News for hackers. Stuff that matters.

A comment on Improving DNS Privacy with Oblivious DoH. Parent comment

Re:Improving DNS Privacy with Oblivious DoH by admax88q on Tuesday December 08, 2020 @12:32PM (#25348516)
Pi-hole is still very much niche, and outside of that and enterprise network admins, the majority of users are stuck using the trash resolver of their operating system directed to the trash DNS servers of their ISP.

If DNS level blocking ever becomes popular enough, malware authors will change their systems to not use the system's DNS, or to use hard coded DNS over TLS/HTTP servers that they know will serve them the data they want.

Preventing proprietary applications from doing malicious things is a constant cat and mouse game. Pi-hole works well for now, I would argue, because it's not popular enough to put a big enough dent in the success rate of malware.

[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by zamadatix on Tuesday December 08, 2020 @01:39PM (#25349545)
DNS level blocking is extraordinarily common in enterprise settings though so the cat and mouse game for malware trying to avoid it is decades in the making at this point, pi-hole is just a recent common name in the prosumer space.
[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by TrueDuality on Tuesday December 08, 2020 @12:52PM (#25348840)
pi-hole is the most recognized name on here, but I think you're wrong about DNS level blocking. There are lot of home routers that have started integrating that feature natively. A few examples that I know off hand:

- Motorola MH7022

- Eero

- Disney Circle

Basically any of them that say "content filtering" in their product sheet are using DNS level filtering.

> ...the trash resolver of their operating system...

I'm very curious why you think the well tested, vetted, and constantly updated resolvers built into OS's are "trash". Is it just because most don't have support for DoH or DoT?

[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by admax88q on Monday December 14, 2020 @02:59PM (#25422414)
Most of the OS level resolvers just forward to the resolver provided via DHCP. Which is fine for enterprise, but for home users means using the ISPs resolver, which can track users and has a history of injecting ads on failed resolutions.

Not to mention the user interface for configuring them has never evolved beyond /etc/hosts and the total disaster that is /etc/resolv.conf (on modern linux distros).

The fact that I have to run a separate device such as pi-hole to intercept DNS rather than just point my OS resolver to a blacklist indicates how OS level resolvers have not kept up with the use cases people are asking of them.

And of course, no support for DoH or DoT or even DNSSEC.

[ Parent | on HN ]