Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Running the second public ODoH relay

numa.rs

Post reply on HN
Print view View original

21–30 of 50 posts

Re: Show HN: Running the second public ODoH relay

#21

Post by UqWBcuFx6NV4r »

LoganDark wrote: post #20
jeroenhd wrote: post #12

Earlier quoted context omitted.

It means you can use a decently fast DNS server like Cloudflare without the major privacy problems of using Cloudflare. Or DNS4EU, or any non-ISP DNS server really. Your ISP snooping on you with SNI logging is something people using normal ISPs don't need to worry about, but feeding all your data into a profit-driven company is.

> something people using normal ISPs don't need to worry about It doesn't matter which ISP you're using if the cables are tapped, which they pretty much are.

Please don’t be intentionally tone-deaf. “a nation-state can track my shit therefore it’s not with doing” is a silly, silly, silly approach to security, and does not speak to the concerns of the vast majority of even privacy-focused people.

Re: Show HN: Running the second public ODoH relay

#25

Post by aftbit »

elp wrote: post #10
cedws wrote: post #3

What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?

My, admittedly cynical, view of it is that the main selling point is that you share your data with the person running the ODoH server. The truth is that very very few people run their own recursive nameserver. The entirely reasonable assumption for any authoritative nameserver, like .com, is that the query is being asked on behalf of someone else and knowing that a user of your nameserver asked for the ip of sexyshee…

I'm disappointed that sexysheep.com is just a domain parking page. I'm not sure what I was hoping for, but I think that's the worst possible outcome.

Re: Show HN: Running the second public ODoH relay

#26

Post by Bender »

To me this feels like turtles all the way down. Ultimately who owns and controls the layer-4 proxies and DoH servers matters and can easily get into turtle arguments. Who controls the certs controls the mathematical obfuscation (encryption) also matters. Pieces of the puzzle can be shared and recombined at any time.

Me personally, I will stick with running my own DoH servers and thus I need not run any turtles (layer 4 proxies) in the middle of my already encrypted connections. Anyone running Unbound DNS can enable DoH if Unbound was built including '--with-libnghttp2' which the Alpine Linux version has. At the moment my browser is talking to Unbound over DoH on my local network so I get the advantages of ECN but I can easily switch it to any server where I have installed Unbound. Ultimately DNS at some point will be unencrypted UDP port 53 so I would rather it be me that determines where that happens so I can optimize my own cache and pre-cache cron jobs to mask my DNS behavior, but that's just me. Others can do whatever they want, as they should. The people that operate my ISP are bigger deviants than I and they know that I know that they know that I know this.

Oh and as a funny side note, I can warm up cache on entirely unrelated nodes and then transfer the cache export to any node and keep it valid on that node as long as I wish making the vast majority of my DNS requests respond in less than 700 nanoseconds not that I am in any hurry.

    unbound-control dump_cache | bzip -9c > /dev/shm/dump_node_1045.txt.bz2
I can then bring those cache dumps in from any node to my home network making DNS resolution entirely invisible. Automation is only limited to ones imagination. Or AI's imagination. I personally find it beneficial to listen to Pure Imagination from Willy Wonka & The Chocolate Factory (1971) RIP Gene Wilder
Post reply on HN