4 ms·

Honestly, I'm fine with that. Applications themselves should not be resolving DNS outside of what I set in settings. The reasons applications do this is to pre

Honestly, I'm fine with that. Applications themselves should not be resolving DNS outside of what I set in settings. The reasons applications do this is to prevent users from blocking telemetry etc. It's my computer, I should have final say on what goes out.

Spivak 2y ago
Yep, I wish they would go the full way and block socket access entirely so your own outgoing traffic is always introspectable even with cert pinning. It would make it blatantly obvious when apps try shady shit.
- newaccount74 2y ago
  Shady shit? Not every network request is a call to an HTTP REST API. Blocking socket APIs would break every app that supports other protocols. Goodbye file transfer apps, VPN apps, file sync apps, database tools, SSH clients, remote desktop clients, audio and video conferencing apps, etc.
  - 9dev 2y ago
    As long as I can add exceptions for those apps to my firewall, I’m kind of… okay with that?
  - Spivak 2y ago
    Shady shit meaning really obvious when you're making http calls with encrypted opaque blobs.
- nomel 2y ago
  I had a great Windows firewall like this about 20 years ago. It would pop up a dialog for every network request from an app. You could block or allow based on port or destination, or "block all". It was amazing, because as you say, it made it very obvious when an app was trying shady shit. I would love to have that back, but I was never able to find a firewall so hostile to the user experience of the general population.
  - kergonath 2y ago
    It sounds similar in spirit to Little Snitch, mentioned in the article (on macOS, but which inspired OpenSnitch, which runs on Linux). It is awesome indeed, if a bit overwhelming at first. Most regular users would just uninstall it to avoid the constant barrage of requests initially, and then every time a new piece of software tries to connect to anything.
  - tpush 2y ago
    Zonealarm?
    - nomel 2y ago
      Yes! That was it. I'll try it again.
amluto 2y ago
There is no such thing as a remotely cross-platform DNS resolution API that has the system do the lookup and does not utterly suck for asynchronous use.
- deleted 2y ago
  [deleted]
- wtallis 2y ago
  I suspect "cross-platform" is doing a lot of heavy lifting for your claim. Browser engines and application frameworks built on top of them have no trouble using platform-specific APIs under the hood.
  - spookie 2y ago
    Yeah, but frameworks are yet another level of abstraction and dependency that just kills momentum.
nullindividual 2y ago
All major browsers now implement the ability to use a browser-defined resolver.
- lxgr 2y ago
  Yes, and some of them even make it the default under some circumstances. I agree with GP that this is generally not a great trend.
Dalewyn 2y ago
Seeing this getting downvoted is fucking wild. I remember 20+ years ago when one of the most commonly seen attacks was malware configuring a proxy server in Internet Explorer which by design overrode the operating system's configuration. What a lot of software does today by ignoring the operating system in lieu of their own shit is just like the above. If your program doesn't (or can't) respect the operating system, your shit is malware and you should reconsider who you write code for.
- yndoendo 2y ago
  Those ideas are not isomorphic. One malicious overrides universal network communication while the other just conducts DNS queries limited to a single application domain.
  - Dalewyn 2y ago
    >just conducts DNS queries Queries that will ignore configurations you set. If I see something ignoring/evading my configured DNS server, that shit is fucking malware.
    - fmajid 2y ago
      At some point in my copious spare time, I plan on writing software to allowlist in my firewall outbound connections only to IPs resolved using my DNS servers.
      - TheNewsIsHere 2y ago
        You could also configure your router to intercept rogue plaintext DNS lookups on your network with responses from a resolver you trust (for example a Pihole, Cloudflare or Google Public DNS, Quad9, PCH, etc). Adding something like Pihole would give you comprehensive blocking and custom internal DNS entries too.
        fmajid 2y ago
nox101 2y ago
I have one browser setup to do DNS differently than another. I don't want to have to set it at a system level and then need multiple systems just to run 2 browsers with different DNS lookup

Spivak 2y ago

Yep, I wish they would go the full way and block socket access entirely so your own outgoing traffic is always introspectable even with cert pinning. It would make it blatantly obvious when apps try shady shit.

newaccount74 2y ago
Shady shit? Not every network request is a call to an HTTP REST API. Blocking socket APIs would break every app that supports other protocols. Goodbye file transfer apps, VPN apps, file sync apps, database tools, SSH clients, remote desktop clients, audio and video conferencing apps, etc.
- 9dev 2y ago
  As long as I can add exceptions for those apps to my firewall, I’m kind of… okay with that?
- Spivak 2y ago
  Shady shit meaning really obvious when you're making http calls with encrypted opaque blobs.
nomel 2y ago
I had a great Windows firewall like this about 20 years ago. It would pop up a dialog for every network request from an app. You could block or allow based on port or destination, or "block all". It was amazing, because as you say, it made it very obvious when an app was trying shady shit. I would love to have that back, but I was never able to find a firewall so hostile to the user experience of the general population.
- kergonath 2y ago
  It sounds similar in spirit to Little Snitch, mentioned in the article (on macOS, but which inspired OpenSnitch, which runs on Linux). It is awesome indeed, if a bit overwhelming at first. Most regular users would just uninstall it to avoid the constant barrage of requests initially, and then every time a new piece of software tries to connect to anything.
- tpush 2y ago
  Zonealarm?
  - nomel 2y ago
    Yes! That was it. I'll try it again.

amluto 2y ago

There is no such thing as a remotely cross-platform DNS resolution API that has the system do the lookup and does not utterly suck for asynchronous use.

deleted 2y ago
[deleted]
wtallis 2y ago
I suspect "cross-platform" is doing a lot of heavy lifting for your claim. Browser engines and application frameworks built on top of them have no trouble using platform-specific APIs under the hood.
- spookie 2y ago
  Yeah, but frameworks are yet another level of abstraction and dependency that just kills momentum.

nullindividual 2y ago

All major browsers now implement the ability to use a browser-defined resolver.

lxgr 2y ago
Yes, and some of them even make it the default under some circumstances. I agree with GP that this is generally not a great trend.

Dalewyn 2y ago

Seeing this getting downvoted is fucking wild. I remember 20+ years ago when one of the most commonly seen attacks was malware configuring a proxy server in Internet Explorer which by design overrode the operating system's configuration. What a lot of software does today by ignoring the operating system in lieu of their own shit is just like the above. If your program doesn't (or can't) respect the operating system, your shit is malware and you should reconsider who you write code for.

yndoendo 2y ago
Those ideas are not isomorphic. One malicious overrides universal network communication while the other just conducts DNS queries limited to a single application domain.
- Dalewyn 2y ago
  >just conducts DNS queries Queries that will ignore configurations you set. If I see something ignoring/evading my configured DNS server, that shit is fucking malware.
  - fmajid 2y ago
    At some point in my copious spare time, I plan on writing software to allowlist in my firewall outbound connections only to IPs resolved using my DNS servers.
    - TheNewsIsHere 2y ago
      You could also configure your router to intercept rogue plaintext DNS lookups on your network with responses from a resolver you trust (for example a Pihole, Cloudflare or Google Public DNS, Quad9, PCH, etc). Adding something like Pihole would give you comprehensive blocking and custom internal DNS entries too.
      - fmajid 2y ago

nox101 2y ago

I have one browser setup to do DNS differently than another. I don't want to have to set it at a system level and then need multiple systems just to run 2 browsers with different DNS lookup