I just want to mention a few things: Fallback, other DNSs like 1.* and Mullvad's free DNS with more options
# Standard
1.1.1.1
1.0.0.1
2606:4700:4700::1111
2606:4700:4700::1001
# Block Malware
1.1.1.2
1.0.0.2
2606:4700:4700::1112
2606:4700:4700::1002
# Block Malware & Adult Content (not useful for this case)
1.1.1.3
1.0.0.3
2606:4700:4700::1113
2606:4700:4700::1003
Mullvad also offers *free* DNS[1], which also supports encrypted DNS
# DoH is port 443 and DoT is port 853
# Standard
dns.mullvad.net
194.242.2.2
2a07:e340::2
# Block Trackers
adblock.dns.mullvad.net
194.242.2.3
2a07:e340::3
# Block Trackers + Malware
base.dns.mullvad.net
194.242.2.4
2a07:e340::4
I should also mention, as this frustrated me a bit, that your browser may implement its own DNS and so just setting these in your router (or pihole) may not completely resolve the issue. In Firefox, go to Settings > Privacy & Security > (scroll all the way down) Enable DNS over HTTPS using > then under either "Increased Protection" or "Max Protection" you can set a DNS resolver (or turn it off). They have defaults for Cloudflare (default!) and NextDNS. While you're there, also check your settings at the top of that page about "Enhanced Tracking Protection"
I am *NOT* a network/security person and would greatly appreciate replies to this comment with additional information. Especially about setting up things like piholes, TVs, browsers, encrypted DNS (especially this!), host files, and so on. Technical forum, so let's get technical and learn ^__^
[0] - https://developers.cloudflare.com/1.1.1.1/ip-addresses/ - https://developers.cloudflare.com/1.1.1.1/setup/#dns-over-ht...
[1] https://mullvad.net/en/help/dns-over-https-and-dns-over-tls
Plain DNS:
# Default servers
# AdGuard DNS will block ads and trackers.
IPv4:
94.140.14.14
94.140.15.15
IPv6:
2a10:50c0::ad1:ff
2a10:50c0::ad2:ff
# Non-filtering servers
# AdGuard DNS will not block ads, trackers, or any other DNS requests.
IPv4:
94.140.14.140
94.140.14.141
IPv6:
2a10:50c0::1:ff
2a10:50c0::2:ff
# Family protection servers
# AdGuard DNS will block ads, trackers, adult content,
# and enable Safe Search and Safe Mode, where possible.
IPv4:
94.140.14.15
94.140.15.16
IPv6:
2a10:50c0::bad1:ff
2a10:50c0::bad2:ff
# Default server
# AdGuard DNS will block ads and trackers.
https://dns.adguard-dns.com/dns-query
# Non-filtering server
# AdGuard DNS will not block ads, trackers, or any other DNS requests.
https://unfiltered.adguard-dns.com/dns-query
# Family protection server
# AdGuard DNS will block ads, trackers, adult content,
# and enable Safe Search and Safe Mode, where possible.
https://family.adguard-dns.com/dns-query
# Default server
# AdGuard DNS will block ads and trackers.
tls://dns.adguard-dns.com
# Non-filtering server
# AdGuard DNS will not block ads, trackers, or any other DNS requests.
tls://unfiltered.adguard-dns.com
# Family protection server
# AdGuard DNS will block ads, trackers, adult content,
# and enable Safe Search and Safe Mode, where possible.
tls://family.adguard-dns.com
Given Cloudflare's logging policy (https://developers.cloudflare.com/1.1.1.1/privacy/public-dns...) and data disclosure practices, the only way US authorities would get anything worthwhile is if they had a specific individual target and a valid legal process. Cloudflare, like most of the big tech companies, is actually very good on this front; they have robust processes and are transparent (https://cf-assets.www.cloudflare.com/slt3lc6tev37/Q1INAiyBub...) about the limited cases in which they do hand over any user data.
(I don't work at Cloudflare, but do work on these issues for another big US tech company.)
> [a] couple in the South-Eastern very conservative Turkish city of Mersin
> Pornography, manifested today in the omnipresent propagation of transgender ideology and sexualization of children, for instance, is not a political Gordian knot inextricably binding up disparate claims about free speech, property rights, sexual liberation, and child welfare. It has no claim to First Amendment protection. Its purveyors are child predators and misogynistic exploiters of women. Their product is as addictive as any illicit drug and as psychologically destructive as any crime. Pornography should be outlawed. The people who produce and distribute it should be imprisoned. Educators and public librarians who purvey it should be classed as registered sex offenders. And telecommunications and technology firms that facilitate its spread should be shuttered.
Even in a Conservative-majority court this kind of ban would likely be ruled unconstitutional very quickly, but we should be clear when talking about this kind of thing where it is that a substantial number of Conservative foundations would like to go (https://www.project2025.org/about/advisory-board/). There is a non-trivial Conservative movement to to ban porn.
https://en.wikipedia.org/wiki/Server_Name_Indication
Server Name Indication payload is not encrypted, thus the hostname of the server the client tries to connect to is visible to a passive eavesdropper. This protocol weakness was exploited by security software for network filtering and monitoring[4][5][6] and governments to implement censorship.[7] Presently, there are multiple technologies attempting to hide Server Name Indication.
Also some countries may mandate users to install and trust government's CA certificate which is then used to MITM HTTPS traffic
https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...
If you have installed a root cert to allow the government to MITM, then there isn't really anything you can do...
dont forget that if certain SNI is detected, your ISP/government may try to force downgrade TLS or replace server-hello with their own cert - meaning you will need to install government certificate to browse certain websites and 99% of users will do that to get access
> going to pornhub.com or definitelynotgayporn.net would arouse suspicion in a government that is banning such behavior
dns blocking doesn't mean adults are banned from visiting porn sites. You start by contradicting your initial concession of assuming this is 100% accurate.
> and could cause a person to be under higher scrutiny. So even if you're right that the DNS bypass isn't what would technically get them in trouble, I think you can understand the motivation to encrypt your DNS traffic to ensure that you don't get a target painted on your back.
This is a prime example of Fear and uncertainty.
> And given this, I hope how you can understand that your comment does very little to contribute to the actual conversation and can even potentially mislead others. A lot of communication is implicit (otherwise it'd be incredibly cumbersome)
And this is doubt. Never fails to accompany the other two.
Those idiots tried to block google docs once.
It didn't go well as you might imagine. ERs, research institutes and several government facilities responded with cordial letters about the court's mental state. Then it was unblocked.
The reason they get to keep the porn bans is because it isn't enforced upon adults, and it does serve as a thin layer of protection against minors.
https://kotaku.com/on-pornhub-math-teacher-makes-his-mark-te...
This has resulted in the Turkish military having a very large collection of amateur gay porn.
> The system has been undergoing change for the past few years: Lambda Istanbul's lawyer Fırat Söyle stated in 2012 that the rectal examinations, and the photographic evidence of anal intercourse have been dismissed as requirements when they gained worldwide and national media attention.
— https://en.m.wikipedia.org/wiki/Pink_certificate
But from when it did happen, it sounds... bad.
> "With the picture it was a bit difficult. The face had to be recognizable as well as the penis and the ass. To put all this into a square was a bit complicated. Twice I got cramps because of the position. […] I also got humiliated at the selection, before they announce it [the final diagnosis]. There are about 12 military people, big ones, with uniforms and everything. […] They all looked one by one at the pictures and I had to bring ten pictures, ten different positions there. This is the difficulty of course, but I managed to do it. And at every single picture they looked and compared it with me. I was standing in the middle. And then they asked me questions. For example which positions I like and if I use this position they see regularly. Questions like that." — Irlenkauser, Julian. "Gender Identities and the Turkish Military." Thesis. European University Viadrina / Istanbul Bilgi University, 2012.
But I think most people would rate non-consensual sex as significantly worse than a non-consensual day job.
So if you say the sex on camera is not consensual, you're implying a very different kind of consent violation than is actually happening.
The argument here is non-consensual. No work is totally consensual, since you need to survive. You accept a life-long inconvenience in exchange for a beautiful house. Can we make sex consensual in exchange for a large enough inconvenience? The response lies in an experiment: Propose a menial job to prostitutes. Even at the same rate, most prefer their occupation. Therefore it’s consensual.
A funny quirk about non-consensual work is that the 1930’s ILO convention against slavery and forced work… excluded able-bodied men in age of working (article 11). Which kind of defeats the purpose of the convention.
This article was only abolished in 1957.
But compulsory military service still exists in probably half of the world countries.
Do you think adult actors agreeing to engage in sexual activity in front of a camera, but only because they have chosen to do that for a living when other viable employment alternatives were available, is also “non-consensual”?
Consensual means without coercion and being of sound mind.
Let's put it this way, do you consider a quid-pro-quo scenario where a boss will promote or give a raise to a female employee if she has sex with him "consensual?" Obviously this is arguable in both directions (as we could say that this is a contract between two adults, but then again, prostitution is illegal). What about if we change this to "Have sex with your boss or be fired?" The latter case is less ambiguous, but both cases would generally be considered non-consensual in Western legal systems and has been that way for quite some time. This is nothing new...
If you understand the above but fail to think "You *must* enter the military service, for 3 years, and are likely to go to combat and have a high risk of being killed or seriously injured (physically or even more likely mentally), or you can go to jail, OR put your dick in some guy's ass" I think you can understand how that constitutes significant cohesion. If you are unable to understand this, I am here to inform you that you are overfit and not robust to general problems.
Definite coercion as stated.
But if the boss is already set on firing everyone in the department, but lets one or two people stay on if they have sex with him, I consider that to be a roundabout method of quid-pro-quo prostitution. Plus embezzlement. There's no retaliation if they say no, they go home like everyone else.
And the military example is similar, there's no retaliation, most men are doing the service. The offer of an alternate option, one that very few take, is not the problem here.
But we'd still call this coercion. The "dual" of this is "have sex with me or be fired." Just because not everyone gets to have that opportunity does not mean it is not the same question stated differently.
> And the military example is similar, there's no retaliation, most men are doing the service.
There is retaliation, it's called jail.
Just because others are doing it doesn't make it any less of a coercion. This scales too.
To me, it matters significantly if refusing is retaliated against or is neutral.
If having sex with the boss is the difference between 0 firings and 1 firing, that's retaliation. If it's the difference between 95% fired and 100% fired, that's not retaliation.
Also we can say everyone gets the offer if that matters.
-
The other "dual" of this is a version where some employees have already been offered money for sex, but by a completely unrelated party. So if they want they can go take that offer now that they have more free time and only so much severance pay. (Also I am assuming they can get a new job easily enough; there are no destitution-based consent problems in this hypothetical.)
Does consent hinge on who is making the offer?
> There is retaliation, it's called jail.
You misunderstand me. There is no retaliation for not doing the gay sex thing. The default expectation is that you won't do it.
Retaliation for refusing to serve in the military is a different matter. And also why I think the mandatory service is where the actual consent issues are.
At its core, it's about whether you're trying to pressure them into sex with you.
I should have specifically said everyone gets the offer, to keep it simple. If the expectation is that basically everyone refuses, then it's not very different from walking around town and telling random people you'll hire them if they have sex with you. Which is just prostitution, not coercion.
Whether someone feels pressured is a difficult communication problem. It's hard to reduce to a simple thought experiment.
"No he will kill me!"
"Alternatively you could have sex and let me film it"
Consent.
There would be some serious issues with 3 if 1 was a fake threat meant to push you into 3, but it's not. The vast majority go along with 1.
You may feel differently if you feel that men's bodies belong to the state to be used in wars.
The consent issues are all in the forced service itself, and apply to every man equally, whether or not they take the gay proof exemption.
There's an old saying about two people of different nationalities:
The difference between you and me is smaller than the difference between us and our respective leaders.
If you opt not to take the gay sex exemption, your fate is the same as if you had never been asked.
I'm unconvinced and be hard pressed to be.
> your fate is the same as if you had never been asked.
This is absolutely not true and is literally the entire reason people go to great lengths to do it. Not understanding this is probably why you're not understanding the rest. I'm not sure how you don't get it because if you're gay you're not going to military service and you're not going to jail. If you're not gay (or not faking) your choice is military service or jail. That's not "the same" no matter how you put it.
The leaders do bad things whether or not a few gay people join or get exemptions. Why are you not convinced of that?
> This is absolutely not true and is literally the entire reason people go to great lengths to do it.
I said if you don't take the gay option, your fate is the same as if you had never been asked. You do military service or go to jail, like everyone else.
You're talking about taking it. Of course it's different if you take it.
I'm convinced of this. But this is not what you said.
In fact, that's kinda the theme of this conversation and the one you're having with others
I thought it was reasonably clear I was talking about how this gay exemption plays out, not the entire world of possibilities.
And for the line that says "your fate is the same", I made that very direct and explicit and you somehow skipped half of the sentence to interpret it in an entirely different way. That one is definitely not my fault.
I would also guess that the number of men who submitted to anal intercourse on camera with someone they wouldn't normally have sex with is approximately zero, so it qualifies as consensual in the ordinary sense. I'm not sure calling the result "amateur gay porn" is the ideal way to put it, but it is in fact all of amateur, pornographic, and gay.
I use Zen which has no such restriction. Though for safety all my illegal activity is done via VPN because this is still a Five Eyes country.
I actually switched to EE and they have no such restriction.
https://decoded.legal/blog/2021/06/must-all-uk-internet-acce...
> If all Internet access providers were subject to retention notices, wouldn’t it be easier to say that? There would be no need to dance around issues of secrecy, or explain why the list of notice recipients cannot be published. The fact that the Home Office chooses to take this approach undermines the claim that all providers have notices.
This source appears to be engaging in wishful thinking.
I don’t keep much data at work for that long
If it is a thing it’s either a massive conspiracy across thousands of network engineers or you could point to some technical details on how it’s implemented.
That’s by definition a conspiracy
I'd be very careful giving security advice to someone in that situation - in fact, I probably wouldn't do it, even though I am an experienced professional who knows more than most people in IT.
Think about accuracy, which is correctness, completeness, and consistency:
Giving security advice to buddies trying to watch out-of-country sporting events has a much different accuracy requirement than advice for someone whose liberty, life, or pursuit of happiness (assets) are at stake. If your advice is incorrect, incomplete (you don't know or account for the entire picture), or inconsistent (different pieces of your advice don't line up) - these people don't miss their favorite team, the might go to jail, get tortured, lose their children, their careers, etc.
When I give professional security advice, I spend a lot of time on it. I make sure I know the whole picture, my advice is correct - rechecking old understandings, testing and retesting, etc. - and it's consistent. These people are trusting me. And then if I'm not sure of those things, I find someone who knows better than I do. I don't have time to do that at the Airbnb.
In this case, it seems to risk incorrectness and incompleteness: It may be incorrect because setting up DNS lookups so there are no leaks is tricky - I'm not even sure how to do it reliably. For example, some apps and OSes have DNS servers hardcoded; IME some just bypass your configuration (maybe the dev just didn't care to integrate with the system DNS settings); IIRC some have hardcoded fallbacks; sometimes the client overrides your config with the local gateway or the servers it supplies; also, DNS has a complex federated infrastructure. (My first stab at secure DNS is a secure VPN that doesn't leak - that seems much easier).
It's incomplete: the authorities might not see the DNS lookups but they will clearly see the IPs that the user accesses, including those of the porn websites.
These people are trusting you and you told them they could safely look at porn. Yikes, I would not want that responsibility without some serious work.
Blocking is step 1. Monitoring step 2. After that it starts getting into physical danger territory.
I do know that being LGBTQ+ is persecuted in many places, even in the US; I know what is overlooked now can be persecuted later, even many years later; I know that in most places Internet usage is recorded and is used to build detailed profiles of users, and that those records are retained indefinitely.
DNS queries still leak the domain unless the client is using DoH.
1. Gay porn is not specifically blocked in Turkey, porn is; so gay porn watchers would be mostly indistinguishable from any porn watchers via their evasion techniques
2. Not that it matters as you are free to be gay in Turkey
3. Not that it matters again, because access to blocked content is never prosecuted. No one ever receives letters from their ISP even for pirating
4. Calling the internet state controlled is a bit far imo, smaller ISPs don’t even apply some blocks and comparatively USDoJ can do domain seizures which is not too different from what happens there (websites being blocked via court orders and “administrative preventative measures”). Although I’d agree that the line for blocking is drawn too close.
5. I also wouldn’t call Mersin very conservative, the left CHP just won the municipal election with ~60% of the votes
One last thing, ISPs have moved on to using DPI to block websites so you might wanna suggest something like green-tunnel so they can up their game.
Not to be overly suspicious, but it sounds very much like government-sponsored astroturfing.
Everything is not ok in Turkey, there’s lots and lots of stuff that needs to be fixed re: gay rights and acceptance in general public plus millions more of other things which led me to leave the country; but having to hide gay porn habits from the government/my isp was not one of them. Again, it’s not Iran or Russia.
The absolute joy they had when I showed them how to set up 1.1.1.1 on their Android TV, phones, and laptops… so they could watch unrestricted gay porn in their heavily censored and state-controlled slice of the World Wide Web…
I still get a virtual greeting card from them once in a while.