Live data from Hacker News

Paul Vixie thinks more people should be running their own DNS servers

businessinsider.com

21–30 of 155 posts

Re: Paul Vixie thinks more people should be running their own DNS servers

#21

How hard is it to make a personal use raspberry pi dns server that assembles a local database using the consensus of a bunch of major sources?

That's not really how customer DNS works, so you're talking about a custom monitoring project. It doesn't seem very hard to monitor the consensus - get a stream of domains and run "dig" against the known endpoints.

But if you want an actual server doing that, I don't think there's much point. You'll get differences for various valid reasons. Entries changing, different anycasts getting different geo responses, etc. It's a bit like "a man with a watch knows the right time, a man with two watches can never be sure".

So the answer is really - why do you want to do this? Different reasons here lead to different approaches.

Re: Paul Vixie thinks more people should be running their own DNS servers

#22
That seems like a bit much. I think getting people to run a raspberry and pi-hole is a much more realistic aim in terms of usefulness and creating awareness.

Plus it's been pretty eye opening. I'm running uBlock Origin and Privacy badger...and still the pi-hole filter 25% of my traffic. A full fkin quarter after adblockers...

Re: Paul Vixie thinks more people should be running their own DNS servers

#24

I ran my own DNS servers in the past (and email servers). It's not too difficult to setup (email is significantly harder), although you'll probably have to run at least two DNS servers in order to use it with a domain because most registrars won't let you change the nameservers unless you have at least two. I think it's a worthwhile thing to do since it demystifies how DNS works (similarly with running your own email…

There's a nice and free secondary DNS service available at https://freedns.afraid.org - so if you trust that service, you can get away with running just one master DNS yourself.

Re: Paul Vixie thinks more people should be running their own DNS servers

#25
post #3
post #2

I run dnsmasq at home talking to Google DNS via DoH. I’ve been thinking about running my own recursive resolver but that theoretically lets my ISP see all my DNS lookups. I think as a compromise I’ll run my own recursive DNS on a digital ocean droplet and point my local dnsmasq instance at that.

So you're cool with Google, a company whose primary business is tracking people, seeing all your DNS, but not your ISP, whose primary business is delivering network access, notwithstanding their bumbling efforts to branch out. Now, Google does claim they don't track DNS requests. But consider why that is? Once upon a time they didn't scan Gmail content either, but that was before GMail dominated the webmail space. Wh…

Disclaimer: I work for Google, but not on DNS or Gmail.

> Now, Google does claim they don't track DNS requests. But consider why that is? Once upon a time they didn't scan Gmail content either, but that was before GMail dominated the webmail space.

You seem to assume that it's a singular organization with a unified agenda, but this really isn't the case. It's the same thing about when folks assume Google looks at your Drive files to recommend ads to you -- it isn't true, there's different motives there.

Drive: we want to sell you storage, your data isn't scanned (except for viruses). Google DNS: speed up DNS, which improves load times, which improves the overall web experience. Photos: Ditto, we want to sell you storage.

Performance is a feature, and most ISP resolvers are junk. Worse, many of those resolvers like to inject their own NXDOMAIN pages. :\

You could argue that Google DNS does positively impact Ads, but only in the respect that faster DNS resolution helps ads load faster too. Overall, I see it as one of those "long term greedy" (my own words) strategies.

As a privacy-conscious Googler myself, I've taken a look at Google DNS to convince myself that it's what it says on the tin. As far as I can tell it is, but I don't expect you to take my word for it. What logging exists is extremely temporary (short-term debugging.)

Re: Gmail, this isn't true either. Sure, there's still processing of your emails (we receive your email, scan it for spam), but it isn't used for Gmail ads. The public perception of this was so bad and the incremental improvement in ad quality so low, that now ads just use your general ad profile. No email scanning involved.

> Software stacks, configuration policies, etc will have all evolved to disfavor niche use cases and favor Google, Cloudflare, etc.

This is a different matter entirely, but this isn't _always_ a bad thing. I'm thinking of TCP here, which has almost entirely been ossified by middleboxes. Same for TLS -- TLS development has been hamstrung by these same kinds of middleboxes and "protocol accelerators." This kind of incredible technology position has allowed for the acceleration of HTTP/2 and the development of QUIC (and therefore HTTP/3). Overall, Google has been incredibly open with the development of these and worked to include everyone. I'm sure it's not always that way. Can you bring up some examples where "niche use-cases" have been locked out by Google-driven software stacks and configuration policies?

Re: Paul Vixie thinks more people should be running their own DNS servers

#28
post #12

Ironically, the instructions linked to in this article for running your own DNS server[1] suggest configuring it to forward all non-local queries to your ISP or Google DNS. (It’s not clear to me whether Vixie is more bothered by the loss of privacy in using Google/Cloudflare/OpenDNS/etc and/or it’s the loss of privacy.) If you’re going to do that, you might as well use dnsmasq or just use your ISPs servers directly.…

well there is dnscrypt. i use a local cache for fast revisits. ya i'm not sure everyone having full dns servers would be a good thing or even practical.

Re: Paul Vixie thinks more people should be running their own DNS servers

#29
post #20

More people should be running their own mail servers, their own web servers, their own IRC servers, etc. But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well. Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns request…

My browsing habits are pretty regular, though: there’s half a dozen sites I visit regularly and the rest are random blogs/etc. I suspect about 20% of the domains I visit account for 80% of my browsing traffic and there would be enormous benefits from a dns speed perspective to a local caching resolver.

Re: Paul Vixie thinks more people should be running their own DNS servers

#30
post #28
post #12

Ironically, the instructions linked to in this article for running your own DNS server[1] suggest configuring it to forward all non-local queries to your ISP or Google DNS. (It’s not clear to me whether Vixie is more bothered by the loss of privacy in using Google/Cloudflare/OpenDNS/etc and/or it’s the loss of privacy.) If you’re going to do that, you might as well use dnsmasq or just use your ISPs servers directly.…

well there is dnscrypt. i use a local cache for fast revisits. ya i'm not sure everyone having full dns servers would be a good thing or even practical.

DNSCrypt only provides authentication, not confidentiality, and it’s only between the client and the recursive server. So it doesn’t address either the performance or the privacy concern of routing all your DNS through someone else’s recursive servers.

Edit: apparently it encrypts traffic as well:

https://dnscrypt.info/faq/

So it’s comparable to DoH which prevents your ISP from snooping but per my other comments here doesn’t address the privacy concern of now having to trust the upstream resolver.

Post reply on HN