Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

nextdns.io

Post reply on HN
Print view View original

111–120 of 151 posts

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#111

Post by yegle »

mvanbaak wrote: post #70
yegle wrote: post #23

I don't understand why any privacy conscious person would choose a hosted service instead of self-hosting your own solution. Implementing the whole thing (modulo the anycast IP, which is the only thing I did not use) is easy. I have a docker-compose file which does the whole stack: 1. Unbound DNS which provides DNS-over-TLS service at port 853. It forward request to my local pihole's 53 port. 2. Pihole forward reques…

How does “forward to google dns” and “android” give you any privacy? Still you dns queries are recorded, tracked and indexed by them, linked to your ip and phone profile.

Disclaimer: I work at Google. I know our internal policy regarding PII information and the tooling around it to protect PII information, so individual employees cannot easily violate my privacy. And I know people work there are generally very vocal (think about Dragonfly) . I would trust more on Google to handle my privacy.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#112

Post by Zhenya »

nextdns wrote: post #19
miki725 wrote: post #8

Personally I run either pihole or something similar however setting something similar for all the friends is a bit cumbersome as it at least requires getting a raspberry pi. This seems like a really intriguing alternative although will voice similar concerns as others are expressing that the site does not indicate the source of the funding, motivations for the project, etc. As such that could be a barrier to entrust…

Motivations: like most tech startups, scratching your own itch :) Funding: Free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.

You should add some kind of rogue device/app guarantee+ notification. If something starts to drill a server, it could spike the users costs without their knowledge. That means every device and app is a liability for the user.

Something to ponder.

I know my Nvidia shield DRILLS Netflix even when it's a asleep.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#113

Post by batrat »

underwater wrote: post #30
nextdns wrote: post #19

Earlier quoted context omitted.

Motivations: like most tech startups, scratching your own itch :) Funding: Free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.

I wouldn't know if 500k is a little or a lot.

Here is my usage on my PI. 2 people around 5 devices.

https://imgur.com/a/jf2Zqgy

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#115

Post by hollerith »

yegle wrote: post #111
mvanbaak wrote: post #70

Earlier quoted context omitted.

How does “forward to google dns” and “android” give you any privacy? Still you dns queries are recorded, tracked and indexed by them, linked to your ip and phone profile.

Disclaimer: I work at Google. I know our internal policy regarding PII information and the tooling around it to protect PII information, so individual employees cannot easily violate my privacy. And I know people work there are generally very vocal (think about Dragonfly) . I would trust more on Google to handle my privacy.

If totalitarianism ever comes to the US, Google would not be able to prevent the totalitarian regime from making use of its data-collection systems. A good analogy would be building a nuclear reactor on a site which sees very rare massive earthquakes. Apple in contrast has acted responsibly by designing its systems not to centralize or concentrate the data in the first place. That is, the unencrypted version of the data and the encryption keys stay on the iPhone.

Second, Google uses personal data combined with machine learning to optimize "user engagement" (roughly, hours spent on the service) because that has been proven to be a good predictor for how resistant an internet service is to competition or disruption. This optimization of user engagement has a bad effect on the productivity and perhaps the mental health of individuals and families and has a bad effect on our public discourse.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#116

Post by dual_basis »

kissgyorgy wrote: post #84

There is a very important use-case which you can do on a local network but can't with this: setting up a DHCP server and pushing a default DNS server address even to clients which network settings you don't have access to, is possible locally. Xbox, streaming devices, non-geek friends devices, etc. Pihole can do this and ohmygod it's life changing!

This doesn't have anything to do with running a local PiHole, it's just a feature of having a local DHCP server. Any typical home router also has a local DHCP server, and if you change the DNS associated with the internet connection on the router this will be passed on to any device which connects via DHCP.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#117

Post by petronio »

swinglock wrote: post #110
petronio wrote: post #95

Earlier quoted context omitted.

I think it depends on who you're trying to protect against. While using DoT to a public resolver gives the public resolver the ability to build a history of your queries, running a recursive resolver yourself means anyone who's watching the wire (ISP, local government, etc.) can build a query history instead. Some people trust Google or Cloudflare more than those other entities, or figure that Google already knows pr…

If you think someone is watching your wire they will see what you connect to after resolving it. That's true if your ISP resolved it, Google resolved it or you resolved it. If this is a problem, you need a different solution altogether. So because a snooping provider is irrelevant when we talk only about resolving DNS, that only leaves the choice of which party to the chain of entities that are able to easily snoop o…

That's true if an IP only serves requests for a single domain. With ESNI it's now possible to connect to a server that hosts services for multiple domains without the domain being divulged in the clear on the wire.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#118

Post by yegle »

blattimwind wrote: post #104
wst_ wrote: post #102

Earlier quoted context omitted.

No. Its not. You need to buy hardware, set it up and later constantly maintain it. It requires technical knowledge, willingness to do it and, above all, free time. While initial investment may seem trivial, on the long run it's not. People very often tend to forget that own solutions are not set up and forget. This is why cloud services are a thing in a first place.

You can absolutely just run a recursive resolver on your laptop use that resolver in every[+] network. There is literally nothing special about a recursive resolver except it doing some legwork that a stub resolver / filter resolver (like glibc or dnsmasq) doesn't do. If you run e.g. Linux or BSD, you'd just install knot-resolver, enable the service and put "127.0.0.1" in your /etc/resolv.conf. That's it. Similarly i…

Debian 10 Buster already install Stubby DNS by default as your caching DNS server.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#119

Post by smaps »

_b8r0 wrote: post #75
yegle wrote: post #23

I don't understand why any privacy conscious person would choose a hosted service instead of self-hosting your own solution. Implementing the whole thing (modulo the anycast IP, which is the only thing I did not use) is easy. I have a docker-compose file which does the whole stack: 1. Unbound DNS which provides DNS-over-TLS service at port 853. It forward request to my local pihole's 53 port. 2. Pihole forward reques…

I'm amazed that on a site called "Hacker News" people are giving you hassle for building your own self-hosted solution rather than handing control of your DNS over to random people, possibly for money down the line. Well done.

The hassle is because of the implication that is super easy to run a self hosted solution. It's a decently complex task that your average person couldn't come close to doing, and many here would still take a bit of time to grok it all.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#120

Post by jamesb93 »

_b8r0 wrote: post #75
yegle wrote: post #23

I don't understand why any privacy conscious person would choose a hosted service instead of self-hosting your own solution. Implementing the whole thing (modulo the anycast IP, which is the only thing I did not use) is easy. I have a docker-compose file which does the whole stack: 1. Unbound DNS which provides DNS-over-TLS service at port 853. It forward request to my local pihole's 53 port. 2. Pihole forward reques…

I'm amazed that on a site called "Hacker News" people are giving you hassle for building your own self-hosted solution rather than handing control of your DNS over to random people, possibly for money down the line. Well done.

Technological proficiency is very distributed too. Some people are really good at web apps but have no idea how to program in a compiled language. There is so much out there and its not really feasible for everyone to know about everything.
Post reply on HN