Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Paul Vixie thinks more people should be running their own DNS servers

businessinsider.com

Post reply on HN
Print view View original

11–20 of 155 posts

Re: Paul Vixie thinks more people should be running their own DNS servers

#11

Post by gruez »

js2 wrote: post #4
wahern wrote: post #3

Earlier quoted context omitted.

So you're cool with Google, a company whose primary business is tracking people, seeing all your DNS, but not your ISP, whose primary business is delivering network access, notwithstanding their bumbling efforts to branch out. Now, Google does claim they don't track DNS requests. But consider why that is? Once upon a time they didn't scan Gmail content either, but that was before GMail dominated the webmail space. Wh…

My ISP is AT&T, so I do indeed trust them less than Google. And no, I don't particularly trust Google either, which is why wrote that I can avoid them both by running a recursive resolver on Digital Ocean (but now I have to trust DO). I could run a VPN full time, but I'm not willing to accept the added latency and bandwidth cost. What would you suggest?

>I don't particularly trust Google either, which is why wrote that I can avoid them both by running a recursive resolver on Digital Ocean (but now I have to trust DO).

Why not run DoH over tor? Much better privacy than a server/ip address only used by you and can be traced back to you.

Re: Paul Vixie thinks more people should be running their own DNS servers

#12

Post by js2 »

Ironically, the instructions linked to in this article for running your own DNS server[1] suggest configuring it to forward all non-local queries to your ISP or Google DNS.

(It’s not clear to me whether Vixie is more bothered by the loss of privacy in using Google/Cloudflare/OpenDNS/etc and/or it’s the loss of privacy.)

If you’re going to do that, you might as well use dnsmasq or just use your ISPs servers directly. If your concern is privacy, you need to configure BIND to operate in recursive mode instead of as a forwarder (dnsmasq is a forwarder only, but you could use unbind if you don’t like BIND). But note that your ISP could in theory still snoop your recursive DNS queried. It all depends who you trust the least.

You could also, per my sibling comment, run dnsmasq locally and then run a recursive DNS server on a cloud server, using either a VPN or DOH in-between. That would give you a local cache with your own recursive DNS that your ISP can’t snoop. But do you trust your cloud provider? (Also make sure if you do this that you configure edns0 client subnet or your video streaming may break.)

[1] https://www.ionos.com/digitalguide/server/configuration/how-...

Re: Paul Vixie thinks more people should be running their own DNS servers

#13

Post by iforgotpassword »

js2 wrote: post #6
wahern wrote: post #5

Earlier quoted context omitted.

Fair enough. I glossed over the Digital Ocean part, or at least failed to appreciate it--you are (or will be) independent and not contributing to centralization of DNS. Thank you! We need more people to run their own network services in order to preserve our freedom and privacy.

FWIW, the first machine I ever had broken-in to was a personal box I ran outside the firewall of an employer and the vulnerability was in BIND 4. Circa 1996 probably. I’d still run my own email if it weren’t such a pain in the ass. I’m not new to this stuff[1], but at some point you get tired of doing SA stuff at home when it’s also your day job. 1. https://duckduckgo.com/?q=qmail+jay+soffian

> I’m not new to this stuff[1], but at some point you get tired of doing SA stuff at home when it’s also your day job.

Amen! Which is really sad sometimes. I really enjoyed that stuff when I was younger. Sometimes makes me wish I had picked another career so I might still enjoy fiddling with more or less trivial tech as a hobby.

Re: Paul Vixie thinks more people should be running their own DNS servers

#14

Post by js2 »

cbdumas wrote: post #10

I learned recently that my home router runs a forwarding DNS server. I suspect many people are already doing this and don't know it.

The article is partly about the performance issue of not having a local server and partly about the privacy loss of sending all your DNS queries to Google. Even without a local dns server there’s still a stub resolver on your OS that provides some degree of caching.

Re: Paul Vixie thinks more people should be running their own DNS servers

#15

Post by jeffreyrogers »

I ran my own DNS servers in the past (and email servers). It's not too difficult to setup (email is significantly harder), although you'll probably have to run at least two DNS servers in order to use it with a domain because most registrars won't let you change the nameservers unless you have at least two.

I think it's a worthwhile thing to do since it demystifies how DNS works (similarly with running your own email servers), but if you're running everything on cloud infrastructure I don't see much benefit aside from the educational aspect.

Re: Paul Vixie thinks more people should be running their own DNS servers

#16

Post by js2 »

commandersaki wrote: post #9
wahern wrote: post #3

Earlier quoted context omitted.

So you're cool with Google, a company whose primary business is tracking people, seeing all your DNS, but not your ISP, whose primary business is delivering network access, notwithstanding their bumbling efforts to branch out. Now, Google does claim they don't track DNS requests. But consider why that is? Once upon a time they didn't scan Gmail content either, but that was before GMail dominated the webmail space. Wh…

I'm not certain it is relevant anymore but ISPs used to MITM DNS requests and would send you to redirects for search/advertising pages for what should've been NXDOMAIN responses. Google at the moment has a better track record here.

They didn’t MITM the requests ... you had to explicitly be using the ISP’s DNS servers. And yes this is one of the reasons I long ago stopped using my ISPs DNS servers.

Re: Paul Vixie thinks more people should be running their own DNS servers

#17

Post by js2 »

gruez wrote: post #11
js2 wrote: post #4

Earlier quoted context omitted.

My ISP is AT&T, so I do indeed trust them less than Google. And no, I don't particularly trust Google either, which is why wrote that I can avoid them both by running a recursive resolver on Digital Ocean (but now I have to trust DO). I could run a VPN full time, but I'm not willing to accept the added latency and bandwidth cost. What would you suggest?

>I don't particularly trust Google either, which is why wrote that I can avoid them both by running a recursive resolver on Digital Ocean (but now I have to trust DO). Why not run DoH over tor? Much better privacy than a server/ip address only used by you and can be traced back to you.

Um, because at the end of the day I don’t care that much and want to actually be able to watch Netflix and stream iTunes and those things tend not to work unless they can route you to a reasonably close CDN, which means knowing at least your /24 usually.

Re: Paul Vixie thinks more people should be running their own DNS servers

#19

Post by skybrian »

wahern wrote: post #3
js2 wrote: post #2

I run dnsmasq at home talking to Google DNS via DoH. I’ve been thinking about running my own recursive resolver but that theoretically lets my ISP see all my DNS lookups. I think as a compromise I’ll run my own recursive DNS on a digital ocean droplet and point my local dnsmasq instance at that.

So you're cool with Google, a company whose primary business is tracking people, seeing all your DNS, but not your ISP, whose primary business is delivering network access, notwithstanding their bumbling efforts to branch out. Now, Google does claim they don't track DNS requests. But consider why that is? Once upon a time they didn't scan Gmail content either, but that was before GMail dominated the webmail space. Wh…

Maybe you shouldn't talk so confidently, considering you got it all wrong about GMail? It's always scanned your email. How do you think spam filtering works? And it used to scan emails for advertising, but doesn't anymore:

https://www.nytimes.com/2017/06/23/technology/gmail-ads.html

Re: Paul Vixie thinks more people should be running their own DNS servers

#20

Post by rmdoss »

More people should be running their own mail servers, their own web servers, their own IRC servers, etc.

But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well.

Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns requests are a MISS).

Privacy? With DNS over TLS/DNS over HTTPS, your ISPs can't see what you are doing. If you run DNS locally, they can. Yes, they will see all the requests your resolvers are doing to the auth DNS servers.

Security? Some good resolvers, like Quad9 or CleanBrowsing will block malicious domains. CleanBrowsing will also help blocking adult content if you have kids. I don't think maintaining such control is practical for most people (pi-hole helps, but still hard to keep it updated and find good enough databases to use).

I would love a de-centralized web, but it is pretty hard to go back.

Post reply on HN