7 ms·

Another good reason to run your own private DNS resolver is censorship. I originally set it up after my ISP was sued to block access to thepiratebay.com. The co

Another good reason to run your own private DNS resolver is censorship. I originally set it up after my ISP was sued to block access to thepiratebay.com. The court was satisfied that a DNS blackhole was good enough..

bhelkey 5y ago
I imagine that it would be easier to use the Google or Cloudflare DNS (8.8.8.8 or 1.1.1.1 respectively). Disclaimer: I work for Google.
- zionic 5y ago
  But then you’re sending all your DNS queries to hostile companies, so that’s a pretty big loss. We need to normalize people using Pi’s for at-home DNS just like we did HTTPS.
  - frakkingcylons 5y ago
    Describing the public DNS resolvers of Google and Cloudflare as "hostile" is textbook shit-HN-says hyperbole.
    - spurtrenolds 5y ago
      Ummmm Can you explain why giving a complete list of URLs you visit to the worlds largest advertising and data gathering company isn't dodgy? If you can't see why, then you appear to have drunk the SV Koolaid. tldr; If millions of people do a silly thing, it is still a silly thing.
    - DyslexicAtheist 5y ago
      I'm using Cloudflare on and off. But it depends what/who you trust. Say you're based in the US work for Google and want to whistle-blow about some nefarious defense/Pentagon contracts, then staying away from Google (or US based Tech firm) infra as much as possible would be sound advice. Even if you're just a consumer you should be interested in degoogling your life including not just google DNS but their stupid web-fonts and google auth API's. Google is still going to get lot of your traffic no matter what you do but every data point you can remove is good - even if it adds zero to your bottom line at least you will maintain awareness of how you get milked every day.
    - zionic 5y ago
      Google is a for-profit-spyware company. They are hostile to me and and anyone who desires privacy.
- charlieyu1 5y ago
  Good advice. Hong Kong government blocked access to some sites these days but at least I can access it with Cloudflare DNS
- jiggunjer 5y ago
  But the DNS traffic still goes through the ISP right? They could blackhole all normal DNS traffic matching their blacklists?
  - vesinisa 5y ago
    You understand the power dynamics here wrong. You pay your ISP for unfiltered and uncensored internet access and your ISP wants to provide this to you. YOU are the ISP's paying customer. The fact that there are 3rd parties like recording industry associations that want to interfere with your and your ISP's private business is a problem for both you and your ISP. The ISP will do the least legally possible it can to satisfy whatever these external players are coercing them to do. The recording industry does not pay your ISP. On the contrary - they sue them to court and try to force them to implement solutions to censor your internet without any compensation. All these solutions cost the ISP, so if the court is happy that removing the DNS records from the ISP's primary DNS is sufficient, then so be it. The ISP has no incentive to be hostile towards you or implement any more blocks than the absolute minimum they are legally required.
  - Macha 5y ago
    Cloudflare at least is DNS over HTTPS. They'd have to block all traffic to 1.1.1.1 to prevent you using it, they couldn't selectively block pirate bay.
    - jiggunjer 5y ago
      I don't think many clients use DNS over HTTPS? Do you need a modern router for it?
      - Macha 5y ago
        All US Firefox users, some Linux distros, Cloudflare (and maybe other) VPN users have it by default. You can also enable it on Windows 10/11 or Chrome. Your router doesn't need to support it, one of the complaints from business/school admins or even just people trying to run pihole network wide is that DoH bypasses network level DNS setup
AlexanderTheGr8 5y ago
I don't follow. If you access thepiratebay.com, at some level, you are going to send a HTTP[S] request to thepiratebay.com and that request will go through your ISP. How do you prevent that without an external DNS-resolver or VPN (which is not controlled by your ISP)?
- vesinisa 5y ago
  The ISP happily routes all IP traffic. Their court-sanctioned solution was just blocking their default nameserver from giving any records for thepiratebay.com. This can be easily circumvented by editing your hosts-file, using some other DNS server than the ISP's, or running your own DNS server.

bhelkey 5y ago

I imagine that it would be easier to use the Google or Cloudflare DNS (8.8.8.8 or 1.1.1.1 respectively). Disclaimer: I work for Google.

zionic 5y ago
But then you’re sending all your DNS queries to hostile companies, so that’s a pretty big loss. We need to normalize people using Pi’s for at-home DNS just like we did HTTPS.
- frakkingcylons 5y ago
  Describing the public DNS resolvers of Google and Cloudflare as "hostile" is textbook shit-HN-says hyperbole.
  - spurtrenolds 5y ago
    Ummmm Can you explain why giving a complete list of URLs you visit to the worlds largest advertising and data gathering company isn't dodgy? If you can't see why, then you appear to have drunk the SV Koolaid. tldr; If millions of people do a silly thing, it is still a silly thing.
  - DyslexicAtheist 5y ago
    I'm using Cloudflare on and off. But it depends what/who you trust. Say you're based in the US work for Google and want to whistle-blow about some nefarious defense/Pentagon contracts, then staying away from Google (or US based Tech firm) infra as much as possible would be sound advice. Even if you're just a consumer you should be interested in degoogling your life including not just google DNS but their stupid web-fonts and google auth API's. Google is still going to get lot of your traffic no matter what you do but every data point you can remove is good - even if it adds zero to your bottom line at least you will maintain awareness of how you get milked every day.
  - zionic 5y ago
    Google is a for-profit-spyware company. They are hostile to me and and anyone who desires privacy.
charlieyu1 5y ago
Good advice. Hong Kong government blocked access to some sites these days but at least I can access it with Cloudflare DNS
jiggunjer 5y ago
But the DNS traffic still goes through the ISP right? They could blackhole all normal DNS traffic matching their blacklists?
- vesinisa 5y ago
  You understand the power dynamics here wrong. You pay your ISP for unfiltered and uncensored internet access and your ISP wants to provide this to you. YOU are the ISP's paying customer. The fact that there are 3rd parties like recording industry associations that want to interfere with your and your ISP's private business is a problem for both you and your ISP. The ISP will do the least legally possible it can to satisfy whatever these external players are coercing them to do. The recording industry does not pay your ISP. On the contrary - they sue them to court and try to force them to implement solutions to censor your internet without any compensation. All these solutions cost the ISP, so if the court is happy that removing the DNS records from the ISP's primary DNS is sufficient, then so be it. The ISP has no incentive to be hostile towards you or implement any more blocks than the absolute minimum they are legally required.
- Macha 5y ago
  Cloudflare at least is DNS over HTTPS. They'd have to block all traffic to 1.1.1.1 to prevent you using it, they couldn't selectively block pirate bay.
  - jiggunjer 5y ago
    I don't think many clients use DNS over HTTPS? Do you need a modern router for it?
    - Macha 5y ago
      All US Firefox users, some Linux distros, Cloudflare (and maybe other) VPN users have it by default. You can also enable it on Windows 10/11 or Chrome. Your router doesn't need to support it, one of the complaints from business/school admins or even just people trying to run pihole network wide is that DoH bypasses network level DNS setup

AlexanderTheGr8 5y ago

I don't follow. If you access thepiratebay.com, at some level, you are going to send a HTTP[S] request to thepiratebay.com and that request will go through your ISP. How do you prevent that without an external DNS-resolver or VPN (which is not controlled by your ISP)?

vesinisa 5y ago
The ISP happily routes all IP traffic. Their court-sanctioned solution was just blocking their default nameserver from giving any records for thepiratebay.com. This can be easily circumvented by editing your hosts-file, using some other DNS server than the ISP's, or running your own DNS server.