111–120 of 239 posts
Earlier quoted context omitted.
I’ve written software all my life, copyright has never been relevant to my earnings at all, trade secrets have been to some extent. Frankly copyright was meant to enable more sharing and benefiting the public domain, instead it’s become a cancer…
For every rule there is an exception.
Earlier quoted context omitted.
That's something people should run themselves. I run Adguard Home on my router. Unlike the main Adguard product, Adguard Home is fully FOSS. It's been rock-solid for me, and improves on pi-hole in various ways - like full IPv6 support.
I could, but DoH/DoT seems very involved to run yourself, and sometimes I need to give a recommendation to someone less tech-savvy.
Setting up a local resolver, such as a Pi-Hole or Unbound on a firewall can serve unencrypted responses to your devices. Those resolvers in turn can use DoT/DoH with their upstream resolvers to encrypt the requests that go through untrusted networks on the Internet.
This is the best of both worlds, the simplicity of unencrypted DNS while encrypting traffic where it matters.
Earlier quoted context omitted.
Unfortunately, Quad9 is censoring some domains in Europe (notably in France and Italy) following injunctions issued by rights holders [1]. That was not the case with Mullvad's DNS. [1] https://quad9.net/news/blog/italian-blocking-demands-followi...
> The German courts entirely disregarded our use of geo-IP lookups on queries, and asserted that since tests via a VPN were able to resolve the domain, we were in breach of court orders Seriously, what the fuck? So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up? I really don't like where this is going.
That kind of thing isn't unheard of for police agencies with moral and oversight issues, though. Orgs start seeking for bigger reasons. A simple copyright issue creatively expounded into an imaginary global drug bombing cyber trafficking crime ring takedown creates a massive internal win. So they do that.
These was one of the fastest DoH services for pipelined queries over single TCP connection IME, it was much faster than Quad9 for this purpose First Mullvad shuts down its Google search proxy Now its DoH service What's next
Earlier quoted context omitted.
Indeed it needs to happen, and even here on HN, it can be difficult for some to admit and acknowledge. It'd be great for this to be the first major relinquishment of nation-state power to happen without violence, without backroom deals, without wedge politics and flag waving. Just... let it go. It's beyond obvious that copyright is not going to exist in 1000 years. Every creature on earth - especially the internet -…
> Copyright is serving exactly nobody today Except for nearly everyone who writes anything (including software) or other artistic pursuits to make a living. This includes a majority of people here on HN.
Modern IP law inhibits productivity more than it helps, imo. LLMs have fundamentally changed our line of work, and they have done so by completely ignoring the existing legal framework for IP. We should not defend the current implementation just because some people might suffer reduced earning potential.
Earlier quoted context omitted.
If you're on Android, FF supports add-ons. If you're on an iPhone, uBlock is now supported: https://apps.apple.com/us/app/ublock-origin-lite/id674534269... There's also Orion browser, but I found it to be a bit more glitchy, especially around sites like YouTube (fuck the app, I'm not watching videos there): https://orionbrowser.com/
Yes, I use Firefox on Android with ublock origin, it works great. But using adblocking DNS on your phone will also block most in-app ads which is a big quality of life improvement. I could also use a VPN to keep my phone always on my home network and thus behind my own ad blocking DNS but Mullvad's adblocking DNS was really nice and convenient.
For example, DNS blocking isn't going to block YouTube ads if you're using the app since they don't need to respect your DNS, but it will if you're in browser because they can't control that.
For apps I always use revanced.
Earlier quoted context omitted.
If you're on Android, FF supports add-ons. If you're on an iPhone, uBlock is now supported: https://apps.apple.com/us/app/ublock-origin-lite/id674534269... There's also Orion browser, but I found it to be a bit more glitchy, especially around sites like YouTube (fuck the app, I'm not watching videos there): https://orionbrowser.com/
The uBlock Origin lite that can run on iOS is very limited compared to the uBlock Origin that runs on Firefox Android.
I'm on your side but telling people to buy a new phone doesn't solve their problem. Short of that uBlock and/or Orion are their best options
Earlier quoted context omitted.
Adversaries don't always ask nicely. Sometimes they break in and silently take the data. These services centralize traffic flows and make it so that an adversary only needs to tap one or two circuits to get a full picture for all users of a service.
CIA is not stupid enough to break into a guarded data center in Switzerland or one of the less America friendly EU countries. They tell the NSA to look for security holes and spread narratives that only criminals use VPN hoping that a politician will notice and try to ban them, like what's happening in the UK. Big tech services are less private than you think but almost every provider who cares about privacy is safer…
Earlier quoted context omitted.
DNSSEC validation on your forwarder would prevent a maliciously modified record from Quad9 (or others) from being accepted locally - i.e. "Quad9 can poison my DNS". I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach…
You are rely here on the assumption what your resolver already knows what the zone is DNSSEC signed. If your forwarder or resolver strips that information?..
1. The forwarder gets a response claiming the record is supposed to be DNNSEC signed from the parent (recursively traversing from the root). The forwarder checks the signature of this claim. If the signature is valid, the forwarder continues on to validate the signature of the record and checks its validity to know if the info was secure. If the signature is invalid, the forwarder knows any information any information is not able to be validated as secure
- Somewhere during the recursive checks through the root, the forwarder gets an unsigned (no DNSSEC) or invalidly signed (e.g. your stripped response) response. The forwarder knows any information is not able to be validated as secure.
- A claim for lack of configuration or support of DNSSEC records comes back. The forwarder knows any information is not able to be validated as secure.
So you always know whether or not the information was secure, it's just if it was insecure you don't know if it's because it was just never secured or if someone tried to tamper with it. And that should make sense, an insecure message is by definition one which you can't tell if it has been tampered with.
Earlier quoted context omitted.
> https://freedns.afraid.org/ This dude has been doing it for 25 years, and actually this is a dns provider for domain names which I'm decently sure makes it more complicated than public dns. They're allowed to say they don't want to pay for it anymore, I just think their logic is bad. Or maybe their lawyer said they're running risks just ignoring takedown and they didn't want to deal with it anymore.
> this is a dns provider for domain names which I'm decently sure makes it more complicated than public dns Can you expand on this? Isn't all DNS for domain names?
Hey dang can I get my rate limit removed yet?