4 ms·

> 1. People who want to censor and/or surveil other people's devices and traffic. This is me, with the caveat being that it's my damn device. It's only the OEM

> 1. People who want to censor and/or surveil other people's devices and traffic. This is me, with the caveat being that it's my damn device. It's only the OEM trying to say it's theirs and that I'm "censoring other people's traffic". If I bought it, I should be able to do as I like. If I tell it the DNS server is local and/or that domain is elsewhere/non-existant, I don't want it deciding otherwise and sneaking traffic out over port 443.

josephcsible 4y ago
I definitely agree that you should be able to control what connections your own devices make. But we need to ensure that such control is only possible at the endpoint, since if it were possible at the router, then the bad guys could do that to censor other people's devices. In your specific case, that means that while devices should offer a configuration setting for which DNS server to use, it shouldn't be via blindly listening to the possibly malicious DHCP server.
- alexiaa 4y ago
  it definitely should be possible at a router level, why should i be forced to configure each device individually? that said, obviously it should be possible to override on the device level, like it already is most of the time.
  - josephcsible 4y ago
    > it definitely should be possible at a router level, why should i be forced to configure each device individually? Because you shouldn't be able to control other people's devices just because they happened to connect to your Wi-Fi. And you don't have to configure them all individually anyway: you can use Group Policy, MDM, etc. to configure that setting on your whole fleet at once.
    - TheHappyOddish 4y ago
      > Because you shouldn't be able to control other people's devices just because they happened to connect to your Wi-Fi. Why? If it's my network, why should I not have control over all the traffic on it?
      - josephcsible 4y ago
        All of the traffic leaving China goes over the CCP's network. Do you think they should be able to keep censoring the whole country? Or if Comcast started censoring municipal fiber websites, would that be okay since the traffic was going through their network?
        TheHappyOddish 4y ago
        What does any of that have to do with my private home network? I don't run a country - democratic or not, nor an ISP trying to beat out competitors. This is my network that I designed for my purposes.
briHass 4y ago
Add me to the list. Unfortunately, with DoH, this now means that I have to go scorched earth and block all common DNS server IPs at the firewall. You use my gateway to resolve (DNS - 53) or you're out of luck. I suppose it's only a matter of time before even the cheapest IoT junk just establishes a VPN to its maker's cloud and sends zero unencrypted traffic.
- josephcsible 4y ago
  You should solve your problem by not putting non-FOSS IoT devices onto your network, not by doing the same kind of tactics that the bad guys trying to censor other people use. And your way will become impossible once DoH servers end up being hosted at the same IPs that important Web servers are also hosted on.
  - 29083011397778 4y ago
    I do. But people have families, and if husbands, wives, children and grandparents want to buy a fancy lightswitch, well, we do the best we can with what we have here in reality. Should everything be FOSS? Sure, that would be wonderful. But so would exposing settings regarding which DNS server to use, and honoring them. Which is funny, because the exact companies I want to block are the ones putting out devices that do none of the above.

josephcsible 4y ago

I definitely agree that you should be able to control what connections your own devices make. But we need to ensure that such control is only possible at the endpoint, since if it were possible at the router, then the bad guys could do that to censor other people's devices. In your specific case, that means that while devices should offer a configuration setting for which DNS server to use, it shouldn't be via blindly listening to the possibly malicious DHCP server.

alexiaa 4y ago
it definitely should be possible at a router level, why should i be forced to configure each device individually? that said, obviously it should be possible to override on the device level, like it already is most of the time.
- josephcsible 4y ago
  > it definitely should be possible at a router level, why should i be forced to configure each device individually? Because you shouldn't be able to control other people's devices just because they happened to connect to your Wi-Fi. And you don't have to configure them all individually anyway: you can use Group Policy, MDM, etc. to configure that setting on your whole fleet at once.
  - TheHappyOddish 4y ago
    > Because you shouldn't be able to control other people's devices just because they happened to connect to your Wi-Fi. Why? If it's my network, why should I not have control over all the traffic on it?
    - josephcsible 4y ago
      All of the traffic leaving China goes over the CCP's network. Do you think they should be able to keep censoring the whole country? Or if Comcast started censoring municipal fiber websites, would that be okay since the traffic was going through their network?
      - TheHappyOddish 4y ago
        What does any of that have to do with my private home network? I don't run a country - democratic or not, nor an ISP trying to beat out competitors. This is my network that I designed for my purposes.

briHass 4y ago

Add me to the list. Unfortunately, with DoH, this now means that I have to go scorched earth and block all common DNS server IPs at the firewall. You use my gateway to resolve (DNS - 53) or you're out of luck. I suppose it's only a matter of time before even the cheapest IoT junk just establishes a VPN to its maker's cloud and sends zero unencrypted traffic.

josephcsible 4y ago
You should solve your problem by not putting non-FOSS IoT devices onto your network, not by doing the same kind of tactics that the bad guys trying to censor other people use. And your way will become impossible once DoH servers end up being hosted at the same IPs that important Web servers are also hosted on.
- 29083011397778 4y ago
  I do. But people have families, and if husbands, wives, children and grandparents want to buy a fancy lightswitch, well, we do the best we can with what we have here in reality. Should everything be FOSS? Sure, that would be wonderful. But so would exposing settings regarding which DNS server to use, and honoring them. Which is funny, because the exact companies I want to block are the ones putting out devices that do none of the above.