Remove almost all online garbage using Dnsmasq • Hacker News Board

Re: Remove almost all online garbage using Dnsmasq

#21

Post by mirimir » Sun, Nov 17, 2019, 8:37 PM UTC

zamadatix wrote: post #11

mirimir wrote: post #10

If tunneled DNS becomes prevalent, these hostname/domain approaches won't work. So it'll come down to blocking at IP level. And that will likely be harder.

That doesn't really have anything to do with the tunneling of DNS. Authentication + ignoring the local resolver do.

I meant stuff like DNS over HTTPS (DoH). If you trust whatever app is doing DoH, that's fine. But if you don't, it's nontrivial to even know what resolver it's using. Let alone forcing it to use a resolver you want.

Edit: So that's tunneled DNS.

You could also call it encrypted DNS, I suppose. But then, you could say something similar about VPNs, instead of calling them tunnels.

Hard-coded authenticated DNS would be hard too, but it's at least possible that you could see what resolver it's using.

Re: Remove almost all online garbage using Dnsmasq

#22

Post by tomc1985 » Sun, Nov 17, 2019, 8:40 PM UTC

matthewaveryusa wrote: post #8

tonymet wrote: post #5

see pihole

To elaborate a bit more, pihole is essentially this (dnsmasq + banlist), but with a pretty UI and admin page. Running your own DNS server is something more people should do and it took me all of 20 minutes to set it up on my docker homeserver with no prior knowledge of DNS except for 'it's the thing that translates domains to ips' and 'it's the thing on port 53'

Tomato firmware has something like this as well ... dnsmasq + blocklists

Re: Remove almost all online garbage using Dnsmasq

#23

Post by ikeboy » Sun, Nov 17, 2019, 9:11 PM UTC

The problem with things like this is it's hard to disable on a case-by-case basis. I enabled something similar in a VPN and found that certain redirecting tracking links from emails were blocked. Ok great, they don't know that I clicked on the link, but also I don't know what the link led to, since it was blocked, and it was something I actually wanted to go to.

Re: Remove almost all online garbage using Dnsmasq

#24

Post by rndomsrmn » Sun, Nov 17, 2019, 9:24 PM UTC

vinni2 wrote: post #15

What’s the difference to pihole?

Pihole does not make use of dnsmasq's build in option to block entire domains (address=/ads.com/::). This list is also optimized because hostnames that match a domain filter are not included, reducing the size a lot.

Re: Remove almost all online garbage using Dnsmasq

#25

Post by rndomsrmn » Sun, Nov 17, 2019, 9:28 PM UTC

9dl wrote: post #19

sneak wrote: post #18

Earlier quoted context omitted.

Works on all devices, including mobile phones and tablets.

* Connected to wifi with installed dnsmasq * * If device do not use public (like 1.1.1.1) or custom DNS

You can also redirect those public dns servers on you router to your local Dnsmasq server with iptables.

Re: Remove almost all online garbage using Dnsmasq

#26

Post by blibble » Sun, Nov 17, 2019, 9:30 PM UTC

mirimir wrote: post #10

If tunneled DNS becomes prevalent, these hostname/domain approaches won't work. So it'll come down to blocking at IP level. And that will likely be harder.

can't even do that with services like cloudflare/other CDNs where multiple completely unrelated sites are served from the same IPs

Re: Remove almost all online garbage using Dnsmasq

#27

Post by mirimir » Sun, Nov 17, 2019, 9:39 PM UTC

blibble wrote: post #26

mirimir wrote: post #10

If tunneled DNS becomes prevalent, these hostname/domain approaches won't work. So it'll come down to blocking at IP level. And that will likely be harder.

can't even do that with services like cloudflare/other CDNs where multiple completely unrelated sites are served from the same IPs

Damn. Good point.

But arguably there will always be user-controllable open-source apps.

Re: Remove almost all online garbage using Dnsmasq

#28

Post by jakeogh » Sun, Nov 17, 2019, 9:51 PM UTC

mirimir wrote: post #21

zamadatix wrote: post #11

Earlier quoted context omitted.

That doesn't really have anything to do with the tunneling of DNS. Authentication + ignoring the local resolver do.

I meant stuff like DNS over HTTPS (DoH). If you trust whatever app is doing DoH, that's fine. But if you don't, it's nontrivial to even know what resolver it's using. Let alone forcing it to use a resolver you want. Edit: So that's tunneled DNS. You could also call it encrypted DNS, I suppose. But then, you could say something similar about VPNs, instead of calling them tunnels. Hard-coded authenticated DNS would be…

We could force/sandbox apps that want access to the net to pass through middleware (with pinned keys etc) the user controls, and remove the SSL (really all networking) code from the apps. Want to resolve a name? Submit it here. Want to make a GET? Submit it here.

That will remove their most cherished authority, so clearly they would hate it and come up with endless fake excuses, but that's why open source matters.

Re: Remove almost all online garbage using Dnsmasq

#29

Post by zamadatix » Sun, Nov 17, 2019, 9:56 PM UTC

mirimir wrote: post #21

zamadatix wrote: post #11

Earlier quoted context omitted.

That doesn't really have anything to do with the tunneling of DNS. Authentication + ignoring the local resolver do.

I meant stuff like DNS over HTTPS (DoH). If you trust whatever app is doing DoH, that's fine. But if you don't, it's nontrivial to even know what resolver it's using. Let alone forcing it to use a resolver you want. Edit: So that's tunneled DNS. You could also call it encrypted DNS, I suppose. But then, you could say something similar about VPNs, instead of calling them tunnels. Hard-coded authenticated DNS would be…

So as you said it's nothing about the tunneling and everything about ignoring your local resolver. Tunneling/DoH is just one of a million ways to enable something to do so (but does not necessitate it does).

Re: Remove almost all online garbage using Dnsmasq

#30

Post by zamadatix » Sun, Nov 17, 2019, 10:03 PM UTC

jakeogh wrote: post #28

mirimir wrote: post #21

Earlier quoted context omitted.

I meant stuff like DNS over HTTPS (DoH). If you trust whatever app is doing DoH, that's fine. But if you don't, it's nontrivial to even know what resolver it's using. Let alone forcing it to use a resolver you want. Edit: So that's tunneled DNS. You could also call it encrypted DNS, I suppose. But then, you could say something similar about VPNs, instead of calling them tunnels. Hard-coded authenticated DNS would be…

We could force/sandbox apps that want access to the net to pass through middleware (with pinned keys etc) the user controls, and remove the SSL (really all networking) code from the apps. Want to resolve a name? Submit it here. Want to make a GET? Submit it here. That will remove their most cherished authority, so clearly they would hate it and come up with endless fake excuses, but that's why open source matters.

There is no such thing as a communication channel you can give to a black box that only allows the black box to communicate things you approve of. It's either give it a communication channel or don't.

If you want to trust it you have to be able to audit its workings. There is no magic sauce from a network layer that gets around this step and after this step nothing else is needed.