3 ms·

And as an extra point - can you actually guarantee that all your DNS lookups hit your DNS server first? That's harder than it sounds, with more and more apps i

And as an extra point - can you actually guarantee that all your DNS lookups hit your DNS server first? That's harder than it sounds, with more and more apps implementing their own DNS over HTTPS clients - Firefox does it for instance, so does Chrome.

k4rli 5y ago
How come DNS requests initiated from Chrome/FF still reach my pi-hole and get blocked just fine? I would think this browsers' solution would have prevented that.
willis936 5y ago
If you run your own router: yes up to a certain point. https://www.myhelpfulguides.com/2018/07/30/redirect-hard-coded-dns-to-pi-hole-using-edgerouter-x/ https://www.myhelpfulguides.com/2018/07/30/redirect-hard-cod... Afaik nobody has a fix for the client hostility that DoH brings to the table.
- Spivak 5y ago
  I think the fact that I can slurp, block, and/or modify all the unencrypted DNS requests of every device on my network to be the hostile thing. Yes we have all abused unencrypted DNS to take the littlest bit of control back from hostile devices but we’re the minority of a minority who lose out in this situation where everyone else is now shielded from random sketchy Wi-Fi hotspots, and their ISP.
  - willis936 5y ago
    I think not giving the option to configure DNS servers or outright ignoring configured DNS servers to be incredibly hostile. Redirecting unencrypted DNS traffic is a defensive escalation. Putting your arms up as a fist comes at your face is not a hostile action.
Wowfunhappy 5y ago
Honestly, my initial reaction to that is "well, this is a great example why I don't like Firefox's DNS-over-HTTPS thing." Firefox should follow the OS's DNS settings, not make assumptions about how I run my network. But a great counterargument would be "too bad, Firefox and now Google are doing it anyway, you lost and this is the world we live in, so deal with it." And, you'd have a point!

k4rli 5y ago

How come DNS requests initiated from Chrome/FF still reach my pi-hole and get blocked just fine? I would think this browsers' solution would have prevented that.

willis936 5y ago

If you run your own router: yes up to a certain point. https://www.myhelpfulguides.com/2018/07/30/redirect-hard-coded-dns-to-pi-hole-using-edgerouter-x/ https://www.myhelpfulguides.com/2018/07/30/redirect-hard-cod... Afaik nobody has a fix for the client hostility that DoH brings to the table.

Spivak 5y ago
I think the fact that I can slurp, block, and/or modify all the unencrypted DNS requests of every device on my network to be the hostile thing. Yes we have all abused unencrypted DNS to take the littlest bit of control back from hostile devices but we’re the minority of a minority who lose out in this situation where everyone else is now shielded from random sketchy Wi-Fi hotspots, and their ISP.
- willis936 5y ago
  I think not giving the option to configure DNS servers or outright ignoring configured DNS servers to be incredibly hostile. Redirecting unencrypted DNS traffic is a defensive escalation. Putting your arms up as a fist comes at your face is not a hostile action.

Wowfunhappy 5y ago

Honestly, my initial reaction to that is "well, this is a great example why I don't like Firefox's DNS-over-HTTPS thing." Firefox should follow the OS's DNS settings, not make assumptions about how I run my network. But a great counterargument would be "too bad, Firefox and now Google are doing it anyway, you lost and this is the world we live in, so deal with it." And, you'd have a point!