71–80 of 111 posts
Pi hole (free) is good for this kind of thing if you are at home https://pi-hole.net/ I found that pihole did too much so wrote my own. I dont think it has any users, except in my house but it seems to work https://github.com/time4tea-net/py-hole/blob/master/README.m...
But does it work on outside home and on 4G?
Earlier quoted context omitted.
For $5/month you can roll your own OpenVPN server with Digital Ocean and it will. [0] Bonus: your cellular ISP can't see your traffic and you're automatically protected at coffee shops. Downside: Battery life takes a slight hit due to encryption. [0] https://www.digitalocean.com/community/tutorials/how-to-bloc...
Regarding the bonus: you're just shifting the problem. Your ISP can't see your traffic, but now digital ocean can.
DO will forward those torrent scare / spam server abuse emails ASAP, so they won't be good for that kind of stuff.
I never liked the idea of using DNS services for filtering web content. For one, it seems like the wrong tool for the job. Filtered content can simply switch to identifying content by IP address instead of DNS, correct? Or change DNS constantly. And for two, of course there are concerns with handing someone your DNS queries in return for filtering...
In practice, I’ve never seen filtered content change to ip addresses or rotating dns names. Do you know of an example?
The NYT could serve their ads from NYT servers instead of nagging you to turn off adblock and continue with their 3rd party ad providers.
So they are not doing that, so I doubt cirumventing DNS adblock will be something that they will care much about either.
It turns out lots of things will resolve anything that looks vaguely like a hostname to see if, in fact, they are a hostname. eg, "untitled.pdf". These queries get passed to your ISP, and then on towards the root name servers. So if you run a large nameserver, you quickly find that most of your DNS queries are very obviously rubbish.
With DNSSEC there are two new records (NSEC, NSEC3), that let you say "between these two names, I guarantee there is no valid records". Thus if your nameserver supports this, it can say "there are no valid names between .pccw and .pe, and thus anything that ends with .pdf is invalid". NSEC and NSEC3 records can both be cached and your resolver can synthesise NXDOMAIN records for them. (See RFC8198 for details).
So, instead of spraying queries for "untitled.pdf" across the internet, you can quickly, and efficiently return NXDOMAIN.
Another cause of these is search paths, when you look up "news.ycombinator.net", if that resolution fails, it will try adding the search path, eg: "news.ycombinator.net.example.org", again, leaking typos, and filenames to everyone in your search path.
If you actually value your privacy, this is the first step that you should take.
I’ve been using Pi-Hole on my home network and it’s amazing. Routinely 18-20%% of DNS requests are blocked. When my wife goes out onto another network she says she is shocked at how ugly her web browsing becomes (ads on nytimes, huffpo, etc). I highly recommend it. Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP.
You might already know this, but in case you don't: they can still see the domain names you visit in plain text because of TLS SNI: https://en.wikipedia.org/wiki/Server_Name_Indication Encrypted SNI is a thing on the horizon that'll let us give the dual middle finger to our ISPs. As far as I know, it is not here now though.
Misleading claim: any external DNS server is not private. Your requests are directed to a third-party. I suspect data-mining you is how they pay their server bills. The correct technical solution for privacy is running your own DNS server locally.
The ISP can still see requests the local DNS server sends to the Internet
Private infrastructure for the win.
So they would like you to please use their own DNS servers... no thanks, I'll just keep using my own, on-premise, private DNS infrastructure at home. Private infrastructure for the win.
So they would like you to please use their own DNS servers... no thanks, I'll just keep using my own, on-premise, private DNS infrastructure at home. Private infrastructure for the win.