51–60 of 88 posts
Earlier quoted context omitted.
In all those options, CF still terminates (strips) SSL from user traffic to plaintext, on their platform, hence MITM by Cloudflare.
And other large parts of the internet are "MITMed" by AWS, Heroku, Microsoft Azure or other hosting companies then. For some reason people don't make the same argument in every thread about AWS though.
Earlier quoted context omitted.
And other large parts of the internet are "MITMed" by AWS, Heroku, Microsoft Azure or other hosting companies then. For some reason people don't make the same argument in every thread about AWS though.
Is Cloudflare a hosting company?
One certainly can argue against Cloudflare specifically, or against centralization in general, but IMHO "they see traffic" isn't a very useful argument on its own.
Earlier quoted context omitted.
In all those options, CF still terminates (strips) SSL from user traffic to plaintext, on their platform, hence MITM by Cloudflare.
And other large parts of the internet are "MITMed" by AWS, Heroku, Microsoft Azure or other hosting companies then. For some reason people don't make the same argument in every thread about AWS though.
https://stackoverflow.com/questions/22775065/cloudflare-add-...
It's just my gut feeling, that CF might abuse its unique position, having access to large part of internet traffic in plaintext. What other CDN gives free services? Hint, why Google Analytics is free?
I recently configured my OPNsense router, for DNS over TLS with Quad9, with certificate domain validation. It uses included Unbound resolver. Not sure what I achieved, but it does feel good :) https://forum.opnsense.org/index.php?topic=9197.msg41265#msg...
Quad9 also supports DNSSEC.
[1] https://www.chameth.com/2017/12/17/dns-over-tls-on-edgeroute...
Earlier quoted context omitted.
Really? They both have anycast pops all over the world - and in my tests, very close performance (couple of ms of difference - if that) to be felt by anyone. ex: https://medium.com/@nykolas.z/dns-resolvers-performance-comp...
I don't have any benchmarking data, but in my brief testing I found that to be the case. I'm using this setup on my openwrt 18.06 router.
Earlier quoted context omitted.
Games run a subset of network connections: Consumer Homelines. They don't run in corporate networks, over public wifi or over mobile networks, all three frequently block non-standard ports (my city's free wifi blocks everything except 80 and 443, DNS is hijacked). These three network types are also important, maybe more important than simple home landlines since they affect the people paying shitloads of cash or repr…
Besides public wlan this isn't an issue. In corporate networks it may be company policy to use their resolvers. External resolvers might not work for internal names, so their use is probably limited in the first place. Mobile networks should allow all ports, if not call your regulator. So 1 out of your 3 are actually important. Also, firewall rules can be changed.
Mobile networks in my experience block a variety of protocols and intercept DNS fairly regularly, even in presence of DNSSEC or DNSCrypt. Not sure what calling the regulator would give me, they're not responsible for what ports the network blocks. Not every operator is in the US, a majority of people do not live in the US and may want to use the internet without the operator playing around in DNS responses.
I recently configured my OPNsense router, for DNS over TLS with Quad9, with certificate domain validation. It uses included Unbound resolver. Not sure what I achieved, but it does feel good :) https://forum.opnsense.org/index.php?topic=9197.msg41265#msg...
I've done the very same thing, on an EdgeRouter Lite [1]. Quad9 also supports DNSSEC. [1] https://www.chameth.com/2017/12/17/dns-over-tls-on-edgeroute...
How secure is this EdgeRouter lite? Is it open source? For what it's worth, I found one blog with VPNFilter botnet and Ubiquiti on the same page :)
Earlier quoted context omitted.
I've done the very same thing, on an EdgeRouter Lite [1]. Quad9 also supports DNSSEC. [1] https://www.chameth.com/2017/12/17/dns-over-tls-on-edgeroute...
Well done ! How secure is this EdgeRouter lite? Is it open source? For what it's worth, I found one blog with VPNFilter botnet and Ubiquiti on the same page :)
The router isn't open hardware but its a good bang for the buck (I also run WireGuard on it, btw). If you want a fully open source router, I can recommend having a look at Router7 [2]. The author's using a PC Engines APU2.
Downside is you gotta do a lot of work yourself, just like with OPNSense. But I like OPNSense, even though the hardware from the company behind it is expensive the same is true for PFSense. And the company behind that isn't so friendly...
Earlier quoted context omitted.
Well done ! How secure is this EdgeRouter lite? Is it open source? For what it's worth, I found one blog with VPNFilter botnet and Ubiquiti on the same page :)
Its based Vyatta/VyOS [1]. There's a way to get OpenBSD running on it as well, but I don't have a link handy. The router isn't open hardware but its a good bang for the buck (I also run WireGuard on it, btw). If you want a fully open source router, I can recommend having a look at Router7 [2]. The author's using a PC Engines APU2. Downside is you gotta do a lot of work yourself, just like with OPNSense. But I like OP…
What work? Install is super easy ... I use OPNsense on small, fanless, cheap 'mini PC' with 2 LAN ports, you buy from aliexpress. Full x86-64, Intel with AES-NI support, for like $200 with 4GB RAM and 40GB ssd
Earlier quoted context omitted.
... which has nothing to do with what I'm talking about.
It had everything to do with it, as more and more is being forced through HTTPS, because I don't know, it's more secure or it's the only port not being filtered. There were a few times I has to run sshd on port 443 (on a server I control---a preventive measure) because a network I was forced to use (a "public" wi-fi) only allowed ports 53, 80 and 443 outbound.