3 ms·

It's not mentioned in this article but from what I understand (and someone please correct me if I'm wrong), "blocking" is happening at the ISP DNS level, and an

It's not mentioned in this article but from what I understand (and someone please correct me if I'm wrong), "blocking" is happening at the ISP DNS level, and anyone living in these affected areas can simply use a different DNS service to continue using these websites unimpeded.

LinuxBender 8y ago
That is correct. A decent method of side-stepping ISP DNS is to run Unbound DNS on your home router or a server in your home, if you can. An example snippet from the configuration in Unbound DNS would look like this: forward-zone: name: "." forward-addr: 1.1.1.1 # CloudFlare forward-addr: 1.0.0.1 # CloudFlare forward-addr: 8.8.8.8 # Google forward-addr: 8.8.4.4 # Google forward-addr: 208.67.222.222 # OpenDNS forward-first: no And you can view it's status with unbound-control: unbound-control dump_infra | grep 1\.1\.1 1.1.1.1 . ttl 1745 ping 0 var 71 rtt 284 rto 284 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 This method of caching can also slightly improve the privacy of the people using your network. You get the bonus of a local low latency cache, and requests are distributed among multiple destinations, slightly reducing the marketing benefits of running those public DNS servers. You can also enable TCP and TLS for recursive servers that support DoT (DNS over TLS). I prefer this over DoH, as everything in your home can benefit from it, not just your browser. Some of the servers mentioned above listen on TCP 853 for TLS. Just google "Unbound DNS TLS" There are some examples on Calomel as well. [1] [1] - https://calomel.org/unbound_dns.html https://calomel.org/unbound_dns.html
- LinuxBender 8y ago
  Here is an example using TLS: forward-zone: name: "." forward-ssl-upstream: yes forward-addr: 208.67.222.222@853 forward-addr: 1.1.1.1@853 forward-addr: 8.8.4.4@853 forward-addr: 9.9.9.9@853 forward-first: no unbound-control dump_infra|cut -c 1-60|column -t 9.9.9.9@853 . ttl 851 ping 6 var 84 rtt 342 rto 342 tA 0 tAA 8.8.4.4@853 . ttl 851 ping 13 var 79 rtt 329 rto 329 tA 0 tA 208.67.222.222@853 . ttl 844 ping 876 var 1823 rtt 8168 rto And here [1] [2] are a small list of public servers that support DoT [1] - https://en.wikipedia.org/wiki/Public_recursive_name_server https://en.wikipedia.org/wiki/Public_recursive_name_server [2] - https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Public+Resolvers https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Public+Re...
willvarfar 8y ago
Is it so simple? I stare at my iphone and start to wonder where I get to change my dns settings...? So I've just spent five minutes poking around and I haven't found it yet. So I've just googled it, and apparently you need 3rd-party apps to do it... Now, interestingly, I could imagine kids doing it rote if someone just tells them how to install the an access-4chan app etc. For example, a couple of years ago I watched in horror as a 10yo friend of my kids demonstrated how to download an app (not from the app store) that would create a vpn to stop the app-store from being able to connect and discovering and uninstalling all the pirated games this kid then proceeded to install for my grateful kids! And her hands flew over the screen, tapping away and typing in English, which is a language she didn't speak let alone write in! Amazing rote. And very scary to tidy up after her! So yeah, kids will probably circumvent this kind of thing even if parents can't.
- fixermark 8y ago
  And that's sort of the thing about these bans. They aren't about expunging content from the Internet---that's basically impossible---they're about increasing the activation energy of seeking it out (and, perhaps, making the behavior of the devices used to seek it out different enough from "common traffic" that it's a lot easier for state intelligence agencies to zero in on the participants).
- milesokeefe 8y ago
  >I stare at my iphone and start to wonder where I get to change my dns settings...? So I've just spent five minutes poking around and I haven't found it yet. So I've just googled it, and apparently you need 3rd-party apps to do it... Took me about 30 seconds. Settings -> Wifi -> Tap the info icon for the network you're on -> Configure DNS.
  - dzhiurgis 8y ago
    WiFi - yes. For cellular net it wa completely impossible for last 10 years, until Apple finally came to its senses hence Cloudflare’s app.
commandersaki 8y ago
These sites are blocked by IP. To circumvent you need TOR, proxy, or VPN.

LinuxBender 8y ago

That is correct. A decent method of side-stepping ISP DNS is to run Unbound DNS on your home router or a server in your home, if you can. An example snippet from the configuration in Unbound DNS would look like this: forward-zone: name: "." forward-addr: 1.1.1.1 # CloudFlare forward-addr: 1.0.0.1 # CloudFlare forward-addr: 8.8.8.8 # Google forward-addr: 8.8.4.4 # Google forward-addr: 208.67.222.222 # OpenDNS forward-first: no And you can view it's status with unbound-control: unbound-control dump_infra | grep 1\.1\.1 1.1.1.1 . ttl 1745 ping 0 var 71 rtt 284 rto 284 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0 This method of caching can also slightly improve the privacy of the people using your network. You get the bonus of a local low latency cache, and requests are distributed among multiple destinations, slightly reducing the marketing benefits of running those public DNS servers. You can also enable TCP and TLS for recursive servers that support DoT (DNS over TLS). I prefer this over DoH, as everything in your home can benefit from it, not just your browser. Some of the servers mentioned above listen on TCP 853 for TLS. Just google "Unbound DNS TLS" There are some examples on Calomel as well. [1] [1] - https://calomel.org/unbound_dns.html https://calomel.org/unbound_dns.html

LinuxBender 8y ago
Here is an example using TLS: forward-zone: name: "." forward-ssl-upstream: yes forward-addr: 208.67.222.222@853 forward-addr: 1.1.1.1@853 forward-addr: 8.8.4.4@853 forward-addr: 9.9.9.9@853 forward-first: no unbound-control dump_infra|cut -c 1-60|column -t 9.9.9.9@853 . ttl 851 ping 6 var 84 rtt 342 rto 342 tA 0 tAA 8.8.4.4@853 . ttl 851 ping 13 var 79 rtt 329 rto 329 tA 0 tA 208.67.222.222@853 . ttl 844 ping 876 var 1823 rtt 8168 rto And here [1] [2] are a small list of public servers that support DoT [1] - https://en.wikipedia.org/wiki/Public_recursive_name_server https://en.wikipedia.org/wiki/Public_recursive_name_server [2] - https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Public+Resolvers https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Public+Re...

willvarfar 8y ago

Is it so simple? I stare at my iphone and start to wonder where I get to change my dns settings...? So I've just spent five minutes poking around and I haven't found it yet. So I've just googled it, and apparently you need 3rd-party apps to do it... Now, interestingly, I could imagine kids doing it rote if someone just tells them how to install the an access-4chan app etc. For example, a couple of years ago I watched in horror as a 10yo friend of my kids demonstrated how to download an app (not from the app store) that would create a vpn to stop the app-store from being able to connect and discovering and uninstalling all the pirated games this kid then proceeded to install for my grateful kids! And her hands flew over the screen, tapping away and typing in English, which is a language she didn't speak let alone write in! Amazing rote. And very scary to tidy up after her! So yeah, kids will probably circumvent this kind of thing even if parents can't.

fixermark 8y ago
And that's sort of the thing about these bans. They aren't about expunging content from the Internet---that's basically impossible---they're about increasing the activation energy of seeking it out (and, perhaps, making the behavior of the devices used to seek it out different enough from "common traffic" that it's a lot easier for state intelligence agencies to zero in on the participants).
milesokeefe 8y ago
>I stare at my iphone and start to wonder where I get to change my dns settings...? So I've just spent five minutes poking around and I haven't found it yet. So I've just googled it, and apparently you need 3rd-party apps to do it... Took me about 30 seconds. Settings -> Wifi -> Tap the info icon for the network you're on -> Configure DNS.
- dzhiurgis 8y ago
  WiFi - yes. For cellular net it wa completely impossible for last 10 years, until Apple finally came to its senses hence Cloudflare’s app.

commandersaki 8y ago

These sites are blocked by IP. To circumvent you need TOR, proxy, or VPN.