Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shutting down our public encrypted DNS

mullvad.net

Post reply on HN
Print view View original

191–200 of 231 posts

Re: Shutting down our public encrypted DNS

#191

Post by bjoli »

johnhtodd wrote: post #149

Hi - I'm with Quad9 (CTO). I'm going to try to put together a single post replying to some of these topics. First: We welcome the Mullvad users who will be shifted onto our systems, and we appreciate that Mullvad contacted us instead of doing this unilaterally. Since we have no signup process, they could have just moved users across but we very much appreciate their cooperation and communication, both with us and wit…

You are probably the guy to ask. I have always found dns over TLS to be the fastest, but with the quic versions making an entrance, maybe things have changed. Which is the one that gives me the fastest replies?

Re: Shutting down our public encrypted DNS

#192

Post by PinkSheep »

johnhtodd wrote: post #149

Hi - I'm with Quad9 (CTO). I'm going to try to put together a single post replying to some of these topics. First: We welcome the Mullvad users who will be shifted onto our systems, and we appreciate that Mullvad contacted us instead of doing this unilaterally. Since we have no signup process, they could have just moved users across but we very much appreciate their cooperation and communication, both with us and wit…

> On the fact that centralization is bad, we agree. DNS resolver centralization is not a great thing, and it seems to be trending in the wrong direction.

It seems all too similar to the degradation of peer-to-peer networks where nodes are replaced by few supernodes. You mentioned a couple reasons yourself: consolidation and legal pressure. Add to this the technical qualification aspect and time investment (Mullvad's position), and the financial cost of sustaining such a non-profit project. Suddenly there are very few people or even organizations worldwide, who can bear the burden.

Thank you for existing and your tireless work.

Re: Shutting down our public encrypted DNS

#194

Post by panarky »

sekh60 wrote: post #152
panarky wrote: post #142

Earlier quoted context omitted.

Citation needed.

For Hitler? He won the most seats of all the parties in the Reichstag in 1932 with 37 or so percent of the vote. That majority would normally have gotten him appointed as Chancellor (by tradition). He used violence and backroom dealing to get from that majority to become Führer, but without a doubt Hitler did get his foot into the door democratically.

He was never democratically elected.

Re: Shutting down our public encrypted DNS

#195

Post by exhilaration »

Brybry wrote: post #148
godelski wrote: post #116

Earlier quoted context omitted.

Really? I never found it effective unless I messed with certs on my phone. For example, DNS blocking isn't going to block YouTube ads if you're using the app since they don't need to respect your DNS, but it will if you're in browser because they can't control that. For apps I always use revanced.

Ads from providers like Google AdMob and AppLovin are blocked. Apps could bundle their own DNS or DoH resolver or use hardcoded static IP addresses but in my experience most do not. Youtube ads do not get blocked by DNS adblock because Youtube ads are served from the same domains as the content and thus DNS blocking would be counterproductive. I don't think it has anything to do with respecting DNS. I don't have the…

FYI I don't see YouTube ads on Android + Firefox mobile + uBlock Origin

Re: Shutting down our public encrypted DNS

#196

Post by aleph_minus_one »

brookst wrote: post #182
Henchman21 wrote: post #90

Earlier quoted context omitted.

Sounds more like we should end copyright worldwide.

There may be a middle ground between the current maximalist copyright regime and ending copyright altogether.

> There may be a middle ground between the current maximalist copyright regime and ending copyright altogether.

The trenches between the different factions are far too deep for any middle ground to have any chance.

Re: Shutting down our public encrypted DNS

#197

Post by aleph_minus_one »

brainwad wrote: post #184
otterley wrote: post #178

Earlier quoted context omitted.

Free Software as a concept could not exist without copyright. Copyright is what allows the license to declare the terms under which a copy is permitted, including the provision that the source code ship with the binary form. (This is discussed in the commentary to the GPL.) Despite the SaaS model under which many of us build, there is still a tremendous amount of packaged and distributed software that people use ever…

Copyleft software couldn't exist. But all software would be free by default, because all source would be in the public domain, and all reverse compilation of binaries would produce public domain code.

> But all software would be free by default, because all source would be in the public domain, and all reverse compilation of binaries would produce public domain code.

I am not aware of any open-source license which tries to approximate the "there is no copyright" situation:

- Such a license would not compulse you to publish the source code of any modification you make for it.

- Such a license would allow you to distribute compiled programs only.

- On the other hand, such a license must not restrict you to de-compile, modify or re-destribute any binaries built from the source code.

- But any such derivate of such a binary or source code would have to stay under the same license (this is a different kind of virality than "normal" viral licenses).

Re: Shutting down our public encrypted DNS

#198

Post by jMyles »

otterley wrote: post #107
jMyles wrote: post #97

Earlier quoted context omitted.

Indeed it needs to happen, and even here on HN, it can be difficult for some to admit and acknowledge. It'd be great for this to be the first major relinquishment of nation-state power to happen without violence, without backroom deals, without wedge politics and flag waving. Just... let it go. It's beyond obvious that copyright is not going to exist in 1000 years. Every creature on earth - especially the internet -…

> Copyright is serving exactly nobody today Except for nearly everyone who writes anything (including software) or other artistic pursuits to make a living. This includes a majority of people here on HN.

I'm guessing you didn't click my profile before writing this knee-jerk, but I'm a professional musician. And I've worked in software engineering, across a zillion different licenses, for many years.

I'm not just shooting from the hip here.

Re: Shutting down our public encrypted DNS

#199

Post by loup-vaillant »

otterley wrote: post #188
brainwad wrote: post #184

Earlier quoted context omitted.

Copyleft software couldn't exist. But all software would be free by default, because all source would be in the public domain, and all reverse compilation of binaries would produce public domain code.

Sure, but if all software is in the public domain, then the profit motive for developing software will be completely wiped out, and much less will be produced as a result. Software development be reduced to a hobby or developers will have to seek out patronage like artists did in the 1600s. That’s not a world that most of us want to return to.

Or have a universal income. Capitalism isn't inevitable. And it will end anyway, at it hits planetary limits. Better start thinking of alternatives before one of the worst ones gets imposed on us.

Re: Shutting down our public encrypted DNS

#200

Post by dunder_cat »

This feels like a nitpick but it's important to mention anyway

> Mullvad Browser uses them [ the DoH servers ] by default when you're not on Mullvad VPN, preventing your ISP from seeing the domains you visit.

This is a half-truth until Encrypted Client Hello (ECH) is in-use for most of your traffic. Sure, you won't have clear-text DNS floating out there in the series of tubes. However, without ECH the hostname you're connecting to is exposed in the SNI field during TLS handshakes.

I imagine most sites we are browsing will eventually be able to leverage ECH, so this should become less of an issue over time, but in the event you frequent any self-hosted operations (e.g. no Cloudflare or similar), encrypted client hello could still reveal identifying information since it requires still exposing an "outer SNI" that a valid certificate needs to be presented for. You only get to easily hide in with the masses when you use a big infrastructure provider as a consequence, since the common outer SNI of cloudflare-ech.com doesn't really reveal anything different than an IP ASN database would. But if the outer SNI is "dunder-cat-enterprises.com", then all I've protected you from is your ISP snooping on the subdomain or pinpointing exactly which one of my domains you might be talking to.

Post reply on HN