News for hackers. Stuff that matters.
Re:How to take back control of /etc/resolv.conf on Linux (2018) by g45y45 on Tuesday March 19, 2019 @05:53PM (#19436396)
You really want to do this if you use Spectrum Cable. You are locked out of configuring the DNS settings via their cable modems (even if you supply your own). These force a DNS search suffix that leaks all DNS requests to their server, even if you are using another public DNS. I noticed network manager kept forcing the DNS search suffix, even after I manually disabled it. I did the config change to disable it messing with the resolv.conf
Re:How to take back control of /etc/resolv.conf on Linux (2018) by vetinari on Tuesday March 19, 2019 @06:51PM (#19436944)
You can easily configure Network Manager to ignore anything from the DHCP, including DNS (properties ipv4.ignore-auto-dns and ipv4.dns* on your connection).
Re:How to take back control of /etc/resolv.conf on Linux (2018) by newman314 on Tuesday March 19, 2019 @07:17PM (#19437166)
Sound like a good reason for DoH
Re:How to take back control of /etc/resolv.conf on Linux (2018) by vetinari on Wednesday March 20, 2019 @06:37AM (#19440722)
DoH cuts both ways, so be sure you know what are wishing for.

Yes, it allows you to prevent your ISP manipulating your DNS. Your ISP has no way to know when you are resolving, because it is masked in other HTTPS traffic.

But it also allows the apps to prevent you from manipulating their DNS. You don't know when an app is ignoring the resolver you configured system-wide, because it is masked in its HTTPS traffic.

There is a worrying trend that apps (browsers especially) are ignoring whatever you configured in your system, and are becoming basically a blackbox outside your control with a wide open connectivity to the Internet. No explanation needed, what that means for any privacy left.

Re:How to take back control of /etc/resolv.conf on Linux (2018) by gnu8 on Tuesday March 19, 2019 @06:01PM (#19436490)
You should put your own router between their modem and your network, and not rely on DHCP from their modem for any of your network configuration.
Re:How to take back control of /etc/resolv.conf on Linux (2018) by ahmedalsudani on Tuesday March 19, 2019 @06:07PM (#19436559)
You usually need to use DHCP to get your IP address, but any decent router will let you pick your preferred DNS server.
Re:How to take back control of /etc/resolv.conf on Linux (2018) by isostatic on Tuesday March 19, 2019 @07:20PM (#19437194)
Worst case scenario is your first hop downstream from the cable modem does port 53 interception and redirects.

However if the only ISP you can get is so hostile, the solution is to tunnel (IPSEC/SSTP/whatever works) all your traffic to a non-hostile network.

Re:How to take back control of /etc/resolv.conf on Linux (2018) by erinnh on Wednesday March 20, 2019 @02:52AM (#19439652)
Use a firewall with nat to redirect all dns traffic to a DoT or DoH dns proxy in your network.

That way you dont have to tunnel all your traffic. (Though technically you could also use the tunnel for only DNS, but its not much easier than the solution above if you want this to apply to all your devices)

Re:How to take back control of /etc/resolv.conf on Linux (2018) by isostatic on Wednesday March 20, 2019 @04:02AM (#19439926)
If they’re intercepting and changing your dns packets, what else are they doing? At the very least you can assume port 80 is unsafe, and should be tunnelled. SNI as a privacy problem too, so forward 443.
Re:How to take back control of /etc/resolv.conf on Linux (2018) by tinus_hn on Tuesday March 19, 2019 @08:58PM (#19437841)
You can tell your dhcp client to ignore the DNS setting sent by the server.
Re:How to take back control of /etc/resolv.conf on Linux (2018) by trav4225 on Tuesday March 19, 2019 @06:53PM (#19436972)
My previous ISP actually just blocked all DNS traffic that wasn't to/from their servers. I had to tunnel my DNS traffic (ridiculous!)...
Re:How to take back control of /etc/resolv.conf on Linux (2018) by spiznnx on Tuesday March 19, 2019 @07:29PM (#19437270)
That's a little ridiculous. I've read[0] that Chromecasts, which are fairly common, won't work if Google DNS is unreachable (also by itself an issue), so I'm surprised they didn't get a lot of complaints.

0. https://news.ycombinator.com/item?id=19170671