Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Neutral DNS servers?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 99 posts

Re: Ask HN: Neutral DNS servers?

#61

Post by jka »

endymi0n wrote: post #47
aaomidi wrote: post #36

Earlier quoted context omitted.

They are western centric, and unfortunately, in this current state of the web they're still essentially the authority on DNS. Alternatively, you can maintain the NSes for all the TLDs you are particularly interested in, and alert yourself if they change to something you don't recognize. Finally, keep in mind that whatever you do, you need to have multiple vantage points to the internet. There's not a lot stopping you…

> They are western centric, and unfortunately, in this current state of the web they're still essentially the authority on DNS. I‘m curious to see your evidence on that or which future state you would see as a more fortunate one.

Questioning why the distributed cluster runs on nodes 'a' and 'b' alone doesn't necessarily imply that nodes 'c', 'd' and 'e' are any better or worse, today or in future.

Re: Ask HN: Neutral DNS servers?

#62

Post by sp332 »

nix23 wrote: post #42

>Given my ‘Information Wants To Be Free’ viewpoint, are there any DNS equivalents of Switzerland That's exactly why Quad9 changed it's HQ to Switzerland: https://www.switch.ch/news/quad9-moves-to-Switzerland/

Quad9's default 9.9.9.9 address blocks malware, but the alternate 9.9.9.10 does not. https://www.quad9.net/service/service-addresses-and-features

Re: Ask HN: Neutral DNS servers?

#63

Post by Arubis »

b112 wrote: post #60
cyounkins wrote: post #55

Earlier quoted context omitted.

Can you point to the evidence that Google DNS is used for analytics?

Another person responded with info, but at this point, shouldn't we assume every single thing Google does, is for analytics? At this point, the onus is to prove thing $x is not used for Google analytics.

Came here to say roughly the same thing. That it’s Google and they’re not charging you for it can at this point be considered suspicious, if not conclusive.

Re: Ask HN: Neutral DNS servers?

#64

Post by chrissnell »

DavideNL wrote: post #26
neilalexander wrote: post #2

You could just run a recursive resolver yourself by using the root hints. You don't need to delegate your DNS queries onto a third-party resolver like Quad9. https://www.iana.org/domains/root/files

Although querying the root servers directly is always unencrypted right? So your ISP can see and might manipulate all queries at will?

The way I handle this is to run unbound on a server in the public cloud and then tunnel over TLS from my local unbound to the cloud instance. My local clients query a PiHole, which forwards to unbound on localhost:15353, which forwards everything over TLS to the fully recursive instance of unbound in the cloud, which uses root.hints.

Re: Ask HN: Neutral DNS servers?

#65

Post by viraptor »

0xbadcafebee wrote: post #41
DavideNL wrote: post #26

Earlier quoted context omitted.

Although querying the root servers directly is always unencrypted right? So your ISP can see and might manipulate all queries at will?

In theory if you got a resolver which could disable UDP queries, it would then default to TCP, and the ISP couldn't manipulate those. Don't know if any resolver supports disabling UDP though.

> would then default to TCP, and the ISP couldn't manipulate those

They can easily manipulate TCP as well. Unless you establish an authenticated session like TLS, TCP can be mitm-ed easily.

Re: Ask HN: Neutral DNS servers?

#67

Post by aaomidi »

endymi0n wrote: post #47
aaomidi wrote: post #36

Earlier quoted context omitted.

They are western centric, and unfortunately, in this current state of the web they're still essentially the authority on DNS. Alternatively, you can maintain the NSes for all the TLDs you are particularly interested in, and alert yourself if they change to something you don't recognize. Finally, keep in mind that whatever you do, you need to have multiple vantage points to the internet. There's not a lot stopping you…

> They are western centric, and unfortunately, in this current state of the web they're still essentially the authority on DNS. I‘m curious to see your evidence on that or which future state you would see as a more fortunate one.

If I knew the answer to this I would be very rich and probably have my name on multiple textbooks of solving decentralized computing problems.

Re: Ask HN: Neutral DNS servers?

#68

Post by tptacek »

progval wrote: post #46
tptacek wrote: post #34

Earlier quoted context omitted.

It doesn't solve the "manipulate" problem we're talking about here, either: nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain; it only (situationally) prevents them from redirecting it somewhere else. (And, of course, it only works if you're running your own recursive server; it does nothing whatsoever in the 8.8.8.8-type use case).

> nothing about DNSSEC prevents a DNS server (or middlebox) from denying results to a disfavored domain But at least it is detectable thanks to NSEC and NSEC3 records.

It's detectable when the site that the DNS provider is censoring falls off the Internet!

Re: Ask HN: Neutral DNS servers?

#69

Post by cyounkins »

b112 wrote: post #60
cyounkins wrote: post #55

Earlier quoted context omitted.

Can you point to the evidence that Google DNS is used for analytics?

Another person responded with info, but at this point, shouldn't we assume every single thing Google does, is for analytics? At this point, the onus is to prove thing $x is not used for Google analytics.

I think some of Google's efforts are genuinely for the public good, like Project Zero.
Post reply on HN