Paul Vixie thinks more people should be running their own DNS servers

Post by coldacid » Sun, Mar 31, 2019, 12:50 AM UTC

slyall wrote: post #23

neonate wrote: post #8

http://archive.is/sRDJv https://outline.com/fDZwD7

Ironically my ISP is using their DNS servers to block archive.is

Post by tdurden » Sun, Mar 31, 2019, 1:02 AM UTC

js2 wrote: post #4

wahern wrote: post #3

Earlier quoted context omitted.

So you're cool with Google, a company whose primary business is tracking people, seeing all your DNS, but not your ISP, whose primary business is delivering network access, notwithstanding their bumbling efforts to branch out. Now, Google does claim they don't track DNS requests. But consider why that is? Once upon a time they didn't scan Gmail content either, but that was before GMail dominated the webmail space. Wh…

My ISP is AT&T, so I do indeed trust them less than Google. And no, I don't particularly trust Google either, which is why wrote that I can avoid them both by running a recursive resolver on Digital Ocean (but now I have to trust DO). I could run a VPN full time, but I'm not willing to accept the added latency and bandwidth cost. What would you suggest?

Post by mbreese » Sun, Mar 31, 2019, 1:08 AM UTC

the_narrator wrote: post #40

throwawaygoog10 wrote: post #25

Earlier quoted context omitted.

Disclaimer: I work for Google, but not on DNS or Gmail. > Now, Google does claim they don't track DNS requests. But consider why that is? Once upon a time they didn't scan Gmail content either, but that was before GMail dominated the webmail space. You seem to assume that it's a singular organization with a unified agenda, but this really isn't the case. It's the same thing about when folks assume Google looks at you…

I can't imagine using Google services if one is remotely privacy conscious. Just from your own defense: Drive: > your data isn't scanned (except for... Google DNS: > What logging exists is extremely temporary... Gmail: > we receive your email, scan it for ....

Post by icedchai » Sun, Mar 31, 2019, 1:19 AM UTC

johnklos wrote: post #45

rmdoss wrote: post #20

More people should be running their own mail servers, their own web servers, their own IRC servers, etc. But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well. Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns request…

Performance for Google or Cloudflare isn't going to be better. Where do you get that idea? Do you think all DNS simply lives in their caches? "your ISPs can't see what you are doing". If they're analyzing traffic, they can, and if they're doing that, they can see to whom I'm connecting, anyway. But you say nothing about why we should trust Google or Cloudflare. I trust my ISP to be big and dumb. I trust Goole and Clo…

Post by js2 » Sun, Mar 31, 2019, 1:29 AM UTC

ryan-c wrote: post #37

js2 wrote: post #30

Earlier quoted context omitted.

DNSCrypt only provides authentication, not confidentiality, and it’s only between the client and the recursive server. So it doesn’t address either the performance or the privacy concern of routing all your DNS through someone else’s recursive servers. Edit: apparently it encrypts traffic as well: https://dnscrypt.info/faq/ So it’s comparable to DoH which prevents your ISP from snooping but per my other comments here…

Are you sure you're not thinking of DNSCurve? It doesn't provide confidentiality, but AFAICT DNSCrypt does.