3 ms·

It's enlightening when you see all the crap that all the devices on your network are doing. You can take things a step further and isolate IOT devices on isolat

It's enlightening when you see all the crap that all the devices on your network are doing. You can take things a step further and isolate IOT devices on isolated subnets, with additional firewall/security rules to create a choke point for all traffic. Only a matter of time before applications begin to roll their own encrypted forms of DNS in order to circumvent ad blockers.

StillBored 5y ago
You mean like DOH? which is quickly becoming ubiquitous.
- blitzar 5y ago
  I expect they mean bypass your networks DNS completely and use hard coded ip's or a hard coded DNS (with some way to obscure it). DNS filtering and blocking is a very powerful tool great for bypassing many features/pitfalls of the internet.
  - BeefWellington 5y ago
    If you have the commitment to it, you can simply force all outbound connections not originating from your DNS servers to be NATed TO your DNS servers. I do this; no machine other than my 2 DNS servers are permitted to make outbound DNS requests (they are transparently handled by my LAN DNS). The real annoying change is the transition to DNS over HTTPS. The canary domain[1] is useful but apps are obviously free to ignore it. [1]: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
- whalesalad 5y ago
  DOH is one way to do it. HTTPS is a secure channel.
- JohnFen 5y ago
  That's why I had to start MITMing all of my HTTPS connections.
  - zo1 5y ago
    That's when the apps start embedding(pinning) certificates and completely ignoring any additional root certs you might want them to accept from the OS.
    - userbinator 5y ago
      That's when you start injecting your own certificate into the certificate verification APIs... one of the amazing powers you get when you're root and actually have full control of your device, no wonder it scares big (ad)tech for users to have that power.

StillBored 5y ago

You mean like DOH? which is quickly becoming ubiquitous.

blitzar 5y ago
I expect they mean bypass your networks DNS completely and use hard coded ip's or a hard coded DNS (with some way to obscure it). DNS filtering and blocking is a very powerful tool great for bypassing many features/pitfalls of the internet.
- BeefWellington 5y ago
  If you have the commitment to it, you can simply force all outbound connections not originating from your DNS servers to be NATed TO your DNS servers. I do this; no machine other than my 2 DNS servers are permitted to make outbound DNS requests (they are transparently handled by my LAN DNS). The real annoying change is the transition to DNS over HTTPS. The canary domain[1] is useful but apps are obviously free to ignore it. [1]: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
whalesalad 5y ago
DOH is one way to do it. HTTPS is a secure channel.
JohnFen 5y ago
That's why I had to start MITMing all of my HTTPS connections.
- zo1 5y ago
  That's when the apps start embedding(pinning) certificates and completely ignoring any additional root certs you might want them to accept from the OS.
  - userbinator 5y ago
    That's when you start injecting your own certificate into the certificate verification APIs... one of the amazing powers you get when you're root and actually have full control of your device, no wonder it scares big (ad)tech for users to have that power.