4 ms·

It took me a second to grok that this is really mostly just an OSS Android app with some associated DNS servers you can optionally use with it. It's not in F-Dr

• ignoramous 6y ago
  > ...because it includes proprietary bits This is baseless. There are no proprietary bits. Just because the default build script doesn't take to polyglot codebases well enough does not mean the app contains closed source tech. And I'm in no hurry to fix that myself but welcome code changes from anyone who's willing to put in the work. Here's the issue in case you or anyone reading this is interested: https://github.com/celzero/rethink-app/issues/215 https://github.com/celzero/rethink-app/issues/215 Please don't confidentally pass off judgement on things you may not fully understand. A quick cursory search of the app's GitHub issues would have alleviated your misplaced concerns. > In the meantime, there's DNS 66, which includes some similar features (minus the app firewall) DNS66 is insecure. Folks might be better off using DoH/DoT apps like https://nebulo.app/ https://nebulo.app/ https://getintra.org/ https://getintra.org/ > It took me a second to grok that this is really mostly just an OSS Android app with some associated DNS servers you can optionally use with it. Take a second or two more, you've likely missed out on a Littlesnitch-esque firewall which is like 50% of the app; and DNSCrypt v3 support, too; and on-device blocklists; and DNS over Tor support; and support for censorship bypass by protecting against SNI sniffing attacks? It is may be our terrible website design and copywriting skills that did us in. DNS66, as great as it is, doesn't have half the features.
  • JeremyNT 6y ago
    Apologies, I saw a different issue https://github.com/celzero/rethink-app/issues/210#issuecomment-753008139 https://github.com/celzero/rethink-app/issues/210#issuecomme... and did not realize those concerns had already been addressed. Unfortunately I can no longer edit my post, but it's good to learn that it is that much closer to F-Droid inclusion! :) I think my comment must have appeared harsher than I intended, because I'm very excited to learn about this project. When I say "just an android app" that's a massive positive for me, but I understand why it might read otherwise! I had assumed at first blush this was yet another scammy SASS product with a corresponding app, but when I realized it was "just" an open source Android app (and finding the open issue re: working towards F-Droid inclusion) it made me very interested indeed! I also didn't mean to imply that DNS 66 was anywhere near feature parity with this project, so apologies if that appeared to be the case. That said I have used DNS 66 in the past effectively, despite its limitations. Can you suggest where I can read more about its security deficiencies, or by "insecure" do you just mean to say it is an incomplete solution? (i.e. the lack of protocol support and the reliance on the Android VPN framework?)
    • ignoramous 6y ago
      > Apologies, I saw a different issue and did not realize those concerns had already been addressed. My bad. I'm sorry, too. In fact, I may be solely at fault here for over-reacting to your comment. My reaction really stems from an unpleasant r/Android experience where folks just piled up on BraveDNS (as it was called then) with utter non-sense and blatant, misleading lies. > I had assumed at first blush this was yet another scammy SaaS product with a corresponding app... This isn't the first time I've heard from folks that the whole thing comes off as scammy / scareware. Is it the website design? The copy? The readme on GitHub? The name of the project? > Can you suggest where I can read more about its security deficiencies, or by "insecure" do you just mean to say it is an incomplete solution? DNS66 is insecure in the sense it doesn't do any form of encryption for DNS requests [0] and, like most other DNS clients, it leaks DNS connections over TCP (only handles UDP) [1]. I wouldn't call it incomplete, it is likely fully complete in the eyes of the original developers. A DNS client can definitely do more, and that's why RethinkDNS exists in the first place. I used to use Nebulo [2] which is super light weight, supports DNS over HTTPS/3 (QUIC), and has way more features than any other DNS client I've come across. [0] https://github.com/julian-klode/dns66/issues/11 https://github.com/julian-klode/dns66/issues/11 [1] https://github.com/julian-klode/dns66/blob/4f1304746e2/app/src/main/java/org/jak_linux/dns66/vpn/DnsPacketProxy.java#L155-L165 https://github.com/julian-klode/dns66/blob/4f1304746e2/app/s... [2] https://github.com/Ch4t4r/Nebulo https://github.com/Ch4t4r/Nebulo