6 ms·

This. And I already have to deal with smart appliances that try to contact their own DNS (I’m looking at you, Samsung) and that break if I force their requests

by mtsr 7y ago

This. And I already have to deal with smart appliances that try to contact their own DNS (I’m looking at you, Samsung) and that break if I force their requests through my own resolver. This will just allow all applications and appliances to bypass my privacy measures.

ferzul 7y ago
who will write the article about the weird world we live in, where the person who is mitm'ing the network connection is me, and it's the non-mitm'ed connection that is untrusted and worrying. at this point i expect to see talk of “the VPN”, a new network for hobbyists and academics, that's kinda like the old internet, and we only use devices that are wrapped in it.
- mtsr 7y ago
  Take a look at Privoxy. It's mostly useless now with everyone defaulting to HTTPS unless you install a root certificate on all your devices.
  - rnhmjoj 7y ago
    This is actually what I'm doing. With some additional duct tape[1] I made privoxy work on https too. I run an instance for each host, though it could be possible to distribute a personal CA certificate. [1]: https://maxwell.ydns.eu/git/rnhmjoj/privoxy-tls https://maxwell.ydns.eu/git/rnhmjoj/privoxy-tls
- nathanaldensr 7y ago
  I was just thinking this. It's crazy: we used to all be concerned about protecting the transport (HTTPS/TLS) but now the bigger problem seems to be the endpoints themselves being untrustworthy--"smart" appliances, Google, Facebook, Mozilla and CloudFlare with DNS-over-HTTPS. Untrustworthy endpoints using secure transport to hide malintent.
Spivak 7y ago
I mean this is pretty much the end goal. It’s a Samsung owned, controlled, and managed device. You as the local network operator are their adversary and it’s in Samsung’s every interest to bypass. They want and expect a clean connection to the internet. Giving it anything else is a problem to them. If you’re installing one of these spyware devices in your network and relying on DNS to keep your information private then that’s on you when it doesn’t work. DoH neither creates nor solves human problems.
- mtsr 7y ago
  I paid for the TV, why do we accept this practice?

by mtsr 7y ago

ferzul 7y ago

who will write the article about the weird world we live in, where the person who is mitm'ing the network connection is me, and it's the non-mitm'ed connection that is untrusted and worrying. at this point i expect to see talk of “the VPN”, a new network for hobbyists and academics, that's kinda like the old internet, and we only use devices that are wrapped in it.

mtsr 7y ago
Take a look at Privoxy. It's mostly useless now with everyone defaulting to HTTPS unless you install a root certificate on all your devices.
- rnhmjoj 7y ago
  This is actually what I'm doing. With some additional duct tape[1] I made privoxy work on https too. I run an instance for each host, though it could be possible to distribute a personal CA certificate. [1]: https://maxwell.ydns.eu/git/rnhmjoj/privoxy-tls https://maxwell.ydns.eu/git/rnhmjoj/privoxy-tls
nathanaldensr 7y ago
I was just thinking this. It's crazy: we used to all be concerned about protecting the transport (HTTPS/TLS) but now the bigger problem seems to be the endpoints themselves being untrustworthy--"smart" appliances, Google, Facebook, Mozilla and CloudFlare with DNS-over-HTTPS. Untrustworthy endpoints using secure transport to hide malintent.

Spivak 7y ago

I mean this is pretty much the end goal. It’s a Samsung owned, controlled, and managed device. You as the local network operator are their adversary and it’s in Samsung’s every interest to bypass. They want and expect a clean connection to the internet. Giving it anything else is a problem to them. If you’re installing one of these spyware devices in your network and relying on DNS to keep your information private then that’s on you when it doesn’t work. DoH neither creates nor solves human problems.

mtsr 7y ago
I paid for the TV, why do we accept this practice?