nykolasz

Great tool, but not maintained anymore, unfortunatelly.

Will have to give Caddy a try. Been a long time nginx user, but they have been very slow to implement new features (including HTTP/3), unfortunately.

how are the users going to manage the router without it? they just need to do it securely and better ways to auto update.

I would love to see a "child" lockdown mode. Maybe that will be a good option to make the iphone/ipad more young children safe?

Poor kid and a good lesson learned. Hope he doesn't get demotivated because of it. It reminds me of the old "everyone@company" email threads that would flood everyone.

I think 100% of the DNS outages in the past few months have been caused by DNSSEC. For little gain that DNSSEC provides.

Yep. What happens when Chrome adds DoH support? And Safari?

And whatever Gaming app the kids download? Suddenly it will become impossible to manage and maintain.

Not even talking about the troubleshooting nightmare.

DNS should be a system-level setting, not an App-level setting.

IP-based and domain-based. We have a long list of domains/IPs used by VPN providers.

Won't prevent someone from setting up its own SSH-based proxy on port 443, but covers things that are accessible and easy to use by young students (talking about elementary school on our case).

Again, we are talking about a school network with young kids (under 12/13).

Quite the opposite. We don't want MITM and this may force that direction.

Band-aid solution that worked pretty well. Very cheap to implement, widely supported and used by many schools.

Our student's data was still private (no emails or passwords being decrypted) and we did the filtering only based on the domain name. It also didn't require an expensive appliance that would be need if did the filtering based on SNI.

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause:

I work at a k12 school and I am involved on many k12 IT communities.

Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS.

There is a fine line between protecting yourself from your ISP and local network operators that NEED to apply some security policies to their traffic. Even Google offers "Safe Search" for schools and libraries that removes porn content.

Unfortunately, on our school network, we also allow BYOD (students with their own laptops and ipads), so we will have to have some strict rules to block DoH, the same way we block proxies and vpns.

The only other option is going to full HTTPS MITM, forcing a root SSL cert to all computers that use our network, which is the last thing that anyone wants to do.

Summary: This may lead to more HTTPS MITM or schools forbidding BYOD AND removing Firefox from their computers.

I work at a k12 school and I am involved with many IT admins from other schools.

Some schools already started to block Firefox from being installed because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS.

There is a fine line between your ISP and local network operators that NEED to apply some security policies to their traffic. Even Google offers "Safe Search" for schools and libraries that removes porn content.

Unfortunately, on our school network, we also allow BYOD, so we will have to have some strict rules to block DoH, the same way we block proxies and vpns.

Glad that they allowed resolvers that filter content based on the user request in there. So good news that Quad9 and CleanBrowsing will be able to make the list.

I need to point out that Norton DNS has been retired and is not supported anymore (and never offered any privacy).

"On November 15, 2018, Norton ConnectSafe service is being retired or discontinued meaning the service will no longer be available or supported. You may continue to use ConnectSafe until November 15, 2018. However, we do recommend that you take a moment to review important details related to this announcement below."

Some alternatives: https://medium.com/@nykolas.z/norton-connectsafe-dns-is-shut...

I am actually surprised he didn't mention CleanBrowsing in their list, which I would recommend as good alternative to Norton and OpenDNS.

Whatever skill you want to learn and will have fun learning. I am trying to learn more about kernel-level programming, because that's something I was always curious about. So that's what I am doing now.

Find your passion.

I would expect a lot more from Slack.

Agree. Isn't that why we have extensions for?

There are multiple extensions and VPN products out there (some better and some worse), so why are they choosing who wins or loses here. I know it is because of $, but I hate the direction they have been taking lately.

First, I would ask: why do you think you need a formal 1-1 with your direct reports?

I would love to understand why Firefox keep adding support for CloudFlare specific features.

And no amount of phishing training will solve it - I don't think. People will still click on links, they will click on buttons and do what they think it is expected for them to do.

On the bright side, Google Safe Browsing is pretty good at catching new untargetted phishing campaigns, so most people get a good level of protection from that. I am also a big proponent of using a DNS firewall* layer to help minimize the exposure to phishing domains.

*I blogged about it here, comparing a few free DNS resolvers, if anyone is interested:

https://medium.com/@nykolas.z/phishing-protection-comparing-...

Really? They both have anycast pops all over the world - and in my tests, very close performance (couple of ms of difference - if that) to be felt by anyone.

ex: https://medium.com/@nykolas.z/dns-resolvers-performance-comp...