Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Paul Vixie thinks more people should be running their own DNS servers

businessinsider.com

Post reply on HN
Print view View original

131–140 of 155 posts

Re: Paul Vixie thinks more people should be running their own DNS servers

#131

Post by hazeii »

7ewis wrote: post #126
hazeii wrote: post #97

Earlier quoted context omitted.

Single data point, but I've been running a home DNS server (bind) for many years; it's set to be authoritative for the .local domain and caching for everything else (except for major tracking and advertising sites, which it blackholes). For hits that are in the cache (the usual case) it's obviously faster than going out to the 'net,. The black-holing combined with ad-blockers mean browsing is a lot faster and conside…

Did you change DNS using the BT Hub? Mine forces me to use their DNS, would love to turn it off at a router level. I know I can buy a new router but I can't justify that right now.

Never used the BT hub, I've always bought my own router (I've also had a linux box as a firewall between the router and home network since the days of dial-up).

Re: Paul Vixie thinks more people should be running their own DNS servers

#133

Post by desdiv »

xorcist wrote: post #111
rmdoss wrote: post #20

More people should be running their own mail servers, their own web servers, their own IRC servers, etc. But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well. Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns request…

> Performance? Due to DNS caching at the resolver level, Not sure about the validity these arguments. Yes, Google is likely to have more cached data than you, but they can also be a half a country or two away. In my experience caches matter less than one might think, since more popular data is usually the one that's low latency anyway. > Privacy? With DNS over TLS/DNS over HTTPS, your ISPs can't see Let's agree on on…

>Yes, Google is likely to have more cached data than you, but they can also be a half a country or two away.

Google has edge nodes in pretty much every ISP of every country except China. A query to Google's public DNS never leaves your ISP, much less your country.

>When clients send queries to Google Public DNS, they are routed to the nearest location advertising the anycast address used (8.8.8.8, 8.8.4.4, or one of the IPv6 addresses in 2001:4860:4860::). The specific locations advertising these anycast addresses change due to network conditions and traffic load, and include nearly all of the Core data centers and Edge Points of Presence (PoPs) in the Google Edge Network.

https://developers.google.com/speed/public-dns/faq

Re: Paul Vixie thinks more people should be running their own DNS servers

#134

Post by upofadown »

lazyjones wrote: post #115
xorcist wrote: post #112

Earlier quoted context omitted.

What's wrong with opkg install unbound? It's robust, doesn't require maintenance, and already available an an optional install in OpenWRT. The reason people don't use it is probably just that it isn't default. Some captive portals mess with DNS resolution and it's probably easier for OpenWRT to just let them.

> What's wrong with opkg install unbound? It's robust, doesn't require maintenance, Good joke. It's written in C, so in addition to typical protocol/logic flaws, it'll have its share of security and memory leak problems. No maintenance? Have a look at https://nlnetlabs.nl/svn/unbound/tags/release-1.9.1/doc/Chan... and its security advisories... Regular updates are necessary.

Here is a list (and some discussion) of the 4 CVEs that unbound has had starting in 2011:

* https://nlnetlabs.nl/projects/unbound/security-advisories/

Nothing there looks particularly scary to me.

Re: Paul Vixie thinks more people should be running their own DNS servers

#135

Post by geocrasher »

Back when I was on 1.5mbps DSL, one of the biggest performance gains in all the things I tried wasn't content caching via a proxy. It wasn't ad blocking (although that helped!) It was running my own DNS. Web pages got snappy again. I'm on a fast internet connection now, but I still contemplate running my own DNS just to get that snappiness back.

Re: Paul Vixie thinks more people should be running their own DNS servers

#136

Post by elagost »

Havoc wrote: post #22

That seems like a bit much. I think getting people to run a raspberry and pi-hole is a much more realistic aim in terms of usefulness and creating awareness. Plus it's been pretty eye opening. I'm running uBlock Origin and Privacy badger...and still the pi-hole filter 25% of my traffic. A full fkin quarter after adblockers...

Pi-Hole is great as a caching mechanism and is easy enough for non-techie friends and family to use (just make sure you have it auto-update for them, or do it yourself once in a while).

Bind9, a true dns server, doesn't provide the privacy enhancements that pi-hole does and it is much more opaque for normal users. I think you're right - it's much easier to look at targets that are a little easier to hit rather than suggesting a bind9 setup to everyone. I have the know-how to do both, and I prefer pi-hole anyway!

Re: Paul Vixie thinks more people should be running their own DNS servers

#137

Post by JdeBP »

3xblah wrote: post #55

I have been serving myself a custom root.zone for almost 20 years now. I use tinydns for this which I think has always been the ideal choice for personal use. The author from the beginning recommended users not to use third party DNS and that advice has proven to be more and more prudent over the years. tinydns stores records on disk and has never been limited by RAM as would be something like nsd, for example. Today…

I have, also.

* http://jdebp.uk./Softwares/nosh/guide/services/djbdns.html#D...

* http://cr.yp.to/dnsroot.html

Re: Paul Vixie thinks more people should be running their own DNS servers

#138

Post by Waterluvian »

viraptor wrote: post #21
Waterluvian wrote: post #18

How hard is it to make a personal use raspberry pi dns server that assembles a local database using the consensus of a bunch of major sources?

That's not really how customer DNS works, so you're talking about a custom monitoring project. It doesn't seem very hard to monitor the consensus - get a stream of domains and run "dig" against the known endpoints. But if you want an actual server doing that, I don't think there's much point. You'll get differences for various valid reasons. Entries changing, different anycasts getting different geo responses, etc. I…

Thanks for sharing. I don't understand DNS as well. I wasn't sure they could disagree for valid reasons for example.

Re: Paul Vixie thinks more people should be running their own DNS servers

#139

Post by bo1024 »

rannug wrote: post #67
rmdoss wrote: post #20

More people should be running their own mail servers, their own web servers, their own IRC servers, etc. But I don't think we are ever going back to that direction. The arguments and benefits for running one locally are not enough the trouble as well. Performance? Due to DNS caching at the resolver level, it is probably faster to use Google's 8.8.8.8 or CloudFlare's 1.1.1.1, than anything local (where all dns request…

> I would love a de-centralized web, but it is pretty hard to go back. As the powers that be continue to centralize and exert control in a negative way, I have a feeling the pendulum will swing the other way once people get annoyed with it. Kids are already using VPNs to circumvent controls. Need to make a cyberpunk-esque decentralization kit for the next generation to adopt.

That would be really cool!

I feel like one of the surprisingly-big barriers is just the difficulty of geting a static IP address assigned to your home. If you could do that, then (I think) they could run everything from a Raspberry Pi: their own website, hosting their own email, etc etc.

(It's actually not much harder technically to set this all up on a VPS, but then the kid has to put a monthly fee on a card -- probably a big barrier for parents.)

Am I right, or is there an easy way to get around the static IP issue?

Re: Paul Vixie thinks more people should be running their own DNS servers

#140

Post by wolco »

stoolpigeon wrote: post #120
wolco wrote: post #88

Earlier quoted context omitted.

Move mysql to a separate droplet. vultr: $2.50 otherwise you have to change mysql defaults to get things to fit. Great tutorials are out there in general reduce your workers/processes. Why do you need dkim or dmarc to send to gmail? If you send a test php mail does gmail pick it up?

If I send a test email with postfix - gmail rejects it and gives me a link to their page explaining why I need to add a bunch of stuff so they know I'm not spamming or fishing. Specifically I get this: gmail-smtp-in.l.google.com[173.194.207.27] said: 550-5.7.1 This message does not have authentication information or fails to pass 550-5.7.1 authentication checks. To best protect our users from spam, the 550-5.7.1 mess…

I spent awhile with loader.io and digital ocean. Putting mysql on a seperate box was huge and allowed me to accept 10x more traffic. This guide helped me back in the day.

http://digitaloceanvps.blogspot.com/2014/04/best-configurati...

For gmail interesting.. wonder why google trusts me.

Post reply on HN