Live data from Hacker News

Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

obdev.at

81–90 of 215 posts

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#81
post #68
post #23

Earlier quoted context omitted.

There is no such thing as a remotely cross-platform DNS resolution API that has the system do the lookup and does not utterly suck for asynchronous use.

I suspect "cross-platform" is doing a lot of heavy lifting for your claim. Browser engines and application frameworks built on top of them have no trouble using platform-specific APIs under the hood.

Yeah, but frameworks are yet another level of abstraction and dependency that just kills momentum.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#84

Earlier quoted context omitted.

> This library wraps around the dnssd framework and the c-ares C library with Swift-friendly APIs and data structures. https://github.com/apple/swift-async-dns-resolver

It feels like Embrace, Extend, Extinguish to claim that a portable API is "legacy" and that its replacement is Apple-only.

That's what you use to create a utility like nslookup in swift, Apple does not want you to do any resolving yourself, just pass a hostname instead:

https://developer.apple.com/documentation/network/nwendpoint...

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#85
post #67

Sequoia also breaks an application's ability to use DNS (or presumably anything UDP-based) if the macOS firewall is enabled, and an app is listed as "Block incoming connections". https://waclaw.blog/macos-firewall-blocking-web-browsing-aft...

I can't reproduce this. Some people say it has to do with ESET: https://www.reddit.com/r/MacOS/comments/1fievr5/updating_mad...

Confirmed, it is from an old ESET network filter: https://support.eset.com/en/alert8723-network-connection-los...

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#86
post #74

Earlier quoted context omitted.

Were the autofilled DNS servers in RFC1918 private space (10.0.0.0/8, 192.168.0.0/16, etc.)? I had issues after the upgrade with Google Chrome being unable to access hosts in these ranges, and fixed it by going to System Settings -> Privacy & Security -> Local Network and toggling Google Chrome off and on again.

No, they weren't local. I have no idea where they came from. I couldn't even delete them, but when I added the Google servers, they autofilled ones were automatically deleted.

They came from DHCP or RDNSS in RA.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#87

My read of this is that it shouldn't affect pi.hole given the system's default nameserver would still received by DDNS and thus be the pi.hole? Or do these requests go somewhere that's hard-coded?

No this appears to be if an application registers a DNS resolver proxy on the local system, getaddrinfo doesn't use the proxy, and presumably just hits whatever the network interface's configured DNS server is.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#88
post #14
post #10

Earlier quoted context omitted.

Yeah, if it was intentional, it would probably be a hard-coded, encrypted URL. Some devices are starting to do that to get around ad blocking.

Good thing you can still see the domain over the network if you control the network.

You can’t control anything if they do DNS over HTTPS to a hardcoded IP they control and cert pin so you can’t MITM the connection, can you?

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#89
post #80

Earlier quoted context omitted.

It feels like Embrace, Extend, Extinguish to claim that a portable API is "legacy" and that its replacement is Apple-only.

Well but the portable API is too low-level and error prone. What is the last time you used getaddrinfo? How often do you actually need to use it? One can make a good technical argument based on the merit of the portable API without immediately resorting to the EEE argument.

getaddrinfo isn't its predecessors, there's nothing error-prone about it. The only thing that's nontrivial is falling back if the first server is unresponsive, and even there the obvious calling code is fine for almost all apps.
Post reply on HN