91–100 of 215 posts
Earlier quoted context omitted.
getaddrinfo() is not a legacy API, it's a standard cross platform API for doing DNS lookups.
Funny how that goes: macOS is POSIX certified but no other desktop BSD or Linux is.
Am I susceptible to this if I redirect all DNS traffic on my network to a pihole, which is the only device I let make external DNS requests?
In other words, it would be unencrypted to the pihole but encrypted when going out to the internet.
Earlier quoted context omitted.
Well but the portable API is too low-level and error prone. What is the last time you used getaddrinfo? How often do you actually need to use it? One can make a good technical argument based on the merit of the portable API without immediately resorting to the EEE argument.
getaddrinfo isn't its predecessors, there's nothing error-prone about it. The only thing that's nontrivial is falling back if the first server is unresponsive, and even there the obvious calling code is fine for almost all apps.
Earlier quoted context omitted.
Honestly, I'm fine with that. Applications themselves should not be resolving DNS outside of what I set in settings. The reasons applications do this is to prevent users from blocking telemetry etc. It's my computer, I should have final say on what goes out.
All major browsers now implement the ability to use a browser-defined resolver.
I agree with GP that this is generally not a great trend.
Earlier quoted context omitted.
Not resolving 127.0.0.1 or RFC1918 addresses or even ULA for IPv6 is done to avoid DNS rebinding attacks. For most end users that is probably the correct move.
My home router even seems to inspect any UDP/53 traffic and redact any responses containing local/private A entries, so not even switching to a public resolver bypasses the protection. I agree that it’s usually the right behavior.
Earlier quoted context omitted.
My home router even seems to inspect any UDP/53 traffic and redact any responses containing local/private A entries, so not even switching to a public resolver bypasses the protection. I agree that it’s usually the right behavior.
Interesting. I hadn’t considered it might be a security feature of his router!
Sometimes I wish it would allow wildcards, but honestly that's probably just another way for users to shoot themselves in the foot (e.g. by adding '*').