Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Neutral DNS servers?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 99 posts

Re: Ask HN: Neutral DNS servers?

#71

Post by kortilla »

contingencies wrote: post #57
kfrzcode wrote: post #50

Earlier quoted context omitted.

As are many Western inventions

DNS[0] is only a decentralized hierarchy with caching, a class of system which pre-dates the digital era as the de-facto means of political and military organization in any human society larger than a village or town. DNS as a directory system for IP is could itself be viewed as a direct philosophical descendant of military insignia (perhaps via the then-popular branch-tangent of the telephone book, itself ex-telegra…

By that same token the internet was invented by the first person to hand gesture to another one. You can’t dilute DNS down to a directory because there were/and are already other directory protocols.

Re: Ask HN: Neutral DNS servers?

#72

Post by mekster »

chrissnell wrote: post #64
DavideNL wrote: post #26

Earlier quoted context omitted.

Although querying the root servers directly is always unencrypted right? So your ISP can see and might manipulate all queries at will?

The way I handle this is to run unbound on a server in the public cloud and then tunnel over TLS from my local unbound to the cloud instance. My local clients query a PiHole, which forwards to unbound on localhost:15353, which forwards everything over TLS to the fully recursive instance of unbound in the cloud, which uses root.hints.

Still, your cloud vendor can see the requests.

But someone can see it, but you can rotate upstream resolvers to split requests if you have to.

Re: Ask HN: Neutral DNS servers?

#73

Post by AnonHP »

chrissnell wrote: post #64
DavideNL wrote: post #26

Earlier quoted context omitted.

Although querying the root servers directly is always unencrypted right? So your ISP can see and might manipulate all queries at will?

The way I handle this is to run unbound on a server in the public cloud and then tunnel over TLS from my local unbound to the cloud instance. My local clients query a PiHole, which forwards to unbound on localhost:15353, which forwards everything over TLS to the fully recursive instance of unbound in the cloud, which uses root.hints.

How is the latency for such a setup? And how is the general browsing experience with said latency (I realize it also depends on which sites you frequently access)? I see some cloud providers/CDNs using a caching TTL as low as five minutes.

Re: Ask HN: Neutral DNS servers?

#74

Post by mekster »

nfriedly wrote: post #9

I know this isn't quite what your asking for, but one idea is to set up a Pi-hole + unbound: https://docs.pi-hole.net/guides/dns/unbound/ Unbound is basically your own private DNS resolver and then Pi-hole lets you filter out whatever "junk" you don't want.

I'm using Adguard Home and it's working great.

https://github.com/AdguardTeam/AdGuardHome

Re: Ask HN: Neutral DNS servers?

#75

Post by speedgoose »

cyounkins wrote: post #55
nimbius wrote: post #30

Google DNS should at this point be considered harmful. Devs love to hardcode it in resolvd because 'user experience' but there's ample evidence its just analytics. Quad 1 cloudflare is reliable doh but comes from a company with a history of bloviating nonsense about internet freedom only to eagerly capitulate to Twitter lynchmobs and blacklist a customer or ten. https://dnscrypt.info/public-servers/ will give you a n…

Can you point to the evidence that Google DNS is used for analytics?

https://developers.google.com/speed/public-dns/privacy

Re: Ask HN: Neutral DNS servers?

#77

Post by justsomehnguy »

AnonHP wrote: post #73
chrissnell wrote: post #64

Earlier quoted context omitted.

The way I handle this is to run unbound on a server in the public cloud and then tunnel over TLS from my local unbound to the cloud instance. My local clients query a PiHole, which forwards to unbound on localhost:15353, which forwards everything over TLS to the fully recursive instance of unbound in the cloud, which uses root.hints.

How is the latency for such a setup? And how is the general browsing experience with said latency (I realize it also depends on which sites you frequently access)? I see some cloud providers/CDNs using a caching TTL as low as five minutes.

You spend most of the time waiting for the actual resolve to complete, not for the "transfer" time between you and VPS.

Source: I'm running Unbound on my notebook, I'm actually queried the stats for some heated discussion on reddit.

For example my current stats_noreset:

    histogram.000000.000512.to.000000.001024=17
    histogram.000000.001024.to.000000.002048=33
    histogram.000000.002048.to.000000.004096=251
    histogram.000000.004096.to.000000.008192=509
    histogram.000000.008192.to.000000.016384=1161
    histogram.000000.016384.to.000000.032768=1891
    histogram.000000.032768.to.000000.065536=2611
    histogram.000000.065536.to.000000.131072=3197
    histogram.000000.131072.to.000000.262144=2502
    histogram.000000.262144.to.000000.524288=1547
    histogram.000000.524288.to.000001.000000=857
    histogram.000001.000000.to.000002.000000=121
    histogram.000002.000000.to.000004.000000=70
    histogram.000004.000000.to.000008.000000=22
    histogram.000008.000000.to.000016.000000=441
    histogram.000016.000000.to.000032.000000=80
As you can see most of queries are completed in a way below 500ms. Adding another 20-40ms on top that doesn't change anything, because caching is a thing and with Unbound you can even ask to actually refresh the expiring records, so you would be served a fresh one from the cache every time, though I never bothered with it, it works fine even without it.

Re: Ask HN: Neutral DNS servers?

#78

Post by justsomehnguy »

egamirorrim wrote: post #29
nfriedly wrote: post #9

I know this isn't quite what your asking for, but one idea is to set up a Pi-hole + unbound: https://docs.pi-hole.net/guides/dns/unbound/ Unbound is basically your own private DNS resolver and then Pi-hole lets you filter out whatever "junk" you don't want.

I don't know if it's an obvious question or not, but how does performance compare with your own unbound vs quad1/8/9? I imagine it's slower in general?

https://news.ycombinator.com/item?id=30649709

Re: Ask HN: Neutral DNS servers?

#80

Post by [deleted] »

irq wrote: post #58
rsync wrote: post #21

Earlier quoted context omitted.

I do this. I have my own resolver on my own server running unbound and it gets service from my paid nextdns account. Sort of like having a pihole but it is available from anywhere and I don’t have to run a rpi…

This setup is intriguing. I'm curious, is there any latency penalty going this way vs using your own pihole + 1.1.1.1 or 8.8.8.8 instead of nextdns?

[deleted]
Post reply on HN