51–60 of 63 posts
Earlier quoted context omitted.
Desktop and Android users can do this, but iPhone users are still pretty much limited to DNS-based blockers.
I mean, they can install Firefox. (With uBlock)
Relevant: Windows will improve user privacy with DNS over HTTPS
> DNS over HTTPS will prevent clients in your network from using the default local DNS services. Relevant: Windows will improve user privacy with DNS over HTTPS https://news.ycombinator.com/item?id=21562295
Info from notracking: https://github.com/notracking/hosts-blocklists#dns-over-http... Info from Mozilla: https://support.mozilla.org/en-US/kb/configuring-networks-di...
Not sure if Microsoft will do something similar? Else there is still the option to set up your own (local) DOH server and let your router route all DOH traffic to your local DOH instance.
The problem with things like this is it's hard to disable on a case-by-case basis. I enabled something similar in a VPN and found that certain redirecting tracking links from emails were blocked. Ok great, they don't know that I clicked on the link, but also I don't know what the link led to, since it was blocked , and it was something I actually wanted to go to.
Which is why uBlock and/or uMatrix is the more usable option.
Additionally having DNS filtering in place will also prevent information leakage in case something goes wrong with one of your browser plugins.
At this point I wonder if a whitelist approach might be better for accessing the web. Does anyone know of any solutions for that?
> DNS over HTTPS will prevent clients in your network from using the default local DNS services. Relevant: Windows will improve user privacy with DNS over HTTPS https://news.ycombinator.com/item?id=21562295
Mozilla added a feature to allow users to disable DOH network wide (also supported by the notracking list). Info from notracking: https://github.com/notracking/hosts-blocklists#dns-over-http... Info from Mozilla: https://support.mozilla.org/en-US/kb/configuring-networks-di... Not sure if Microsoft will do something similar? Else there is still the option to set up your own (local) DOH server and let your router route…
Since pihole and dnsmasq are already requiring disabling DoH, I see DoH as the dead of these kinds of adblock systems.
Earlier quoted context omitted.
Mozilla added a feature to allow users to disable DOH network wide (also supported by the notracking list). Info from notracking: https://github.com/notracking/hosts-blocklists#dns-over-http... Info from Mozilla: https://support.mozilla.org/en-US/kb/configuring-networks-di... Not sure if Microsoft will do something similar? Else there is still the option to set up your own (local) DOH server and let your router route…
AFAIK, being HTTP, you won't be able to differentiate and/or route it. And it can be done outside the control of the OS or browser (with js embedded in a page, application, etc.) so even if you configure your browser/system, it still will pass through filters unless whole domains are filtered? Since pihole and dnsmasq are already requiring disabling DoH, I see DoH as the dead of these kinds of adblock systems.
If for example they will use the 1.1.1.1 DOH instance, you can simply redirect all localnet 1.1.1.1 (80/53) traffic to your own local (DOH)DNS(masq).
Besides that there must be a fallback option for network admins, since using dns filtering and localnet dns is very common in enterprise. Firefox implemented a canary domain, specifically designed for this purpose, see: https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
Why dnsmasq? Why not unbound/bind/etc?
Each has a use case. dnsmasq has an easier barrier to entry, so I have seen people use it during prototyping before implimenting unbound/powerdns/bind etc, but often those can be much more complicated setups. Most edge routers provided by ISP's are running dnsmasq on the underside.
I'd say opposite
It had less examples and docs compare to unbound. At least that was my reason to setup unbound 2 years ago
>Most edge routers provided by ISP's are running dnsmasq on the underside.
True and sad
Earlier quoted context omitted.
* Connected to wifi with installed dnsmasq * * If device do not use public (like 1.1.1.1) or custom DNS
You can also redirect those public dns servers on you router to your local Dnsmasq server with iptables.
You should not
Or you completely compromise DNS chain and as result you can not trust results of dns resolve
Earlier quoted context omitted.
I mean, they can install Firefox. (With uBlock)
Firefox on iOS doesn't supports (Firefox) extensions. However Safari does supports content blockers (such as 1Blocker).