4 ms·
> Why would I go for just 1 arbitrary provider rather than the lowest latency choice out of 140? Because a ISP that can compromise any one of those 140 differe
by a1369209993 5y ago
> Why would I go for just 1 arbitrary provider rather than the lowest latency choice out of 140?
Because a ISP that can compromise any one of those 140 different single points of failure can now make that one have the lowest latency and give you malicious DNS results just like you never secured anything.
This is the same problem as allowing 140 different CAs to issue certificates for subdomains of com, rather than forcing the fucking registry to do it when you get a domain name in the first place.
- kd913 5y agohttps://github.com/DNSCrypt/dnscrypt-proxy/wiki/Configuration-Sources https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Configuratio... >minisign_key is a public key, used to verify that the content is legitimate. Lists can thus be served from any location, even from an untrusted ISP: dnscrypt-proxy will immediately detect and reject something that has been tampered with. >https://dnscrypt.info/stamps-specifications/ https://dnscrypt.info/stamps-specifications/ >https://dnscrypt.info/faq https://dnscrypt.info/faq An ISP will not be able to spoof the sources or these stamps. They wouldn't put the effort in. Even if they did, it is factored and thought about. More harmful would be a malicious DoH relay but I trust the devs.That I think is fixed by mandating the use of DNSSec too for my relays.