26 ms·

Applications should respect OS settings unless told otherwise by a user i.e opt in not opt out. It’s useful Firefox has the option to enable dns over https for

Applications should respect OS settings unless told otherwise by a user i.e opt in not opt out. It’s useful Firefox has the option to enable dns over https for users who do not run their own dns, dnscrypt, stubby servers etc but it should absolutely be opt in otherwise it’s bypassing any custom dns servers setup already. I run a small OpenBSD router with stubby for dns over tls and unbound for caching. Unbound is also loaded with a dns blocklist for adblocking/malicious site blocking which unfortunately would get bypassed automatically by browser defaults. OpenBSD just patched Firefox to disable doh by default.

techntoke 7y ago
There probably already exists, but I would like to see a standardized Docker setup for encrypted DNS and running your own DNS with unbound. I run both Unbound and Nsd locally, but I probably have a lot I could improve upon. I just used what few informative tutorials I was able to find.
- dngray 7y ago
  The arch wiki actually has a section on using unbound, dnsmasq, pdnsd with dnscrypt: https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DNS_cache_configuration https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DN... I do this on my router, and then force all of it over the VPN with a socks proxy.
  - techntoke 7y ago
    Any chance you could setup that in a Docker contaienr?
    - dngray 7y ago
      It would be very trivial to do. I currently use AlpineLinux and have mine setup like so: https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Unbound_DNS_forwarder_with_dnscrypt https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...
josteink 7y ago
> I run a small OpenBSD router with stubby for dns over tls and unbound for caching. Good news you can add DNS records which informs Firefox to disable DoH: https://news.ycombinator.com/item?id=20913248 https://news.ycombinator.com/item?id=20913248 > OpenBSD just patched Firefox to disable doh by default. People never seem to get it or admit it up front, but OpenBSD consistently seem to be making the right choices all the way.
- dngray 7y ago
  > People never seem to get it or admit it up front, but OpenBSD consistently seem to be making the right choices all the way. It's also worth noting that OpenBSD is used by a relevantly small number of users, when you consider everyone in the world. Out of those users I would bet close on 100% of them actually know what DNS is. So just because they do something with their default packaging does not mean it is right for everyone everywhere. Take something like Ubuntu for example.
dngray 7y ago
> Applications should respect OS settings unless told otherwise by a user i.e opt in not opt out. No, this is absolutely terrible. The reason being is because it leaves pleb users who don't even know what DNS is unprotected. It's also only really okay, when you control the DNS server on your network otherwise you're unprotected. Advanced users which have their own local DNS servers and have those set up to do lookups over DoT/DoHS etc are certainly in the minority. Getting all operating systems to include support for DoHs and all unsupported ones to include it isn't going to happen, so I think at this point it's certainly justifiable to include support in the browser. In the future we may see every OS will have support for something like DNS over QUIC (where DoHs will lead to). We see with Android 9 support for DoT, but that is just Android 9 (10.4% in May 2019) https://www.androidauthority.com/android-version-distribution-748439/ https://www.androidauthority.com/android-version-distributio... We know there's plenty of older android devices out there which will likely never see an update.

techntoke 7y ago

There probably already exists, but I would like to see a standardized Docker setup for encrypted DNS and running your own DNS with unbound. I run both Unbound and Nsd locally, but I probably have a lot I could improve upon. I just used what few informative tutorials I was able to find.

dngray 7y ago
The arch wiki actually has a section on using unbound, dnsmasq, pdnsd with dnscrypt: https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DNS_cache_configuration https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DN... I do this on my router, and then force all of it over the VPN with a socks proxy.
- techntoke 7y ago
  Any chance you could setup that in a Docker contaienr?
  - dngray 7y ago
    It would be very trivial to do. I currently use AlpineLinux and have mine setup like so: https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Unbound_DNS_forwarder_with_dnscrypt https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

josteink 7y ago

> I run a small OpenBSD router with stubby for dns over tls and unbound for caching. Good news you can add DNS records which informs Firefox to disable DoH: https://news.ycombinator.com/item?id=20913248 https://news.ycombinator.com/item?id=20913248 > OpenBSD just patched Firefox to disable doh by default. People never seem to get it or admit it up front, but OpenBSD consistently seem to be making the right choices all the way.

dngray 7y ago
> People never seem to get it or admit it up front, but OpenBSD consistently seem to be making the right choices all the way. It's also worth noting that OpenBSD is used by a relevantly small number of users, when you consider everyone in the world. Out of those users I would bet close on 100% of them actually know what DNS is. So just because they do something with their default packaging does not mean it is right for everyone everywhere. Take something like Ubuntu for example.

dngray 7y ago

> Applications should respect OS settings unless told otherwise by a user i.e opt in not opt out. No, this is absolutely terrible. The reason being is because it leaves pleb users who don't even know what DNS is unprotected. It's also only really okay, when you control the DNS server on your network otherwise you're unprotected. Advanced users which have their own local DNS servers and have those set up to do lookups over DoT/DoHS etc are certainly in the minority. Getting all operating systems to include support for DoHs and all unsupported ones to include it isn't going to happen, so I think at this point it's certainly justifiable to include support in the browser. In the future we may see every OS will have support for something like DNS over QUIC (where DoHs will lead to). We see with Android 9 support for DoT, but that is just Android 9 (10.4% in May 2019) https://www.androidauthority.com/android-version-distribution-748439/ https://www.androidauthority.com/android-version-distributio... We know there's plenty of older android devices out there which will likely never see an update.