3 ms·

CurveDNS encrypts communications between a DNS resolver and an DNS authoritative server. https://curvedns.on2it.net https://curvedns.on2it.net

• iam-TJ 7y ago
  Firefox doesn't like the certificate there, which is rather ironic: Web sites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for curvedns.on2it.net. The certificate is only valid for the following names: www.github.com, .github.io, .githubusercontent.com, *.github.com, github.com, github.io, githubusercontent.com Error code: SSL_ERROR_BAD_CERT_DOMAIN
  • jfindley 7y ago
    I think the project has moved to https://dnscurve.io/ https://dnscurve.io/ - I can't say for certain this is the same project but it's the current website for github.com/curvedns/curvedns which I believe is the software behind GP's link.
    • iosonofuturista 7y ago
      Seems to be a even more terrible than usual naming decision. It appears that DNSCurve is the protocol, and CurveDNS is an implementation. And the official page for the protocol seems to reside at http://www.dnscurve.org http://www.dnscurve.org. What a mess.
  • donmcronald 7y ago
    It's https://curvedns.github.io/curvedns https://curvedns.github.io/curvedns hosted on GitHub Pages giving a (301) redirect. How did they get a header based redirect via GitHub pages?
    • Arnavion 7y ago
      https://github.com/curvedns/curvedns/blob/gh-pages/CNAME https://github.com/curvedns/curvedns/blob/gh-pages/CNAME https://duckduckgo.com/?q=github+pages+"cname+file" https://duckduckgo.com/?q=github+pages+"cname+file" The official GH docs at https://help.github.com/en/articles/using-a-custom-domain-with-github-pages https://help.github.com/en/articles/using-a-custom-domain-wi... don't seem to talk about it (any more?) as opposed to the web UI way of setting the custom domain. There is a small mention at https://help.github.com/en/articles/troubleshooting-custom-domains#github-repository-setup-errors https://help.github.com/en/articles/troubleshooting-custom-d...
• 3xblah 7y ago
  True or false: dnscrypt-wrapper can be put in front of an authoritative server (instead of a recursive resolver), thereby enabling end-to-end encrypted DNS packets for a user running dnscrypt-proxy (in front of the user's cache, e.g. unbound). If true, anyone have some examples of who is doing that?
  • dngray 7y ago
    Is this what you had in mind? • https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DNS_cache_configuration https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DN... • https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Unbound_DNS_forwarder_with_dnscrypt https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...
    • 3xblah 7y ago
      No. If it was, the tutorial would be focused on authoritative DNS providers, at least in part.
      • 3xblah 7y ago
        I personally run CurveDNS but here is a quick and dirty script to show how DNSCrypt might be used to encrypt DNS traffic between stub resolvers or caches and authoritative servers, if authoritative DNS providers used dnscrypt-wrapper. To demonstrate we can pretend we are an authoritative DNS provider, e.g., a root server. See code, documentation and examples at https://github.com/Cofyc/dnscrypt-wrapper https://github.com/Cofyc/dnscrypt-wrapper # send end-to-end encypted DNS queries to/from an authoritative DNS server # send query for example.com to root server using stub resolver (drill) # authoritative DNS server (e.g., tinydns, nsd, etc.) listening on 127.0.0.1:53, serving root.zone from ftp.internic.net # dnscrypt-wrapper listening on 127.0.0.1:530 # dnscrypt-proxy listening on 127.0.0.1:5300 # could have dnscache or unbound forwarding to the dnscrypt-wrapper listening address dnscrypt-wrapper --gen-provider-keypair --provider-name=2.dnscrypt-cert.root.zone --ext-address=127.0.0.1:530 dnscrypt-wrapper --gen-crypt-keypair --crypt-secretkey-file=1.key dnscrypt-wrapper --gen-cert-file --crypt-secretkey-file=1.key --provider-cert-file=1.cert --provider-publickey-file=public.key --provider-secretkey-file=secret.key dnscrypt-wrapper -r 127.0.0.1:53 -a 127.0.0.1:530 --provider-name=2.dnscrypt-cert.root.zone --crypt-secretkey-file=1.key --provider-cert-file=1.cert -p 1.pid & k=$(dnscrypt-wrapper --show-provider-publickey|sed 's/Provider public key: //'); dnscrypt-proxy --provider-key=$k -a 127.0.0.1:5300 -r 127.0.0.1:530 --provider-name=2.dnscrypt-cert.root.zone -p 2.pid & drill example.com -p5300 @127.0.0.1 read a < 1.pid read b < 2.pid rm 1.key 1.cert public.key secret.key 1.pid 2.pid kill $a kill $b