5 ms·

Wikimedia DNS

109 points by pabs3 3y ago

codetrotter 3y ago
Does it resolve queries for pirate websites like Pirate Bay, Sci-Hub, etc?
- nvy 3y ago
  Apologies for the janky formatting as I'm on mobile and copying from a tmux session but: yes, it seems that it does. $ dig @wikimedia-dns.org +tls libgen.is ; <<>> DiG 9.18.16-1~deb12u1-Debian <<>> @wikimedia-dns.org +tls libgen.is ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5711 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;libgen.is. IN A ;; ANSWER SECTION: libgen.is. 3600 IN A 193.218.118.42 ;; Query time: 283 msec ;; SERVER: 2001:67c:930::1#853(wikimedia-dns.org) (TLS) ;; WHEN: Wed Sep 06 20:57:49 EDT 2023 ;; MSG SIZE rcvd: 54
Dalewyn 3y ago
Given how much it talks about fighting censorship and how much Wikipedia engages in political activism, I 300% expect them to censor something or another given enough time to transpire.
- acdha 3y ago
  This is definitely a good cue for some introspection about your political bubble but it’s completely off-topic for this service.
  - deleted 3y ago
    [deleted]
- whelp_24 3y ago
  Wikipedia may be biased but it isn't censored (mostly). Wikipedia is against censorship.
  - memefrog 3y ago
    [dead]
nre 3y ago
> We cannot recommend external resolver services such as those run by Google, Cloudflare, Quad9, among others, for a variety of reasons. We have no control over how these services are run or what private data is logged. Even though most of these services have explicit privacy policies, they do log some data and we have no control or insight into that. I find it very ironic that Wikipedia themselves talk about the privacy/logging practices of other DNS services but neglect to indicate a clear policy for their own service. I would imagine it's based off the regular Wikipedia privacy policy but they should clearly indicate that.
- NoPicklez 3y ago
  Couldn't agree more. It's very easy to throw shade at other providers, then not provide those assurances in your own service. It seems like a weak attempt to throw shade at other providers without substantiated claims. Take Quad9 for instance, they have plenty of information in their transparency report regarding their service, over and above what Wikimedia has provided.
  - ff317 3y ago
    [Disclosure: I'm an engineer at Wikimedia involved with this project] Wikimedia hasn't actually formally launched or announced this project. We've been working on it in the background for a long time, and we've just recently reached the point of wanting to do a slightly-broader round of both beta-testing the service and soliciting other meta-feedback on the plans with our Wikipedia editor and reader communities. Unfortunately, the only way we can do this testing and feedback round is through a public interface like meta-wiki. And of course, once we've put out public information on how to use and access it, it's being picked up on various social media and news sites and publicized beyond what we desired at this stage. We knew that was a risk, but it's still a little jarring how fast it has shown up in places like this HN thread. We absolutely plan to have a published privacy policy and other such things in place when the service is actually, officially launched. Launching some time in the future is not yet certain to even happen, as there is still internal evaluation/debate of the project's various costs and risk/benefit going on during this phase as well.
cmeacham98 3y ago
I understand why they likely don't, but I wish they'd run this service on wikipedia.org. As is, this is just another DoT/DoH service for censors to block. If it was run on the main Wikipedia domain/IPs, then it would force censors into choosing collateral damage (blocking all of Wikipedia) or allowing this service to be accessible.
- jmprspret 3y ago
  Isn't the wikimedia domain used for some external assets included in wikipedia articles? Or am I misremembering?
  - NoZebra120vClip 3y ago
    Commons is hosted on commons.wikimedia.org, but the actual encyclopedias have an internal method to access media on the Commons server, and don't use external <img> links like you would normally see.
- deleted 3y ago
  [deleted]
- acdha 3y ago
  They describe this as a small scale beta so I’d imagine a key part of deciding whether to go forward would be that question. It’d be harder for a government to block all TCP 443 to Wikipedia but they’d also be maximizing the likelihood of legal repercussions.
  - 0cf8612b2e1e 3y ago
    Are there legal repercussions for hosting DNS? I guess there are entries for “naughty” sites (as defined per jurisdiction), but seems pretty innocuous.
    - acdha 3y ago
      I’m sure that’d be the defense they’d make but remember that laws and courts aren’t board games. If someone passes a law forbidding anyone from providing access to something or assisting with that access, you can’t rule out getting dragged into court because your DNS service helped someone get content their ISP’s servers blocked. Google or Cloudflare have the same risk but also orders of magnitude more lawyers than Wikipedia.
ThinkBeat 3y ago
If Wikipedia funds this is not a bit out of scope? They keep asking for money to help Wikipedia, and I have no issue with that. But if they fund ventures like this out of the same pot I have a small issue with that.
- notRobot 3y ago
  > Wikimedia DNS helps prevent some surveillance and censorship of our wikis and other websites by securing DNS lookups. Seems completely in line with their mission.
- deleted 3y ago
  [deleted]
Gigachad 3y ago
Sorta related but Wikipedia become known for having links for stuff google delists and was the most reliable way to find the official url for things. The editors noticed and have started removing links from site pages now.
- nvy 3y ago
  Your description is very vague but if you have a substantial source that goes into detail about whatever phenomenon it is you're describing then it might make a good submission on its own.
  - Gigachad 3y ago
    It's not worth a full post but one example of where Wikipedia still works is to find the current link for The Pirate Bay which often changes. One example where the link is being censored on Wikipedia is Kiwi Farms
    - guraf 3y ago
      thepiratebay.org has always been the domain, it never changed (expect for a brief period where they lost control of it due to internal infighting). You're probably thinking of something else.
pabs3 3y ago
Personally I don't know why people aren't just using a local recursive DNS resolver rather than external services like this. I wonder when the root servers etc will start supporting DoH/DoT.
- josephcsible 3y ago
  Because your ISP will hijack the queries it makes.
  - pabs3 3y ago
    Don't they only hijack the queries that you send to the ISPs DNS servers? Or do they MITM all DNS requests no matter the destination DNS server and hijack them? A local recursive resolver will generally not forward requests to the ISPs DNS servers.
    - josephcsible 3y ago
      They MITM all DNS requests no matter the destination DNS server and hijack them. (Clarification: every ISP can. Some, but not all, actually do so.)
      - guraf 3y ago
        > Some, but not all, actually do so Can you name one that does?
    - acdha 3y ago
      It’s on the honor system: if you’re worried about the problems encrypted DNS prevents, your ISP is the most likely threat. With traditional DNS, your ISP can monitor everything you query passively. They also see every host name you connect to using TLS with SNI. Since that’s passive, you don’t know who they share that with except to the extent that you trust your government’s privacy law’s & enforcement. They can also spoof DNS replies if they want to send you to a different server. This used to be common for Wi-Fi login systems when most of the web ran on HTTPS but TLS breaks it now. This is an active attack which is usually pretty blatant so you won’t see it commonly on residential ISPs. DNS over TLS/HTTPS breaks all of the passive DNS monitoring & active spoofing. It does not help with TLS SNI monitoring but there’s an Encrypted Client Hello extension being tested now for that.
judiisis 3y ago
Curious when encrypted sni and ech will be mainstream
asalahli 3y ago
Not to be confused with DNS over Wikipedia[0] 0. https://news.ycombinator.com/item?id=22790425 https://news.ycombinator.com/item?id=22790425
ossusermivami 3y ago
I have been using https://nextdns.io https://nextdns.io for quite some time now and never looked back, highly recommend it! Having a built-in pi-hole available from anywhere and without having to manage it for my whole family is why i would recommend it...
CoolCold 3y ago
I've expected to find technical details, it's on another page - https://wikitech.wikimedia.org/wiki/Wikidough https://wikitech.wikimedia.org/wiki/Wikidough Excerpt: > Wikidough is currently deployed as an anycasted service on all our PoPs [6 datacenters]. > Our current deployment of Wikidough runs dnsdist 1.6.1 and PowerDNS Recursor 4.6.0. Both of these are installed from backported Debian sid packages

Wikimedia DNS

109 points by pabs3 3y ago

codetrotter 3y ago

Does it resolve queries for pirate websites like Pirate Bay, Sci-Hub, etc?

nvy 3y ago
Apologies for the janky formatting as I'm on mobile and copying from a tmux session but: yes, it seems that it does. $ dig @wikimedia-dns.org +tls libgen.is ; <<>> DiG 9.18.16-1~deb12u1-Debian <<>> @wikimedia-dns.org +tls libgen.is ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5711 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;libgen.is. IN A ;; ANSWER SECTION: libgen.is. 3600 IN A 193.218.118.42 ;; Query time: 283 msec ;; SERVER: 2001:67c:930::1#853(wikimedia-dns.org) (TLS) ;; WHEN: Wed Sep 06 20:57:49 EDT 2023 ;; MSG SIZE rcvd: 54

Dalewyn 3y ago

Given how much it talks about fighting censorship and how much Wikipedia engages in political activism, I 300% expect them to censor something or another given enough time to transpire.

acdha 3y ago
This is definitely a good cue for some introspection about your political bubble but it’s completely off-topic for this service.
- deleted 3y ago
  [deleted]
whelp_24 3y ago
Wikipedia may be biased but it isn't censored (mostly). Wikipedia is against censorship.
- memefrog 3y ago
  [dead]

nre 3y ago

> We cannot recommend external resolver services such as those run by Google, Cloudflare, Quad9, among others, for a variety of reasons. We have no control over how these services are run or what private data is logged. Even though most of these services have explicit privacy policies, they do log some data and we have no control or insight into that. I find it very ironic that Wikipedia themselves talk about the privacy/logging practices of other DNS services but neglect to indicate a clear policy for their own service. I would imagine it's based off the regular Wikipedia privacy policy but they should clearly indicate that.

NoPicklez 3y ago
Couldn't agree more. It's very easy to throw shade at other providers, then not provide those assurances in your own service. It seems like a weak attempt to throw shade at other providers without substantiated claims. Take Quad9 for instance, they have plenty of information in their transparency report regarding their service, over and above what Wikimedia has provided.
- ff317 3y ago
  [Disclosure: I'm an engineer at Wikimedia involved with this project] Wikimedia hasn't actually formally launched or announced this project. We've been working on it in the background for a long time, and we've just recently reached the point of wanting to do a slightly-broader round of both beta-testing the service and soliciting other meta-feedback on the plans with our Wikipedia editor and reader communities. Unfortunately, the only way we can do this testing and feedback round is through a public interface like meta-wiki. And of course, once we've put out public information on how to use and access it, it's being picked up on various social media and news sites and publicized beyond what we desired at this stage. We knew that was a risk, but it's still a little jarring how fast it has shown up in places like this HN thread. We absolutely plan to have a published privacy policy and other such things in place when the service is actually, officially launched. Launching some time in the future is not yet certain to even happen, as there is still internal evaluation/debate of the project's various costs and risk/benefit going on during this phase as well.

cmeacham98 3y ago

I understand why they likely don't, but I wish they'd run this service on wikipedia.org. As is, this is just another DoT/DoH service for censors to block. If it was run on the main Wikipedia domain/IPs, then it would force censors into choosing collateral damage (blocking all of Wikipedia) or allowing this service to be accessible.

jmprspret 3y ago
Isn't the wikimedia domain used for some external assets included in wikipedia articles? Or am I misremembering?
- NoZebra120vClip 3y ago
  Commons is hosted on commons.wikimedia.org, but the actual encyclopedias have an internal method to access media on the Commons server, and don't use external <img> links like you would normally see.
deleted 3y ago
[deleted]
acdha 3y ago
They describe this as a small scale beta so I’d imagine a key part of deciding whether to go forward would be that question. It’d be harder for a government to block all TCP 443 to Wikipedia but they’d also be maximizing the likelihood of legal repercussions.
- 0cf8612b2e1e 3y ago
  Are there legal repercussions for hosting DNS? I guess there are entries for “naughty” sites (as defined per jurisdiction), but seems pretty innocuous.
  - acdha 3y ago
    I’m sure that’d be the defense they’d make but remember that laws and courts aren’t board games. If someone passes a law forbidding anyone from providing access to something or assisting with that access, you can’t rule out getting dragged into court because your DNS service helped someone get content their ISP’s servers blocked. Google or Cloudflare have the same risk but also orders of magnitude more lawyers than Wikipedia.

ThinkBeat 3y ago

If Wikipedia funds this is not a bit out of scope? They keep asking for money to help Wikipedia, and I have no issue with that. But if they fund ventures like this out of the same pot I have a small issue with that.

notRobot 3y ago
> Wikimedia DNS helps prevent some surveillance and censorship of our wikis and other websites by securing DNS lookups. Seems completely in line with their mission.
deleted 3y ago
[deleted]

Gigachad 3y ago

Sorta related but Wikipedia become known for having links for stuff google delists and was the most reliable way to find the official url for things. The editors noticed and have started removing links from site pages now.

nvy 3y ago
Your description is very vague but if you have a substantial source that goes into detail about whatever phenomenon it is you're describing then it might make a good submission on its own.
- Gigachad 3y ago
  It's not worth a full post but one example of where Wikipedia still works is to find the current link for The Pirate Bay which often changes. One example where the link is being censored on Wikipedia is Kiwi Farms
  - guraf 3y ago
    thepiratebay.org has always been the domain, it never changed (expect for a brief period where they lost control of it due to internal infighting). You're probably thinking of something else.

pabs3 3y ago

Personally I don't know why people aren't just using a local recursive DNS resolver rather than external services like this. I wonder when the root servers etc will start supporting DoH/DoT.

josephcsible 3y ago
Because your ISP will hijack the queries it makes.
- pabs3 3y ago
  Don't they only hijack the queries that you send to the ISPs DNS servers? Or do they MITM all DNS requests no matter the destination DNS server and hijack them? A local recursive resolver will generally not forward requests to the ISPs DNS servers.
  - josephcsible 3y ago
    They MITM all DNS requests no matter the destination DNS server and hijack them. (Clarification: every ISP can. Some, but not all, actually do so.)
    - guraf 3y ago
      > Some, but not all, actually do so Can you name one that does?
  - acdha 3y ago
    It’s on the honor system: if you’re worried about the problems encrypted DNS prevents, your ISP is the most likely threat. With traditional DNS, your ISP can monitor everything you query passively. They also see every host name you connect to using TLS with SNI. Since that’s passive, you don’t know who they share that with except to the extent that you trust your government’s privacy law’s & enforcement. They can also spoof DNS replies if they want to send you to a different server. This used to be common for Wi-Fi login systems when most of the web ran on HTTPS but TLS breaks it now. This is an active attack which is usually pretty blatant so you won’t see it commonly on residential ISPs. DNS over TLS/HTTPS breaks all of the passive DNS monitoring & active spoofing. It does not help with TLS SNI monitoring but there’s an Encrypted Client Hello extension being tested now for that.

judiisis 3y ago

Curious when encrypted sni and ech will be mainstream

asalahli 3y ago

Not to be confused with DNS over Wikipedia[0] 0. https://news.ycombinator.com/item?id=22790425 https://news.ycombinator.com/item?id=22790425

ossusermivami 3y ago

I have been using https://nextdns.io https://nextdns.io for quite some time now and never looked back, highly recommend it! Having a built-in pi-hole available from anywhere and without having to manage it for my whole family is why i would recommend it...

CoolCold 3y ago

I've expected to find technical details, it's on another page - https://wikitech.wikimedia.org/wiki/Wikidough https://wikitech.wikimedia.org/wiki/Wikidough Excerpt: > Wikidough is currently deployed as an anycasted service on all our PoPs [6 datacenters]. > Our current deployment of Wikidough runs dnsdist 1.6.1 and PowerDNS Recursor 4.6.0. Both of these are installed from backported Debian sid packages