5 ms·

> read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, Don't worry. All the browsers and stuff are bypassing

> read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, Don't worry. All the browsers and stuff are bypassing this level of control by moving to DNS-over-HTTPS. You'll either have to deploy a TLS terminating proxy on your network, or give up on this arms race.

notarealllama 1y ago
Jokes on you, I do have a fortinet which does this.... Oh wait, only up to TLS 1.1 or something and it's slow. I forgot the name of the software but there used to be a few tools to terminate and reencrypt. But yeah dnssec is it's own challenge
- gbuk2013 1y ago
  You need to get an F5 box instead. :)
gbuk2013 1y ago
To be fair, if you are geeky enough to run a PiHole you will have no trouble finding the config option to turn off DoH in your browser.
- freedomben 1y ago
  True, but I want all the devices on my home network to have DoH disabled too. Most of them I can't change directly.
- int0x29 1y ago
  Don't turn it off in your browser. If you have control of that setting just install an ad blocker. The point of DNS block lists is to get rid of ads on phones, TVs, and other non configurable things.
  - woleium 1y ago
    And then there is amazon sidewalk, which can only be evaded by unplugging the wifi board on your tv
  - hnuser123456 1y ago
    Except, now you don't really control your web browser either, and ad blockers are getting crippled. It is an uphill battle.
    - Larrikin 1y ago
      AdBlockers are not crippled on Firefox
  - nobody9999 1y ago
    >Don't turn it off in your browser. If you have control of that setting just install an ad blocker. The point of DNS block lists is to get rid of ads on phones, TVs, and other non configurable things. Yes, and...It's not just to block ads. It's also to block various trackers and unwanted/surreptitious "telemetry" and "updates" to those devices you can't control/configure.
mikevin 1y ago
Would certificate pinning also remove the first option? I wonder if we are moving to a system where inspecting your own traffic isn't a viable option anymore, am I missing a workaround?
- deleted 1y ago
  [deleted]
- jcalvinowens 1y ago
  If you control the machine you can always defeat pinning, given enough effort. But for an IoT device, yeah, we're already there.
wkat4242 1y ago
Yeah DoH was a solution to a really niche US-only problem where their laws provided the ability for providers to sell their users' DNS logs. In normal countries with privacy protections this isn't a thing anyway. In this model, DoH is only a bad thing because it evades local DNS control. I know that apps can always roll their own or even hardcode servers, but I hate the way that DoH was seen as some kind of saviour even though it adds zero benefit to European users and only adds negatives.
- diogocp 1y ago
  Your comment makes no sense. The DoH providers can still log requests and sell them. DoH protects against intermediaries spying on your requests and potentially forging responses. Exactly the same as HTTPS. Sending anything in clear text over the internet in 2025 is criminally negligent.
  - koito17 1y ago
    HTTPS is not necessary to encrypt DNS traffic. DNS-over-TLS exists, but it has much less traction compared to DNS-over-HTTPS. I am guessing the reason is that HTTPS traffic all goes through port 443, so "censorship" of DNS becomes tricky, since DNS traffic becomes a bit harder to distinguish from ordinary web traffic. Encapsulating DNS packets in HTTP payloads still feels a bit strange to me. Reminds me a bit of DOCSIS, which encapsulates ethernet frames in MPEG-2 Transport Stream packets (this is not a joke).
    - baq 1y ago
      Everything other than 80 and 443 is blocked by default, anything-over-https is just a matter of time. With a properly configured TLS MITM proxy only certificate pinning will prevent snooping, but it’ll also prevent connectivity, so you might call it a win for security/privacy, or a loss for the open internet if it’s you who needs to VPN to a safe network from within such an environment…
      - wkat4242 1y ago
gosub100 1y ago
The arms race will continue. I think the next gen will be a self hosted archive.ph style host that lets all the garbage load and distills it into a PDF or Web 1.0 style file ready for consumption. I would be fine with a browser extension that learns what I watch the most and preloads it for me, and/or an on demand service that shares prerendered sites bundled into torrents that group together common interests. Edit: as much as I dislike AI, I concede it would be lovely to tell it to replace all ads with pictures of flowers.
- DrillShopper 1y ago
  That's what The Internet Junkbusters Proxy / Privoxy excelled so good at.

notarealllama 1y ago

Jokes on you, I do have a fortinet which does this.... Oh wait, only up to TLS 1.1 or something and it's slow. I forgot the name of the software but there used to be a few tools to terminate and reencrypt. But yeah dnssec is it's own challenge

gbuk2013 1y ago
You need to get an F5 box instead. :)

gbuk2013 1y ago

To be fair, if you are geeky enough to run a PiHole you will have no trouble finding the config option to turn off DoH in your browser.

freedomben 1y ago
True, but I want all the devices on my home network to have DoH disabled too. Most of them I can't change directly.
int0x29 1y ago
Don't turn it off in your browser. If you have control of that setting just install an ad blocker. The point of DNS block lists is to get rid of ads on phones, TVs, and other non configurable things.
- woleium 1y ago
  And then there is amazon sidewalk, which can only be evaded by unplugging the wifi board on your tv
- hnuser123456 1y ago
  Except, now you don't really control your web browser either, and ad blockers are getting crippled. It is an uphill battle.
  - Larrikin 1y ago
    AdBlockers are not crippled on Firefox
- nobody9999 1y ago
  >Don't turn it off in your browser. If you have control of that setting just install an ad blocker. The point of DNS block lists is to get rid of ads on phones, TVs, and other non configurable things. Yes, and...It's not just to block ads. It's also to block various trackers and unwanted/surreptitious "telemetry" and "updates" to those devices you can't control/configure.

mikevin 1y ago

Would certificate pinning also remove the first option? I wonder if we are moving to a system where inspecting your own traffic isn't a viable option anymore, am I missing a workaround?

deleted 1y ago
[deleted]
jcalvinowens 1y ago
If you control the machine you can always defeat pinning, given enough effort. But for an IoT device, yeah, we're already there.

wkat4242 1y ago

Yeah DoH was a solution to a really niche US-only problem where their laws provided the ability for providers to sell their users' DNS logs. In normal countries with privacy protections this isn't a thing anyway. In this model, DoH is only a bad thing because it evades local DNS control. I know that apps can always roll their own or even hardcode servers, but I hate the way that DoH was seen as some kind of saviour even though it adds zero benefit to European users and only adds negatives.

diogocp 1y ago
Your comment makes no sense. The DoH providers can still log requests and sell them. DoH protects against intermediaries spying on your requests and potentially forging responses. Exactly the same as HTTPS. Sending anything in clear text over the internet in 2025 is criminally negligent.
- koito17 1y ago
  HTTPS is not necessary to encrypt DNS traffic. DNS-over-TLS exists, but it has much less traction compared to DNS-over-HTTPS. I am guessing the reason is that HTTPS traffic all goes through port 443, so "censorship" of DNS becomes tricky, since DNS traffic becomes a bit harder to distinguish from ordinary web traffic. Encapsulating DNS packets in HTTP payloads still feels a bit strange to me. Reminds me a bit of DOCSIS, which encapsulates ethernet frames in MPEG-2 Transport Stream packets (this is not a joke).
  - baq 1y ago
    Everything other than 80 and 443 is blocked by default, anything-over-https is just a matter of time. With a properly configured TLS MITM proxy only certificate pinning will prevent snooping, but it’ll also prevent connectivity, so you might call it a win for security/privacy, or a loss for the open internet if it’s you who needs to VPN to a safe network from within such an environment…
    - wkat4242 1y ago

gosub100 1y ago

The arms race will continue. I think the next gen will be a self hosted archive.ph style host that lets all the garbage load and distills it into a PDF or Web 1.0 style file ready for consumption. I would be fine with a browser extension that learns what I watch the most and preloads it for me, and/or an on demand service that shares prerendered sites bundled into torrents that group together common interests. Edit: as much as I dislike AI, I concede it would be lovely to tell it to replace all ads with pictures of flowers.

DrillShopper 1y ago
That's what The Internet Junkbusters Proxy / Privoxy excelled so good at.