So why is Netflix hitting me with Dradis?

johnpoz

Also if it was a company as big as Netflix doing something - why would they not just hide the traffic in their normal traffic vs doing a DNS query in the clear?

This isn't speculation - its experience and common sense

tinfoilmatt

@johnpoz You'd have to ask Netflix.

johnpoz

@tinfoilmatt Sure go ask them.. Or its just a simple DNS query and not some form of trying to sneak something into your network.

tinfoilmatt

@johnpoz said in So why is Netflix hitting me with Dradis?:

Or its just a simple DNS query and not some form of trying to sneak something into your network.

Which, again, is equal speculation on your part.

johnpoz

@tinfoilmatt Yeah I am just speculating that a dns query is just a dns query <rolleyes>

tinfoilmatt

@johnpoz said in So why is Netflix hitting me with Dradis?:

@tinfoilmatt Yeah I am just speculating that a dns query is just a dns query <rolleyes>

Your attempts to manipulate my words reveal the strength of your position.

aivxtla

You could block that if you want, but when they can't talk they tend to get more chatty about it - asking more and more often, etc..

Also a noob here myself lol. That's pretty much like my Netgear router despite being in AP mode, pretty much spams 8.8.8.8/8.8.4.4 for connectivity checks, even though its DNS in its web interface is set to the pfsense firewall which in turn is set to Cloudflare and Quad9. When 8.8.8.8/8.8.4.4 got blocked as part of the DoH IP list in pfblockerng it became even more aggressive and I had a spam of block alerts like every 3-5 secs if not more often at times lol. If I recall something similar happened when I had "Chromecast with Google TV" dongles a few years ago, so I'm not surprised.

tinfoilmatt

@aivxtla My devices hammer connectivitycheck.gstatic.com, gsas.apple.com, bing.com, ngw.dvr163.com (a Chinese NVR), etc. all day long. It is what it is.

On this point specifically (i.e., DNSBL and/or IPBL), make sure to configure logging such that these queries/packets are 'sinked'.

johnpoz

@tinfoilmatt said in So why is Netflix hitting me with Dradis?:

strength of your position.

So you're saying it is malicious then? an iot device doing queries to a hard coded public DNS server, to a domain dradis.netflix.com

tinfoilmatt

@johnpoz OP's speculation that his TV querying a domain aliased to appboot.dradis.netflix.com is potentially nefarious, is equally as speculative as your 'position' that it's not.

johnpoz

@tinfoilmatt whatever - done here..

And the moon is not made of cheese is speculation the same as saying it is.

While mine is based on common sense and experience - his is based off what? His tinfoil hat.. He doesn't even understand the direction of the traffic flow..

tinfoilmatt

@johnpoz said in So why is Netflix hitting me with Dradis?:

And the moon is not made of cheese is speculation the same as saying it is.

No. It's mostly rock. We've been there, and samples have come back.

If you simply want to call the person stupid for trying to understand and learn, then just have out and say it, John. You're not hiding it very well.