Live data from Hacker News

AdGuard DNS: A Privacy-Oriented DNS Server

adguard.com

41–50 of 111 posts

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#41

This is really groundbreaking but it got less noise than I thought it would. Adhell (an app that is capable of doing system wide ad blocking along with many other things thanks to Knox which is Samsung-only capability) was the main reason I stayed with Samsung for years. Now every phone with Android Pie will be to use dns based ad blocking in all networks without running an annoying app in the background.

There's also AdAway, which runs on any rooted Android phone, and doesn't require you to show all your traffic to a particular DNS server.

The advantage of Knox based blocking is that it doesn't require root.

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#42
post #39
post #35

Earlier quoted context omitted.

It doesn't cost that much to run a DNS server, even with DoH/DoT. You can easily serve a few million users with a milisecond latency off a cheap instance with 2GB instance. That's not to say the cost is zero, but with with multiple caching layers (O/S, browser, router, etc), and serving same results for everyone, server costs are not very high.

This might be a little more expensive than usual if it returns NXDOMAIN for known ad serving domains. Many DNS clients don't cache failures.

Don't know how AdGuard does this, but pihole returns 127.0.0.1 for ad-serving domains. I don't know enough about DNS to guess why it does that instead of returning a failure, though my guess is that maybe doing so prevents software from falling through to a user's secondary DNS server.

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#43
post #14
post #13

I’ve been using Pi-Hole on my home network and it’s amazing. Routinely 18-20%% of DNS requests are blocked. When my wife goes out onto another network she says she is shocked at how ugly her web browsing becomes (ads on nytimes, huffpo, etc). I highly recommend it. Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP.

> Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP. Curious how you set this up? I see cloudflare as an option in the pihole settings but doesn't appear to be encrypted? (at least as a default)

Checkout DNS Crypt. It came as an option when I flashed my router to DDWRT but it can also be installed on your laptop/desktop.

https://dnscrypt.info/

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#44
post #39

Earlier quoted context omitted.

This might be a little more expensive than usual if it returns NXDOMAIN for known ad serving domains. Many DNS clients don't cache failures.

Don't know how AdGuard does this, but pihole returns 127.0.0.1 for ad-serving domains. I don't know enough about DNS to guess why it does that instead of returning a failure, though my guess is that maybe doing so prevents software from falling through to a user's secondary DNS server.

Interesting. Could produce odd results if you run a local webserver and don't have SNI on. Seems like that behavior should be something configurable.

Edit: Apparently it is. https://pi-hole.net/2018/05/18/nxdomain-and-null-blocking-wi...

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#45

I never liked the idea of using DNS services for filtering web content. For one, it seems like the wrong tool for the job. Filtered content can simply switch to identifying content by IP address instead of DNS, correct? Or change DNS constantly. And for two, of course there are concerns with handing someone your DNS queries in return for filtering...

In practice, I’ve never seen filtered content change to ip addresses or rotating dns names. Do you know of an example?

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#46
How is it being monetized? I have become more and more suspicious of “free” privacy services. Unless there is an exchange of money for a service, it is highly likely that eventually the company will either fold, or decide to sell the previously private information.

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#47

How is it being monetized? I have become more and more suspicious of “free” privacy services. Unless there is an exchange of money for a service, it is highly likely that eventually the company will either fold, or decide to sell the previously private information.

Its a marketing expense as far as I can tell. They sell a mobile adblocker.

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#48
post #40

Misleading claim: any external DNS server is not private. Your requests are directed to a third-party. I suspect data-mining you is how they pay their server bills. The correct technical solution for privacy is running your own DNS server locally.

https://1.1.1.1/

> We will never sell your data or use it to target ads. Period.

> We’ve retained KPMG to audit our systems annually

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#49
post #33
post #13

I’ve been using Pi-Hole on my home network and it’s amazing. Routinely 18-20%% of DNS requests are blocked. When my wife goes out onto another network she says she is shocked at how ugly her web browsing becomes (ads on nytimes, huffpo, etc). I highly recommend it. Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP.

You might already know this, but in case you don't: they can still see the domain names you visit in plain text because of TLS SNI: https://en.wikipedia.org/wiki/Server_Name_Indication Encrypted SNI is a thing on the horizon that'll let us give the dual middle finger to our ISPs. As far as I know, it is not here now though.

There’s an open request to add ESNI support to cloudflared

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#50
post #14
post #13

I’ve been using Pi-Hole on my home network and it’s amazing. Routinely 18-20%% of DNS requests are blocked. When my wife goes out onto another network she says she is shocked at how ugly her web browsing becomes (ads on nytimes, huffpo, etc). I highly recommend it. Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP.

> Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP. Curious how you set this up? I see cloudflare as an option in the pihole settings but doesn't appear to be encrypted? (at least as a default)

If you want more options, dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy

https://github.com/pi-hole/pi-hole/wiki/DNSCrypt-2.0

Post reply on HN