6 ms·
For those wondering: it's DNS blocks, so only affecting those using ISP DNS.
by Semaphor 10mo ago
For those wondering: it's DNS blocks, so only affecting those using ISP DNS.
- wrboyce 10mo agoWorth mentioning NextDNS and ControlD under this! I migrated from the former to the latter about six months ago, but both are a solid choice.
- mctt 10mo agoFree trial then $20USD per year for ControlD. Is that what you use? If so, why do you use this over another service?
- cyberpunk 10mo agoNot GP, but I just run my own dns inside the network (unbound on a little openbsd sbc) with a cronjob that pipes oisd.nl into it every night, works great..
- silisili 10mo agoNot OP but I also use ControlD. I admittedly like NextDNS interface better, but honestly, I rarely need to login anyways. So why ControlD? Because I don't want to run my own piHole, basically. They maintain ad block lists that you can edit as you see fit to add things or relax things that may cause issues(which you can't do easily with public ad blocking dns servers). Why ControlD then and not NextDNS? First, because their support was awesome when I had an issue. AFAICT it was the founder actually emailing me back and forth, and it ended up being my ISP's fault, but I only knew that based on research provided to me by support. Secondly, I got a good deal on a 5-year subscription at one point. Happy to answer any questions, not affiliated but a fan of the service.
- maxloh 10mo agoI am curious why SNI-based block isn't used.
- trinix912 10mo agoShhh, don’t give them ideas
- ronsor 10mo agoIt won't be relevant in a couple years when 90% of sites will be using ECH, meaning the SNI will be encrypted as well.
- hypeatei 10mo agoJust enabling ECH doesn't stop this, firewalls can see it and mangle the data to force a downgrade because most servers need to support older protocols. It's more accurate to say that once sites only support ECH, then they'll be forced to stop downgrading or deal with angry users.
- ronsor 10mo agoTLS 1.3, including the ECH extension, does not permit downgrading, unless your implementation is broken. Trying to downgrade or strip extensions from any TLS 1.3 connection will simply break the connection.
- hypeatei 10mo agoIn the wild, that's not true at all[0][1]. The corporate firewall at my employer actually wasn't able to block ECH until they updated it then it was able to block sites as usual. 0: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-TLS-1-3-Encrypted-Client-Hello-ECH-in/ta-p/328324 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Ho... 1: https://docs.broadcom.com/doc/symantec-ech-whitepaper https://docs.broadcom.com/doc/symantec-ech-whitepaper (see page 8)
- dilyevsky 10mo agoThis is literally impossible. What your corp fw likely does is mitm outer SNI because your IT department installed your company CA in every client's trust store. So unless you do that at national level your only other option is to block ECH entirely. Edit: actually totally possible but you need build quantum computer with sufficient cubits first =)
- Reason077 10mo agoInteresting. UK ISPs have had a similar block/filter list for many years (mostly covering copyright-infringing torrent websites and the like). But it’s more robust than a simple DNS block. A VPN can bypass the block, but changing DNS providers will not.
- hsbauauvhabzb 10mo agoWhat / how do they do it then? SNI inspection?
- lategloriousgnu 10mo agoThe ISP's blackhole the IP for some blocked domains. So changing your DNS to 8.8.8.8 will resolve the domain, but the IP won't work. A VPN avoids this, since the traffic goes via the VPN IP.
- hsbauauvhabzb 10mo agoHow would that work with cloudflare and similar though?
- lategloriousgnu 10mo agoCloudflare works with the UK government to facilitate blocks within their infra, I assume in exchange for being allowed to access UK network infrastructure. In the case that a blocked site resolved to a Cloudflare IP, it would likely be kicked off of Cloudflare, or geo-blocked for UK users (by Cloudflare). https://www.ispreview.co.uk/index.php/2025/07/cloudflare-blocking-access-to-internet-piracy-websites-in-the-uk.html https://www.ispreview.co.uk/index.php/2025/07/cloudflare-blo...
- hsbauauvhabzb 10mo agoIronically that url is forbidden for me, I was under the impression that CF were fairly anti censorship, or at least they inferred that they should not be the one calling the shots (in reference to kiwifarms)
- peter_d_sherman 10mo ago[flagged]
- deleted 10mo ago[deleted]
- JohnLocke4 10mo agoAs a reward for freeing yourself from the de facto government DNS, you will now be gifted free movies for eternity
- drnick1 10mo agoIf this is the case, someone running their own recursive DNS server (like Bind9 or Unbound) can trivially bypass these restrictions. Doing this is a sensible step towards more privacy, regardless of censorship.
- layer8 10mo agoThey don’t need to run their own DNS server, just configure a DNS server other than the ISP-provided one, like Quad9 or Google.
- hdgvhicv 10mo agoUsing Google - one of the largest data mining companies out there - rather than my trusted ISP doesn’t sound d like a step towards privacy
- password4321 10mo agoMaybe this is a good place to ask: what is the easiest way to use my own DNS entirely in user mode (not a server when I can't change which DNS is pointed to, since not an admin), a SOCKSv5 proxy? It looks like this is possible with Chrome-based browsers using a command line flag (--host-resolver-rules) or in Firefox settings. Is there a better way?
- subscribed 10mo ago"private DNS". Configure your own (with ad blocking) on nextdns.
- pabs3 10mo agoIf you are on Linux, install unbound and set your DNS server to localhost, done.
- progbits 10mo agoRegardless of censorship, I don't recommend anyone to use ISP DNS servers. They are often slow, flaky and don't respect record TTLs. Quad 1/8/9 isn't optimal alternative (too much centralization if everyone uses those by default) but running your own is easy.
- SoftTalker 10mo agosome ISPs make it difficult to use other DNS servers
- yrand 10mo agoThere's DNS over HTTPS they can't viably block, so thankfully they get the short end of the stick here. edit: Thinking of it, anyone knows if it's possible to use that for OS-wide DNS resolves, not just for the browser?