Paul Vixie thinks more people should be running their own DNS servers
businessinsider.com
Paul Vixie thinks more people should be running their own DNS servers
1–10 of 155 posts
Re: Paul Vixie thinks more people should be running their own DNS servers
#2I run dnsmasq at home talking to Google DNS via DoH. I’ve been thinking about running my own recursive resolver but that theoretically lets my ISP see all my DNS lookups.
I think as a compromise I’ll run my own recursive DNS on a digital ocean droplet and point my local dnsmasq instance at that.
Re: Paul Vixie thinks more people should be running their own DNS servers
#3I run dnsmasq at home talking to Google DNS via DoH. I’ve been thinking about running my own recursive resolver but that theoretically lets my ISP see all my DNS lookups. I think as a compromise I’ll run my own recursive DNS on a digital ocean droplet and point my local dnsmasq instance at that.
So you're cool with Google, a company whose primary business is tracking people, seeing all your DNS, but not your ISP, whose primary business is delivering network access, notwithstanding their bumbling efforts to branch out.
Now, Google does claim they don't track DNS requests. But consider why that is? Once upon a time they didn't scan Gmail content either, but that was before GMail dominated the webmail space.
What do you think is going to happen once DNS becomes centralized? If it's taken too far we won't be able to go back. And it can easily go too far. Chrome and Firefox are ubiquitous enough that if they succeed in removing local resolvers from the loop it will mean that the entire ecosystem will have transformed to accommodate them. Software stacks, configuration policies, etc will have all evolved to disfavor niche use cases and favor Google, Cloudflare, etc.
ISPs can already see the IP address we're all connecting to, and the correlation between domains and IPv4 addresses is more than strong enough to provide the necessary information for commercial profiling. IPv6 will virtually make it 1:1. (So Encrypted SNI likewise provides little benefit.)
The shift to TLS accounts for 90% of the potential capacity for avoiding ISP snooping, short of VPNs or TOR. That last 10% comes with a huge price tag.
Re: Paul Vixie thinks more people should be running their own DNS servers
#4I run dnsmasq at home talking to Google DNS via DoH. I’ve been thinking about running my own recursive resolver but that theoretically lets my ISP see all my DNS lookups. I think as a compromise I’ll run my own recursive DNS on a digital ocean droplet and point my local dnsmasq instance at that.
So you're cool with Google, a company whose primary business is tracking people, seeing all your DNS, but not your ISP, whose primary business is delivering network access, notwithstanding their bumbling efforts to branch out. Now, Google does claim they don't track DNS requests. But consider why that is? Once upon a time they didn't scan Gmail content either, but that was before GMail dominated the webmail space. Wh…
My ISP is AT&T, so I do indeed trust them less than Google. And no, I don't particularly trust Google either, which is why wrote that I can avoid them both by running a recursive resolver on Digital Ocean (but now I have to trust DO).
I could run a VPN full time, but I'm not willing to accept the added latency and bandwidth cost.
What would you suggest?
Re: Paul Vixie thinks more people should be running their own DNS servers
#5Earlier quoted context omitted.
So you're cool with Google, a company whose primary business is tracking people, seeing all your DNS, but not your ISP, whose primary business is delivering network access, notwithstanding their bumbling efforts to branch out. Now, Google does claim they don't track DNS requests. But consider why that is? Once upon a time they didn't scan Gmail content either, but that was before GMail dominated the webmail space. Wh…
My ISP is AT&T, so I do indeed trust them less than Google. And no, I don't particularly trust Google either, which is why wrote that I can avoid them both by running a recursive resolver on Digital Ocean (but now I have to trust DO). I could run a VPN full time, but I'm not willing to accept the added latency and bandwidth cost. What would you suggest?
Fair enough. I glossed over the Digital Ocean part, or at least failed to appreciate it--you are (or will be) independent and not contributing to centralization of DNS.
Thank you! We need more people to run their own network services in order to preserve our freedom and privacy.
Re: Paul Vixie thinks more people should be running their own DNS servers
#6Earlier quoted context omitted.
My ISP is AT&T, so I do indeed trust them less than Google. And no, I don't particularly trust Google either, which is why wrote that I can avoid them both by running a recursive resolver on Digital Ocean (but now I have to trust DO). I could run a VPN full time, but I'm not willing to accept the added latency and bandwidth cost. What would you suggest?
Fair enough. I glossed over the Digital Ocean part, or at least failed to appreciate it--you are (or will be) independent and not contributing to centralization of DNS. Thank you! We need more people to run their own network services in order to preserve our freedom and privacy.
FWIW, the first machine I ever had broken-in to was a personal box I ran outside the firewall of an employer and the vulnerability was in BIND 4. Circa 1996 probably.
I’d still run my own email if it weren’t such a pain in the ass. I’m not new to this stuff[1], but at some point you get tired of doing SA stuff at home when it’s also your day job.
Re: Paul Vixie thinks more people should be running their own DNS servers
#7Earlier quoted context omitted.
Fair enough. I glossed over the Digital Ocean part, or at least failed to appreciate it--you are (or will be) independent and not contributing to centralization of DNS. Thank you! We need more people to run their own network services in order to preserve our freedom and privacy.
FWIW, the first machine I ever had broken-in to was a personal box I ran outside the firewall of an employer and the vulnerability was in BIND 4. Circa 1996 probably. I’d still run my own email if it weren’t such a pain in the ass. I’m not new to this stuff[1], but at some point you get tired of doing SA stuff at home when it’s also your day job. 1. https://duckduckgo.com/?q=qmail+jay+soffian
Yep. I've been using OpenBSD since circa 2000 and rarely deviate from the stock software and configuration. At least as important as security (and not unrelated), they ship HTTP, SMTP, and DNS services in base; services which the developers use themselves.[1]
Package management is more difficult, but if I have to install something as a package I probably don't want the headache. Upgrades are more manual as compared to Linux distros, but they're simple and consistent and well-documented so require no more than an hour every 6 months. Sysmerge (for upgrading /etc) and now syspatch (for kernel patches) have made it even simpler. The upgrades come precisely every 6 months. The system evolves incrementally so I don't need to invest much effort in keeping pace--just stay on schedule.
I only backup user data and a few key configuration files (e.g. domain specific rules for smtpd.conf and httpd.conf) as I can recreate a setup with minimal effort.
I stopped running POP and IMAP a long time ago. OpenBSD never provided native solutions. (They shipped a POP3 daemon, popa3d, for a few years but few people used it.) I use mutt, some others use alpine, and others just forward their email to somewhere else. I do greylisting with OpenBSD's native spamd and some simple RBL checks that run from the MDA, but that's it. I get more spam than I might otherwise, but it's tolerable, especially considering I don't have to maintain additional software. And most other users don't see the same spam volume--I've used my e-mail address on web pages and in public forums for nearly two decades so it's on pretty much every list traded among spammers and marketers.
[1] People criticize their "secure by default" mantra as disingenuous or misleading, but if you've been running these services for years or decades you know exactly what they mean by it.
Re: Paul Vixie thinks more people should be running their own DNS servers
#8Re: Paul Vixie thinks more people should be running their own DNS servers
#9I run dnsmasq at home talking to Google DNS via DoH. I’ve been thinking about running my own recursive resolver but that theoretically lets my ISP see all my DNS lookups. I think as a compromise I’ll run my own recursive DNS on a digital ocean droplet and point my local dnsmasq instance at that.
So you're cool with Google, a company whose primary business is tracking people, seeing all your DNS, but not your ISP, whose primary business is delivering network access, notwithstanding their bumbling efforts to branch out. Now, Google does claim they don't track DNS requests. But consider why that is? Once upon a time they didn't scan Gmail content either, but that was before GMail dominated the webmail space. Wh…
I'm not certain it is relevant anymore but ISPs used to MITM DNS requests and would send you to redirects for search/advertising pages for what should've been NXDOMAIN responses. Google at the moment has a better track record here.
Re: Paul Vixie thinks more people should be running their own DNS servers
#10I learned recently that my home router runs a forwarding DNS server. I suspect many people are already doing this and don't know it.