181–190 of 456 posts
Earlier quoted context omitted.
Tried searching, but couldn’t find a report by KPMG. Has one been produced already or is this a future thing? Regardless, impressive step to take.
That's a good question, they said it would happen annually so they should have had one by April 1st 2019. I put a question into support, we'll see if it goes anywhere.
Earlier quoted context omitted.
Netflow data, DNS capture, enrichment of cell tower access data (location), reporting on non-usage (idle time, tracking), Bill and household information, credit account usage, etc. SPs are huge sellers in this market. We still need to encrypt the accessed resource and DNS queries everywhere. Even once that’s done, things like opencaching will be used by SPs to gather tons of data where they participate.
What about 8.8.8.8? I'm guessing we're just trusting Google here (and Cloudflare 1.1.1.1 who now also does 10gb free VPNs) + the good will of engineers with access to this information within Google.
Earlier quoted context omitted.
> Its distributed nature means there are technical performance advantages to doing the above: reduced request latency, localized traffic routing and reduced bandwidth, etc. You don’t need a giant any cast network to serve DNS. You just need to use the servers closest to you. My issue with this is that I've never been with an ISP that had a faster response time than Cloudflare/Google - and one would think they should,…
> In addition, my ISP does not provide DoH/DNSCrypt/DNSSec. None. Just 'vanilla' DNS. Furthermore, they also don't provide an unaltered DNS service: they block some websites from resolving, the list isn't made available, and is decided via extrajudicial means. You cannot opt-out, and all ISPs in the country adhere to this. They're not forced by law to do so. I'm also not in a normally thought of as a repressive count…
Earlier quoted context omitted.
So if VPN over Tor (or Tor over VPN) increases anonymity then why is it the popular advice on the Net is not to do it?
Perhaps because downloading Tor (or even searching for it / visiting its website) demonstrates an active interest in thwarting surveillance. Almost by definition, that means you're worth taking a closer look at. Once you're under the microscope, you'd better hope your opsec is flawless or that your activities are completely boring, or else the $TLA knows exactly what you've been up to, TOR or not. Disclosure: my acti…
Not if you access tor over VPN. VPN hides all traffic from ISP and Gov. Obviously, make sure your browser does not use Google or Cloudflare DNS.
I may not have the technical expertise to understand this fully but right now I'm doing adblocking by using adguard's DNS IPs in my router (1). It kinda works everywhere but for some apps like Chromecast I have to null route two IP addresses (8.8.8.8 and 8.8.4.4) otherwise it doesn't work. Those are both Google's IPs afaik. So my question is: will I be able to keep doing it after this? I am asking because I am extrem…
In comparison to your current position, where you're black-holing the hard-coded addresses and the app is falling back to your configured DNS: yes you will be able to continue doing that, assuming the Chromecast will maintain the same fallback behaviour. The exact addresses you need to block and the protocol/ports you need to block may change (eg. to port 443 tcp instead of port 53 udp).
The big thing that DoH will prevent is something that you aren't currently doing, which is: instead of null-routing 8.8.8.8, you could be intercepting DNS requests to 8.8.8.8 and responding to them yourself. You would need to do this if the chromecast didn't fall back to using your proper DNS server. DoH will prevent this kind of interception, so your only choices are to allow it through or block it. And if the Chromecast then refuses to fall back, then blocking it will make the device not work, with no viable workaround short of replacing the firmware.
The goal of DoH is ultimately to prevent your ISP doing the exact same thing to you, ie. intercepting (or just listening in on) your DNS requests even when you want them to go elsewhere. Unfortunately, there's no way to prevent the same protections from extending to a malicious local device trying to circumvent you on your local network.
Earlier quoted context omitted.
It's more an industry error, I suspect. The University I went to forced all the Software Engineers to do some of the traditional Engineering papers, including courses on ethics. The professional institute that accredits the University's ability to call their course an Engineering course required those courses. Courses like that don't fix unethical people, but they make the rest of us aware that ethical concerns exist…
I question the amount that such ethics courses actually help. Business majors have had ethics courses for as long as I can imagine, and yet you don't have to go far on HN (even in this very thread) before you see people saying business majors are unethical. The bigger problem, IMO, is that many tech companies have started handing out kool-aid that data collection and analytics is ethical. They justify it by saying th…
I took a business ethics course in undergrad, and it was surprising how many students advocated all sorts of (to me) aberrant ethical views. (Note I’m pretty traditional, morally speaking. The environment was strongly postmodern, and this was before all the modern insanity about “free speech is bad because some people say bad/offensive things”.)
Not that I minded personally, but it was a strong lesson to me that teaching people categories and how to think won’t give them a desire to respect any particular brand of morality.
Earlier quoted context omitted.
If Google/Cloudflare are having significant issues resolving DNS everybody is getting a call anyways.
Not sure I understand. If you're using your ISP's DNS service, majority of your requests are going to hit their cache. You shouldn't notice any downtime as long as the cache doesn't expire.
Or you can directly ask a domain's authoritative nameserver directly. Using an intermediate caching resolver isn't required. Recursively resolving the DNS query locally only requires asking a centralized nameserver for a domain's authoritative nameservers (the NS records) which can usually be cashed locally for a long time. Every other request is compartmentalized to different servers by domain delegation.
Or do both; configure your local resolver to try recursively resolving a request, and fall back to the ISP (other) cache if needed.
Earlier quoted context omitted.
DNS requests are transmitted in plaintext through the ISPs connections. Because DNS is not remotely secure there isn’t any reason they couldn’t simply redirect your selected DNS to their own, or replace “not found” responses with a link to their own advertisements. So without DoH an ISP knows everything you request, even if you have a different DNS server set, and if they really wanted to they can simply hijack any c…
I encountered this in a local ISP in India in 2012: they were intercepting all DNS requests and forcibly using OpenDNS’s annoying NXDOMAIN advertising thing. When I returned in 2016 they’d stopped doing that. No idea if the technique is widespread.
Basically, you just give it the bad IP addresses and it will replace every query result containing them with an NXDOMAIN.
Earlier quoted context omitted.
Did you read their plan? Because you can block a certain domain to stop DoH resolution.
Perhaps I read too fast, but I didn't see that. What's the domain to block?
[0] https://support.mozilla.org/en-US/kb/canary-domain-use-appli...