dns.conf

  [Resolve]

  FallbackDNS=1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001

The same with NTP:

/etc/systemd/timesyncd.conf

  [Time]

  FallbackNTP=time.cloudflare.com

hedora10• 6 years ago

How do you completely disable the fallback, though?

lazyjones• 6 years ago

From a technical standpoint, there seems to be absolutely no reason to put cruft like this in systemd. If the network isn't configured (or configured correctly), there's no point in making sure DNS "always works". It has more potential to leak information at the wrong moment than to fix anything the user/administrator did wrong.

pas3• 6 years ago

It's a quick and dirty sane default used for development.

diegocg• 6 years ago

This is probably part of networkd, which is a different daemon in charge of managing the network

creeble4• 6 years ago

Or is it systemd-resolvd? Who can tell these days?

mindslight• 6 years ago

Seriously, what the hell? This is one of the most blatant instances of lazy crosscutting leakage, but the general trend is why I've moved net horizon isolation more towards full vms rather than relying on local firewall rules.

Probably the best way to get this "fixed" is to propose that resolved fall back to being a full recursive resolver. Poettering won't be able to resist adding more scope.

dec0dedab0de• 6 years ago

I'm kind of behind on systemd, can someone explain why it has DNS and NTP at all? Shouldn't it just use whatever the rest of the computer uses?

AlexandrB4• 6 years ago

Systemd is kind of like the Borg. It slowly assimilates daemons until it eventually replaces all system level functionality. Its next target is home directories[1], then who knows what else.

[1] https://systemd.io/HOME_DIRECTORY/

ghostpepper3• 6 years ago

You're confusing systemd (the replacement for init) with systemd (the replacement for init, dns, syslog, login/getty, grub, your home directory, etc).

Both are called systemd but one is actually only a single module of the other.

znpy3• 6 years ago

the more i grow up the more i emphatize with Poettering.

AlexandrB4• 6 years ago

So to summarize:

When discussing privacy and Google a common refrain is "just don't use Google products then". But Google's DNS is used as the default for a key system daemon in the majority of Linux systems?

I'm going to file this under "voting with your wallet is bullshit".

I also hope that the systemd team is watching the Google DNS ToS like a hawk because: "We may modify the Terms or any portion to, for example, reflect changes to the law or changes to our APIs. You should look at the Terms regularly."

microcolonel• 6 years ago

The singular party who is entitled to complain about this default configuration is Google.

jancsika• 6 years ago

At flare-up #237 you'd think one would have figured out a professional way to handle questions like this.

Buried in the pointless flamewar is the maintainer's own reply which is the way forward:

Anyway, if there's a well respected network of community DNS servers that can roughly match Cloudflare/Google we can add, sure.

That is the correct and initial response the maintainer should have given. It puts the onus on OP to show how their preferred DNS stacks up against Cloudfare/Google.

Instead, the maintainer plays dumb wrt the importance of defaults, essentially guaranteeing that OP will escalate the rhetoric. Worse, the maintainer responds in kind.

If the maintainer had gone the correct (and easy!) route, we'd all benefited by having learned how this non-profit DNS stacks up against the others from a technical standpoint. (How does it, anyway?)

And to cover my bases-- when spam gets through to the inbox, no serious person asks, "Why doesn't anyone ever talk about the spammer's responsibility to prevent spam? What about the spammer?" Similar logic applies for why I'm talking about maintainer and not OP.

psadauskas• 6 years ago

Buried? As the 6th post in an 8-post thread? And I don't see any flaming at all. Your comment here is far more aggressive than any in the Github issue.

eqvinox• 6 years ago

It's after another maintainer post, and then the post begins by ... weird name calling about the funding question (which, albeit maybe a bit excessive, I'd still consider valid to ask.)

I think "buried" is an OK description of that.

Systemd: Don’t fallback to Google NTP and DNS

Related Stories