Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NextDNS Joins Firefox’s Trusted Recursive Resolver

blog.mozilla.org

Post reply on HN
Print view View original

141–146 of 146 posts

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#141

Post by core-questions »

threatofrain wrote: post #34
cookiecaper wrote: post #30

Earlier quoted context omitted.

One of the positives of DNS-level blocking is that it's relatively rough-grained. You can block pornhub.com, but you can't block out every mention of homosexuality at the DNS level without blocking any site that may potentially mention it, which would include any news site, discussion forum, social media, etc. We should be skeptical of aggresively-enforced DoH. In most cases, the vendor's interest in stopping ad bloc…

Yes, so one should expect that religious sites describing the healthy mode of heterosexuality should remain visible, while sites discussing homosexual parenting ought be stricken via DNS. Is the positive you're talking about summed up as "it's not that bad"?

It's well within any parent's rights to block content like that, yes. If I can prevent my children from seeing obscene and objectionable things until they're old enough to have reasonable conversations about it, I will.

That doesn't mean I want to raise bigots, it just means I want to do what I can to ensure the narratives being pushed on my children are wholesome ones that will help them to grow up to be useful, contributing members of society and parents as well.

Maybe you don't care about that for your own kids; that's on you, champ. I'm not arguing for anything censoring anyone else, or anyone censoring what any adult reads.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#142

Post by 3xblah »

kiwidrew wrote: post #123
3xblah wrote: post #91

Earlier quoted context omitted.

If the user is sitting behind a filtered port 53, e.g., at a hotel, running her own resolver will not solve the problem. This filtering of port 53 may be growing in popularity among ISPs. If it is, then that means users cannot easily choose their own source of DNS data. It becomes necessary to connect to some remote computer you control that can send traffic on port 53 just to send an authoritative DNS query. It is l…

> Otherwise, we are allowing third parties to become the absolute gatekeepers to the sources of authority for finding an IP address. Caches are not authoritative sources of DNS data. In theory this is what DNSSEC is meant to provide: cryptographic proof that the cache is giving you unmodified data from the zone's authoritative server(s). Unfortunately... it's still very difficult to run a recursive resolver in a "har…

Building DNS resolution into applications, bypassing the OS, is not something I like as a user. It robs me of control. Chrome started down this path and then withdrew. However Golang seems to encourage building applications that do their own DNS resolution.

Then there are computers like Chromecasts with hardcoded DNS servers and Apple devices with inaccesible HOSTS files. This sort of design takes control from the user and puts it with the company. Net/Free/OpenBSD still offer a reasonable level of control for those users who want it.

The way it was introduced, DOH seems inextricably linked to one application. It is 100% browser-centric. I hope that will change. The internet is more than just a medium for a commercial web. Maybe people will start HTTP tunnelling more than just DNS.

As for DNSSEC, it only makes sense to me if one is sharing a cache with others. If it is not a shared cache, if the user has her own caching resolver that connects directly to authoritative servers, then IMO most of the reasoning behind using DNSSEC is gone.

What is interesting about some of these DOH comments is that it appears some folks do not want the operator of an authoritative DNS server to know they are sending a query. It seems they want to "hide" behind a third party cache, assuming that is even possible.^1 That sort of "privacy" is not something I care about. I want to cut out the third party DNS middleman. I prefer to query authoritative servers directly without using a recursive resolver (either local or remote), using custom programs I wrote; this is much faster than using a cold cache.

The issue for me is control not "privacy". That is the point of the original comment I made about the Mozilla press release. Even NextDNS' FAQ admits a user-managed solution (the example they use is a PiHole) is superior, in terms of "trust", to one managed by a third party, such as NextDNS.

1. I would bet some of the folks complaining about privacy leakage in DOH are using a third party cache that sends EDNS Client Subnet, like Google Public DNS. IMO, if someone is really intent on keeping their DNS lookups private, then the most effective way is to avoid making remote queries. Get the DNS data in bulk and put it in a HOSTS file, a local zone file, "local-data:" in an unbound.conf, etc. There are zone file access programs, public scans and now DOH (outside the browser, via HTTP/1.1 pipelining).

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#143

Post by thayne »

morpheuskafka wrote: post #41
thayne wrote: post #18

I'm not sure how I feel about Firefox's strategy for DoH. On the one hand, moving DNS out of the hands of ISPs that (at least in the US) have no real incentive to respect user privacy is probably a good thing. On the other hand, circumventing the system DNS will cause problems for anyone who has explicitly configured DNS, such as corporate networks, schools, households that use DNS for security/adblocking/parental co…

Enterprise use cases can easily manage this through Group Policy. Households (keep in mind we are only talking about people who knew enough to change DNS settings in the first place) can just change the setting on each of their five or so computers. And if you are using DNS as parental controls, that's not a great solution as nothing stops someone from getting the IPs out of band (ex. a website that does DNS lookups)…

> And if you are using DNS as parental controls, that's not a great solution as nothing stops someone from getting the IPs out of band

You are assuming a rather narrow use case for "parental controls". For many people it is less about draconian control and more about not wanting someone (whether a child or the individual themselves) from accidentally stumbling on porn or other unwanted content.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#144

Post by [deleted] »

7786655 wrote: post #75
Karunamon wrote: post #56

Earlier quoted context omitted.

That's great for the handful of people that read Hacker News and understand DNS, it's a trash solution for the rest of the world. Defaults matter because they are rarely changed.

Right now the defaults are unencrypted DNS handled by ISPs which in the US have explicit legal permission to sell your data.

[deleted]

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#145

Post by newscracker »

core-questions wrote: post #140
newscracker wrote: post #40

Earlier quoted context omitted.

I’d be interested to get to any links/descriptions on how you run your own DNS server and the monetary and time costs of it.

You should look into setting up a Pi-Hole. https://pi-hole.net/ Good jumping off point for this.

Thanks. I have heard of pi-hole and know what it does (though I haven’t setup one myself). I’ll take a shot at it. I was wondering what stack the GP was using, where it was hosted and what the costs were.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#146

Post by heavyset_go »

ViViDboarder wrote: post #114
heavyset_go wrote: post #27

I'm a fan of DoH, but I'm also a Chromecast owner, so I get to experience the downsides of application-level DNS resolvers. Chromecasts will ignore the DNS servers set by DHCP, and will cease to function if they cannot communicate with Google's DNS servers[1]. That means my network-enforced DNS preferences that block ad and malware sources are ignored, and I see more ads than I want to. It also means that when Google…

What Chromecast devices did they drop support for? I have a Gen 1 Chromecast and it still works just fine.

Gen 1 Chromecasts will not receive any new updates from Google, but will continue to function.
Post reply on HN