6 ms·

I don't think the author forgot the axiom; they seem to acknowledge that they just don't know of anything better in that case: > That's about the best you can

by nilkn 8y ago

I don't think the author forgot the axiom; they seem to acknowledge that they just don't know of anything better in that case: > That's about the best you can ask for with a centralized infrastructure for the internet. A recurring theme in this quest for data ownership and privacy is that you can only take it so far before you have to ultimately trust a company or entity to do what they say they're doing.

rsync 8y ago
"they seem to acknowledge that they just don't know of anything better in that case" They don't know you can run your own DNS server ? It's technically trivial (for this audience) and it's basically free (very low traffic and resource instance or droplet or VM ...).
- nilkn 8y ago
  I disagree that it's technically trivial for the audience this article is written for. The suggestions on the page are all as simple as using a particular browser, search engine, or browser plugin.
- DoctorOetker 8y ago
  how much daily traffic does running your own DNS server generate? (to keep up to date with the domain-IP binding?) I am really interested in trying this...
  - perennate 8y ago
    The DNS requests corresponding to typical HTTP traffic would be negligible compared to that HTTP traffic. DNS servers generally don't generate any traffic except when you perform a query. Should be <512 bytes per request and after a particular domain name is queried it doesn't need to be queried again for some time (depending on TTL).
    - DoctorOetker 8y ago
      so its really only somewhat anonymizing if many people use it? is there some kind of distributed DNS table through TOR or something?
  - oarsinsync 8y ago
    If you were to run your own recursive DNS resolver, you'd probably do 3-10x more DNS traffic than you did before, due to the number of requests increasing from 1 to multiple. That said, each DNS request & response is usually under 1KB, so the background traffic doesn't really stop being negligible. Don't run your resolver open to the wider internet, however. Only accept recursive requests from your local network segment, or you'll unwittingly become part of DNS amplification attacks.
    - DoctorOetker 8y ago
      oh, I thought a DNS server meant I would be storing my own copy of table of URL's to IP adresses? So the privacy enhancement is tracking by the DNS server? but if my local DNS server forwards these requests, how exactly does it improve my privacy if it does not store a bulk "DNS table" in my amateur speak?
      - antonvs 8y ago
        DNS servers deal with domain names, not URLs. For an HTTPS request, the rest of the URL (path etc.) is only ever sent to the target site, over an encrypted connection. From an information privacy perspective, DNS is a weak link in this mechanism. The reason running your own DNS improves your privacy has to do with how centralized or decentralized your DNS traffic is, and who gets to see it as a result. If you use a DNS controlled by someone else, the DNS operator can see, and therefore (in principle) track, all of the domain name lookups you make that aren't served by your local machine or router's cache. In contrast, if you run your own DNS server that's not just a slave to e.g. an ISP's server, then external domain lookups are made directly against the authoritative DNS servers for the domain you're looking up. There's no longer a single central server, other than your own, that's seeing all your lookups. So if you look up news.ycombinator.com, and the name isn't already in your cache, the request goes direct from your DNS server to an AWS DNS server, because that's who hosts the ycombinator.com DNS. Your non-cached DNS requests are thus spread out across all the DNS servers for all the different domains you're accessing, and the only DNS servers that see your requests are the servers for the domain you're accessing. There are some caveats to this. First, if your ISP is unscrupulous, it can examine your DNS traffic anyway, since most DNS traffic is currently unencrypted (this is changing, but slowly.) To get around that you'd need an encrypted DNS proxy hosted outside your provider's network. Second, large DNS providers like Verisign, GoDaddy, AWS etc. will tend to get a large subset of your requests anyway. However, most of those big companies are publicly focused on information security, and it would be big news if it turned out they were tracking your DNS lookups. Some of them provide audited guarantees that they don't do this.
- davidsong 8y ago
  Where would you point the upstream? Doesn't it just push the problem up one server?
  - gruez 8y ago
    If you run your own recursing DNS server, your "upstream" is ICANN and the various registries that run the top level domains.
    - DoctorOetker 8y ago
      suppose a local government blocks a global gambling or betting platform, will ICANN happily serve the IP one seeks to a end-user installed DNS server? What is then the legal perspective? Is ICANN then in contempt of local law?
      - gruez 8y ago
        Because of how recursing works[1], ICANN only serves the IP for the dns server responsible for the tld. I doubt that would run afoul of any laws because ICANN doesn't even know what the actual domain you're looking up is. [1] https://en.wikipedia.org/wiki/File:Example_of_an_iterative_DNS_resolver.svg https://en.wikipedia.org/wiki/File:Example_of_an_iterative_D...
        Asooka 8y ago
        > I doubt that would run afoul of any laws Sure it does. If the law says that domain X is not accessible in country Y, then ICANN has to scrub domain X from the list of domains when queried from country Y. Whether country Y has the jurisdiction to demand ICANN comply with their laws is a different matter, but I believe that technically serving "blocked" domains is probably against the relevant laws.
        gruez 8y ago
        >Sure it does. If the law says that domain X is not accessible in country Y, then ICANN has to scrub domain X from the list of domains when queried from country Y. But thing is that ICANN doesn't have a list of domains. All it has is a list of tlds and the dns servers for them. So if www.example.com. was blocked in some random country, the conversation with ICANN would go something like this: client: what's the IP for example.com? ICANN: I don't know, but you should ask verisign (the operator of the .com TLD) You could argue that ICANN should have responded with "I don't know" (which will cause the recursion to stop), but that's sort of pointless because if you really wanted to know, you could ask ICANN to resolve some random.com domain and you would get the response that you need ("go ask verisign"). The company you want to block/sanction/threaten here is verisign (the actual company that controls the .com zone), not ICANN (the company that controls the root zone).
codesforhugs 8y ago
It doesn't take a huge amount of research to learn of altenatives like uncensoreddns.org so I think it is a little lazy to just go with Cloudflare.
- johnisgood 8y ago
  > UncensoredDNS is the name of a DNS service which consists of two uncensored DNS servers. The servers are available for use by anyone, free of charge. According to the article, "free of charge" is suspicious. > This node is hosted at AS9167 in Copenhagen, Denmark. Denmark belongs to the Nine Eyes. Given this information, why uncensoreddns? Are there better alternatives?

by nilkn 8y ago

rsync 8y ago

"they seem to acknowledge that they just don't know of anything better in that case" They don't know you can run your own DNS server ? It's technically trivial (for this audience) and it's basically free (very low traffic and resource instance or droplet or VM ...).

nilkn 8y ago
I disagree that it's technically trivial for the audience this article is written for. The suggestions on the page are all as simple as using a particular browser, search engine, or browser plugin.
DoctorOetker 8y ago
how much daily traffic does running your own DNS server generate? (to keep up to date with the domain-IP binding?) I am really interested in trying this...
- perennate 8y ago
  The DNS requests corresponding to typical HTTP traffic would be negligible compared to that HTTP traffic. DNS servers generally don't generate any traffic except when you perform a query. Should be <512 bytes per request and after a particular domain name is queried it doesn't need to be queried again for some time (depending on TTL).
  - DoctorOetker 8y ago
    so its really only somewhat anonymizing if many people use it? is there some kind of distributed DNS table through TOR or something?
- oarsinsync 8y ago
  If you were to run your own recursive DNS resolver, you'd probably do 3-10x more DNS traffic than you did before, due to the number of requests increasing from 1 to multiple. That said, each DNS request & response is usually under 1KB, so the background traffic doesn't really stop being negligible. Don't run your resolver open to the wider internet, however. Only accept recursive requests from your local network segment, or you'll unwittingly become part of DNS amplification attacks.
  - DoctorOetker 8y ago
    oh, I thought a DNS server meant I would be storing my own copy of table of URL's to IP adresses? So the privacy enhancement is tracking by the DNS server? but if my local DNS server forwards these requests, how exactly does it improve my privacy if it does not store a bulk "DNS table" in my amateur speak?
    - antonvs 8y ago
      DNS servers deal with domain names, not URLs. For an HTTPS request, the rest of the URL (path etc.) is only ever sent to the target site, over an encrypted connection. From an information privacy perspective, DNS is a weak link in this mechanism. The reason running your own DNS improves your privacy has to do with how centralized or decentralized your DNS traffic is, and who gets to see it as a result. If you use a DNS controlled by someone else, the DNS operator can see, and therefore (in principle) track, all of the domain name lookups you make that aren't served by your local machine or router's cache. In contrast, if you run your own DNS server that's not just a slave to e.g. an ISP's server, then external domain lookups are made directly against the authoritative DNS servers for the domain you're looking up. There's no longer a single central server, other than your own, that's seeing all your lookups. So if you look up news.ycombinator.com, and the name isn't already in your cache, the request goes direct from your DNS server to an AWS DNS server, because that's who hosts the ycombinator.com DNS. Your non-cached DNS requests are thus spread out across all the DNS servers for all the different domains you're accessing, and the only DNS servers that see your requests are the servers for the domain you're accessing. There are some caveats to this. First, if your ISP is unscrupulous, it can examine your DNS traffic anyway, since most DNS traffic is currently unencrypted (this is changing, but slowly.) To get around that you'd need an encrypted DNS proxy hosted outside your provider's network. Second, large DNS providers like Verisign, GoDaddy, AWS etc. will tend to get a large subset of your requests anyway. However, most of those big companies are publicly focused on information security, and it would be big news if it turned out they were tracking your DNS lookups. Some of them provide audited guarantees that they don't do this.
davidsong 8y ago
Where would you point the upstream? Doesn't it just push the problem up one server?
- gruez 8y ago
  If you run your own recursing DNS server, your "upstream" is ICANN and the various registries that run the top level domains.
  - DoctorOetker 8y ago
    suppose a local government blocks a global gambling or betting platform, will ICANN happily serve the IP one seeks to a end-user installed DNS server? What is then the legal perspective? Is ICANN then in contempt of local law?
    - gruez 8y ago
      Because of how recursing works[1], ICANN only serves the IP for the dns server responsible for the tld. I doubt that would run afoul of any laws because ICANN doesn't even know what the actual domain you're looking up is. [1] https://en.wikipedia.org/wiki/File:Example_of_an_iterative_DNS_resolver.svg https://en.wikipedia.org/wiki/File:Example_of_an_iterative_D...
      - Asooka 8y ago
        > I doubt that would run afoul of any laws Sure it does. If the law says that domain X is not accessible in country Y, then ICANN has to scrub domain X from the list of domains when queried from country Y. Whether country Y has the jurisdiction to demand ICANN comply with their laws is a different matter, but I believe that technically serving "blocked" domains is probably against the relevant laws.
        gruez 8y ago
        >Sure it does. If the law says that domain X is not accessible in country Y, then ICANN has to scrub domain X from the list of domains when queried from country Y. But thing is that ICANN doesn't have a list of domains. All it has is a list of tlds and the dns servers for them. So if www.example.com. was blocked in some random country, the conversation with ICANN would go something like this: client: what's the IP for example.com? ICANN: I don't know, but you should ask verisign (the operator of the .com TLD) You could argue that ICANN should have responded with "I don't know" (which will cause the recursion to stop), but that's sort of pointless because if you really wanted to know, you could ask ICANN to resolve some random.com domain and you would get the response that you need ("go ask verisign"). The company you want to block/sanction/threaten here is verisign (the actual company that controls the .com zone), not ICANN (the company that controls the root zone).

codesforhugs 8y ago

It doesn't take a huge amount of research to learn of altenatives like uncensoreddns.org so I think it is a little lazy to just go with Cloudflare.

johnisgood 8y ago
> UncensoredDNS is the name of a DNS service which consists of two uncensored DNS servers. The servers are available for use by anyone, free of charge. According to the article, "free of charge" is suspicious. > This node is hosted at AS9167 in Copenhagen, Denmark. Denmark belongs to the Nine Eyes. Given this information, why uncensoreddns? Are there better alternatives?