4 ms·
These things you suggest incur significant latency. Also, can you simply pipe DNS over Tor? I don't see how, since Tor is TCP-only. I suppose DoT or DoH could p
by jcgl 27d ago
These things you suggest incur significant latency. Also, can you simply pipe DNS over Tor? I don't see how, since Tor is TCP-only. I suppose DoT or DoH could potentially work, but not all authoritative servers may support those protocols. The TCP handshake will also add further latency.
Furthermore, even once you layer all that tunneling on top, it's still unclear how doing recursive resolution from your end of the tunnel is better than going through one of the big resolvers. The privacy benefits seem marginal at best. Overall, I don't think you have convinced me in the slightest of your original point that "really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver."
- iamnothere 27d agoIf your centralized DNS server receives a blocking order, what are you doing to do? You’ll have to do something. Give me another alternative then. In the current geopolitical environment, this is not idle speculation, it’s a real threat. Latency is a tradeoff, I mentioned there are tradeoffs. For an individual or home network, the latency should not be a problem especially with caching. As for TCP/UDP, current RFCs say that DNS servers must accept TCP, but not all may follow the standard and some misconfigured firewalls may block it. But it doesn’t seem to be an issue when tunneling all traffic over Tor using something like Tails. So I don’t think this is really a problem.
- jcgl 27d agoSame thing as if something equivalent happens to your VPN service I guess? Switch to another one. Oh yeah crap, you're right about DNS over regular TCP. I totally brainfarted on that.