News for hackers. Stuff that matters.
Re:So my ISP was hijacking my DNS by akerl_ on Thursday November 05, 2026 @08:40PM (#50387083)
A reminder that the average consumer device doesn't actually validate DNSSEC in its default configuration: it relies on its recursive resolver to set a bit on the response saying "I validated DNSSEC, things are all good". In that configuration, DNSSEC gets you no protection against this.

One of the reasons a variety of providers have been pushing for DoH is because DoH fully closes the risk of ISP MITM without needing individual site operators to do anything. This is why you're seeing folks like Firefox and Chrome enable DoH by default.

Re:So my ISP was hijacking my DNS by cowlevel on Friday November 06, 2026 @02:04AM (#50389102)
DoH is fine if a bit complicated. The problem is who the DoH provider is. Usually it's Cloudflare.
Re:So my ISP was hijacking my DNS by account42 on Friday November 06, 2026 @07:46AM (#50391699)
> One of the reasons a variety of providers have been pushing for DoH is because DoH fully closes the risk of ISP MITM without needing individual site operators to do anything.

... by replacing it with Google/Cloudflare MITM with whom the user doesn't even have a business relationship or even shared jurisdiction.

Re:So my ISP was hijacking my DNS by akerl_ on Friday November 06, 2026 @08:16AM (#50391953)
The business relationship most home users have with their ISP explicitly permits that ISP to harvest data from their DNS requests.
Re:So my ISP was hijacking my DNS by account42 on Friday November 06, 2026 @11:28AM (#50394532)
I'm glad you know everyones ISP terms of services as well as the local laws that restrict which parts of them are worth a damn.
Re:So my ISP was hijacking my DNS by akerl_ on Friday November 06, 2026 @01:03PM (#50395928)
Do you actually disagree with my claim, or is your concern purely that you don’t like my generalization?