This article is a glittery piece of shit, from lies about the blockers to completely made up points on the ad system.
Brave, the false sensation of privacy
321–330 of 501 posts
Re: Brave, the false sensation of privacy
#322Earlier quoted context omitted.
I only know enough about networking to be dangerous but I am convinced Comcast is doing shady shit with my modem when I change the DNS settings to use non-Comcast servers. Every once in a while I’ll attempt to use Wireshark to try to make sense of what’s happening but I’m pretty clueless and don’t really know what I’m looking at/for. If anyone knows any good resources to learn about the ISP nuts and bolts that make i…
>I am convinced Comcast is doing shady shit with my modem when I change the DNS settings to use non-Comcast servers Well that's vague. What are the symptoms? How would comcast even know that you changed DNS settings? It's possible to infer that from DNS queries to their servers dropping off and traffic to 1.1.1.1 or 8.8.4.4 increasing, but I doubt comcast is competent enough to build that sort of detection system.
Sorry, I didn't get into details because I wasn't intending to ask HN to troubleshoot for me. But, since you asked...
I have an "XFi Gateway" combination modem/router provided by Comcast (perhaps my first mistake) so the DNS settings are restricted and cannot be changed. I have the Comcast modem/router set to bridge mode and connected my own router where I can control the DNS settings.
My understanding is the DNS settings closer to the client control. So in addition to having set my router to Cloudflare's DNS I also set my devices as well. One day, maybe a year ago or so, I'm on HN and I click an archive.is link, read the article, and go to the discussion thread only to see several comments about how archive.is is blocked by Cloudflare DNS. I checked the DNS settings on my MacBook and router and I was indeed using Cloudflare DNS but for some reason I was able to access the "blocked" address.
So I went to the terminal, cleared the cache, and checked nslookup archive.is and it responded correctly. Then I checked a nonsense DNS server: nslookup archive.is 5.9.3.7 or something and it still responded correctly. I tried the same with different websites and got the same result. So I searched "see my DNS server" or something and found a few websites but they all showed Cloudflare. Very odd.
When I logged in with my VPN, Mullvad, and changed the DNS settings on the router and my laptop to Mullvad's and repeated the experiment it finally returned NXDOMAIN. Then I disconnected from the VPN but left Mullvad's DNS settings, repeated the experiment again with the same results - even when I was using a totally bogus DNS server it was returning the correct IP address.
That's when I installed Wireshark and, lo and behold, I could see the requests that should have been going to 1.1.1.1 or 5.9.3.7 going to 75.75.75.75. Comcast.
A call to Comcast was, as expected, a complete waste of time. First they told me it was using their DNS settings because of "their firewall" and then they told me that if I used their built-in router rather than mine + bridge mode I wouldn't have the issue at all.
Messing around in Wireshark I eventually determined the issue had something to do with one specific port that was making the requests (I can't recall how but I think because I could see Mullvad VPN was using a different port for DNS?) so I fiddled around and forced (or maybe redirected?) my router to use that port too and that finally worked in avoiding the Comcast servers. But, knowing just enough to be dangerous and not entirely sure what I was doing, I didn't keep the forced port and decided I'd have to get my own modem and use my VPN in the meantime.
Before I had gotten around to buying a new modem (this was somewhat early in the pandemic) I saw a post on HN about NextDNS and decided I'd see if I ran into the same issue. I didn't, as far as I could tell at least. When I run Wireshark now (I still use NextDNS) I don't see any contact with 75.75.75.75 or 75.75.76.76. I think this is because NextDNS uses DoH? But who knows.
Like I said, I only know enough to be dangerous so perhaps I just had something configured in an odd way that made the Comcast servers step in as a fail-safe and there's a totally innocent explanation. But based on my experience as a Comcast customer I don't really think they're deserving of the benefit of the doubt so I've definitely got a bit of a tin foil hat when it comes to them secretly messing around with my traffic through the leased modem.
Re: Brave, the false sensation of privacy
#323So ironic that the OP's website doesn't require HTTPS. The most minimum security practice on the web that's nearly enforced by even the worst browser, and this security rant either doesn't care or doesn't realize their site is misconfigured.
The author is not technical; this was only the first of many mistakes they made. I posted three exhaustive responses at https://news.ycombinator.com/item?id=27552530.
Re: Brave, the false sensation of privacy
#324> Their adblocker is just a fork of uBlock Origin, This does not appear to be true. Here is the github repo for their open source adblock engine written in rust: https://github.com/brave/adblock-rust Here is a (somewhat dated) article describing it by the authors: https://brave.com/improved-ad-blocker-performance/ > Google will take decisions that benefit their advertisement business, like making impossible to use ad…
> If earning half a penny in a month is okay for you, in exchange of your privacy, because of course, they’re tracking you with Rewards, then enjoy your money. Lie. Brave doesn't track you. Your ad data never leave your machine (a bit like your bookmarks). The ad engine works privately on your computer and not on Brave server.
If it's fetching ads, it has to 100% be sending some data to someone, who is likely able to correlate it and track you. It doesn't take much.
Re: Brave, the false sensation of privacy
#325Earlier quoted context omitted.
So closing your bathroom door isn’t worth it because someone can ram it? :)
I live in a house with toddlers. This is absolutely true. I leave the door open so it doesn't bash into my leg when they come hammering on it.
What is "it" that would bash into your leg? The door? Are your toddlers strong enough to ram closed door with enough force for it to bash into your leg?
Re: Brave, the false sensation of privacy
#326Fear mongering. A competitor maybe? Someone with an agenda against Eich because of the donation debacle? Privacy-wise, either Firefox or Brave are better than Chrome. Ads are annoying but they do fund the net.
Disagree. Brave's approach to funding is at odds with privacy. The concept of warming up to ads to get paid is capitulating to the advertising industry. While I did not appreciate the tone of the article, there are some valid points there. Brave may be better than Chrome but there are still better options. It might be better to get a common cold virus than it is to get covid-19, but I'd still rather not get any virus…
"Brave's approach to funding is at odds with privacy."
Elaborate, please. Brave's ad model is built for privacy and security. User's must first opt-in. Your data remains on your device. Ad catalogs are downloaded and reviewed locally. You are rewarded when you see an ad notification. I repeat, rewards are granted when your attention has been spent; no clicks necessary. I discussed the model further in this recent 5-minute video: https://youtu.be/LsrrT502luI
Re: Brave, the false sensation of privacy
#327Brave is a scam, but recommending palemoon or icecat a is (for different reasons) also a bad idea.
How exactly is Brave a scam? The author certainly couldn't argue this point (detailed response to their claims can be found here: https://news.ycombinator.com/item?id=27552530).
Re: Brave, the false sensation of privacy
#328I appreciate articles that look into topics in some depth that I’m curious about. But I really dislike the author’s strident writing style. Now, if there’s a single exaggeration or untruth from the author, It’ll throw the rest of the article in doubt for me. I think it would be better if it was a bit more dispassionate. Another thing I’ve noticed in security (and I actually work in this field) is that if a project ma…
It's a personal website, not a corporate blog. Why does it have to be dispassionate? The tone is strident, but there are no personal attacks or abusive language used.
Huh? I’m not saying there should be a law. I’m just saying I think it would be more effective and persuasive if it was more dispassionate. It’s my personal opinion.
Re: Brave, the false sensation of privacy
#329In 2001 or so I considered entering into an encrypted email correspondence with my brother, for fun. I quickly gave up on the idea because I realized that I didn’t trust that my computer or my brother’s computer didn’t already have spyware of some kind, I didn’t trust the integrity of any encryption/decryption tools that existed, didn’t trust myself not to lose the passwords or leave them lying around, and didn’t tru…
You can pretty easily check how private and secure a browser is; setting up a "man in the middle" to monitor its communication is something we do routinely at Brave (see https://brave.com/popular-browsers-first-run/), and what others have done as well (see https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf).
Re: Brave, the false sensation of privacy
#330I appreciate articles that look into topics in some depth that I’m curious about. But I really dislike the author’s strident writing style. Now, if there’s a single exaggeration or untruth from the author, It’ll throw the rest of the article in doubt for me. I think it would be better if it was a bit more dispassionate. Another thing I’ve noticed in security (and I actually work in this field) is that if a project ma…
> But I really dislike the author’s strident writing style. Colorful and emotional language gets attention. Dispassionate writing doesn't. Whenever I see people criticize an author for a little rhetorical flair, I play the famous "Pirates of the Caribbean" scene in my mind: Hacker News: "Your article is the most strident and obnoxious piece of technical writing I've ever heard of" Author: "Ah, but you have heard of i…
Yeah clickbait sells, but I’m saying if there’s a single error, combined with the emotional tone, I’m more likely to discount the whole article and think they’re just extremely biased and blinded by their emotions.