4 ms·

>There's a lot of lament that this bypasses the operating system level config systemd-resolved has the clandestine ability to forward all your DNS traffic to g

>There's a lot of lament that this bypasses the operating system level config systemd-resolved has the clandestine ability to forward all your DNS traffic to google in many distributions of Linux. I would say the state of resolution in general is getting uncomfortably sketchy. many wireless routers from Asus and others due to a buggy (or perhaps intentional) implementation of Dnsmasq will quietly intercept your DNS requests using their own built-in resolver. RT-ARCH13 is notorious for it even if NAT mode is disabled. for my pihole implementation I block 53 outbound and do DoH resolution using cloudflared on the pi. finally it bears remembering that the number one largest opposition to the use of DoH was ISP's who were (and still are) making a killing selling your search history. they went so far as to lobby congress to stop DoH. Now the very same ISP's we tried to protect users from are part of the DoH club anyway because, well, money talks. https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-strike-privacy-deal-to-encrypt-dns-lookups-in-firefox/ https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-...

danudey 5y ago
I recently tried setting up microk8s, since Ubuntu was pushing it pretty hard and it seemed useful, but a lot of stuff wouldn't work at all. Turns out that the microk8s config uses cloudflare DNS by default, and not your currently configured DNS or any kind of local DNS proxy. This was hugely frustrating because it's not the configuration that I would expect, it's not obvious why things are failing, and, in our case, it's sending internal DNS names to an external DNS server, unencrypted, over the public internet. Surely it's convenient, but definitely not trustworthy.
yrro 5y ago
"clandestine"? Please, don't be ridiculous. The choice of fallback DNS server is a default that is only used in the absence of any other configured DNS resolver. If you are compiling systemd yourself then this is one of many defaults that you need to be aware of. Everyone else will get the defaults that their distribution has chosen.

danudey 5y ago

I recently tried setting up microk8s, since Ubuntu was pushing it pretty hard and it seemed useful, but a lot of stuff wouldn't work at all. Turns out that the microk8s config uses cloudflare DNS by default, and not your currently configured DNS or any kind of local DNS proxy. This was hugely frustrating because it's not the configuration that I would expect, it's not obvious why things are failing, and, in our case, it's sending internal DNS names to an external DNS server, unencrypted, over the public internet. Surely it's convenient, but definitely not trustworthy.

yrro 5y ago

"clandestine"? Please, don't be ridiculous. The choice of fallback DNS server is a default that is only used in the absence of any other configured DNS resolver. If you are compiling systemd yourself then this is one of many defaults that you need to be aware of. Everyone else will get the defaults that their distribution has chosen.