Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Paul Vixie thinks more people should be running their own DNS servers

businessinsider.com

Post reply on HN
Print view View original

61–70 of 155 posts

Re: Paul Vixie thinks more people should be running their own DNS servers

#61

Post by tdurden »

mbreese wrote: post #46
the_narrator wrote: post #40

Earlier quoted context omitted.

I can't imagine using Google services if one is remotely privacy conscious. Just from your own defense: Drive: > your data isn't scanned (except for... Google DNS: > What logging exists is extremely temporary... Gmail: > we receive your email, scan it for ....

With that logic, how could anyone remotely privacy conscious use any service on the Internet? There’s a lot to worry about w.r.t. privacy online. Virus scanning, spam filtering, and debug logging aren’t high on my worry-list.

I think the point is not necessarily what they are scanning now, but what they might scanning in the future for other purposes.

Re: Paul Vixie thinks more people should be running their own DNS servers

#62

Post by tomjakubowski »

raggi wrote: post #49

Quick, name a non-niche dns server that is easy to configure and maintain that hasn't had a major vulnerability in the last six months.

dnsmasq's last CVE was in October 2017 https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=dnsmasq

despite that "safety record", I am probably going to switch to https://github.com/bluejekyll/trust-dns

Re: Paul Vixie thinks more people should be running their own DNS servers

#63

Post by spudlyo »

mmaunder wrote: post #34

This site is a paywall no matter if I go incognito or use the web link. Am i missing some ninja magic? Is it ok to be irritated by this? Haven't been able to read the article but is it referring to this Nov 2018 tweet? https://twitter.com/paulvixie/status/1063843157668970496?s=1...

It's ok to be irritated by this. I ended up reading it in links[0] initially, which is usually my go to. After reading your comment I decided to install Firefox 66 (which I've been meaning to do anyway), where NoScript is apparently still at thing. No Javascript, no annoying popovers.

[0]: https://en.wikipedia.org/wiki/Links_(web_browser)

Re: Paul Vixie thinks more people should be running their own DNS servers

#64

Post by merb »

well basically running your own dns server, might be better for privacy, however security might be worse if you are lazy. if you do not keep your stuff up to date you will be more in trouble and have probably less privacy. (the same with mail servers, etc..) of course the more tech savy and time you have the less of an issue will it be.

Re: Paul Vixie thinks more people should be running their own DNS servers

#65

Post by rannug »

I've been running BIND9 on a raspberry pi powered off of a usb port on my wifi router. Sure 8.8.8.8 and 1.1.1.1 will know some of my households queries, but not how much they are being queried. It's actually surprisingly busy with redundant requests. Request that google et al know less about now.

It's also handy to review the DNS logs. I found out my off brand wifi cameras were phoning home to china every minute. Blocked that domain in a hot minute!

Re: Paul Vixie thinks more people should be running their own DNS servers

#66

Post by Panino »

ryan-c wrote: post #37
js2 wrote: post #30

Earlier quoted context omitted.

DNSCrypt only provides authentication, not confidentiality, and it’s only between the client and the recursive server. So it doesn’t address either the performance or the privacy concern of routing all your DNS through someone else’s recursive servers. Edit: apparently it encrypts traffic as well: https://dnscrypt.info/faq/ So it’s comparable to DoH which prevents your ISP from snooping but per my other comments here…

Are you sure you're not thinking of DNSCurve? It doesn't provide confidentiality, but AFAICT DNSCrypt does.

DNSCurve does provide confidentiality, using x25519-xsalsa20poly1305.

Re: Paul Vixie thinks more people should be running their own DNS servers

#67

Post by rannug »

rmdoss wrote: post #20

More people should be running their own mail servers, their own web servers, their own IRC servers, etc. But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well. Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns request…

> I would love a de-centralized web, but it is pretty hard to go back.

As the powers that be continue to centralize and exert control in a negative way, I have a feeling the pendulum will swing the other way once people get annoyed with it.

Kids are already using VPNs to circumvent controls.

Need to make a cyberpunk-esque decentralization kit for the next generation to adopt.

Re: Paul Vixie thinks more people should be running their own DNS servers

#68

Post by spudlyo »

nullc wrote: post #56
rmdoss wrote: post #20

More people should be running their own mail servers, their own web servers, their own IRC servers, etc. But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well. Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns request…

> Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns requests are a MISS). It's perfectly possible to recursive resolve your misses to Google's DNS server if you want.

> It's perfectly possible to recursive resolve your misses to Google's DNS server if you want.

I don't think that's how recursive name servers work. It's been a while since I've had to reason about this but, for example if 'www.google.com' in not cache, it contacts a root domain server, then a 'com' domain server, then a 'google.com' domain server, which finally answers the query, which then gets cached by the recursive name server.

Eventually the recursive name server on your family or organization's local LAN will have a decent cache hit ratio, and the round trip times to your local recursive server could be potentially an order of magnitude (2ms vs. 20ms) faster than talking to Google or CloudFlare.

It's possible that your ISP can still know which DNS lookups you're doing by snooping the traffic between your recursive DNS server and other DNS servers on the net, but I'm guessing that they're not doing this because it's not as easy as just ingesting their own DNS logs.

Re: Paul Vixie thinks more people should be running their own DNS servers

#69

Post by toast0 »

jeffreyrogers wrote: post #15

I ran my own DNS servers in the past (and email servers). It's not too difficult to setup (email is significantly harder), although you'll probably have to run at least two DNS servers in order to use it with a domain because most registrars won't let you change the nameservers unless you have at least two. I think it's a worthwhile thing to do since it demystifies how DNS works (similarly with running your own email…

It's not too hard to find a secondary server; Hurricane Electric offers a free secondary service.

Re: Paul Vixie thinks more people should be running their own DNS servers

#70

Post by zrm »

js2 wrote: post #50
ryan-c wrote: post #37

Earlier quoted context omitted.

Are you sure you're not thinking of DNSCurve? It doesn't provide confidentiality, but AFAICT DNSCrypt does.

You’re right. I went of the Wikipedia page for it which says: DNSCrypt wraps unmodified DNS traffic between a client and a DNS resolver in a cryptographic construction in order to detect forgery. Though it doesn't provide end-to-end security, it protects the local network against man-in-the-middle attacks. https://en.wikipedia.org/wiki/DNSCrypt But according to dnscrypt.info it’s encrypted.

DNSCrypt and DNSCurve both provide confidentiality (and are very similar to each other). The thing that doesn't provide confidentiality is DNSSEC.
Post reply on HN