Hacker News Reader

Comment by djsumdog | Hacker News Reader

I feel like people forgot about how CloudFlare, Google, et. al. can new effectively censor content they don't agree with:

https://fightthefuture.org/article/the-new-era-of-corporate-...

..and even though CloudFlare back pedaled on that particular decision somewhat, it still happened.

If you really want something fast and secure, run your own caching DNS that uses root DNS servers.

View on HN

This is some pretty sage advice. I think it's great that Cloudflare is offering the service, but it's relatively simple (and fun!) to setup up our own. There's guide in the link below for using unbound server to do this. Example#1 fits many people. And, if we choose to censor any domains we can always do so on our own service... take a look at Example#2!

https://calomel.org/unbound_dns.html

Since a discussion about this topic has been present in every thread about Cloudflare's DNS service, I can quite confidently say "people" didn't forget.

They also allow for websites to look HTTPs-enabled, but the transfer happens in clear text, e.g.:

    Client -(HTTPS)> CloudFlare -(HTTP)> Server.

For a company that allegedly is privacy first, this is a huge violation of trust.

I also know about some people that run websites that can't get Stripe because they can't figure out how to configure SSL for their website, they just plug in CloudFlare in front, and now they can communicate with Stripe, and everything is received in cleartext following the diagram i posted.

Cloudflare calls this "Flexible SSL", and it is described here: https://support.cloudflare.com/hc/en-us/articles/200170416-W...

I have flagged this for both Cloudflare and Stripe, but none seems to care.

The threat model of MiTM attacks leans heavily towards the client side than the Cloudflare -> origin connection. It's not perfect and it would be fantastic if everyone could setup SSL on their origin servers, but in the end there's are more script kiddies in coffeeshops than there are tier1 isps trying to steal your data

Flexiable SSL by Cloudflare should itself be considered a MiTM Attack and should be opposed by all security standards, organizations, and anyone that values privacy or security, this highlights the inherent problem with SSL in the first place.

> If you really want something fast and secure, run your own caching DNS that uses root DNS servers.

is there a good tutorial for this somewhere?

If you want to do it on your local linux system, it's pretty easy: you just need to install bind9 and use `nameserver 127.0.0.1` in your /etc/resolv.conf

Bind9 has a poor reputation because of how difficult it is to use it to define zones (manage a domain name), but if you want to use it as a resolver, it's basically plug'n'play.

Huge bonus included : if you want to flush the cache, you just need to run `sudo rndc flush`, so you don't have to wait for TTL timeout to test your newly configured domain name when you setup a website (you still have to restart your browser, because most of them do their own dns caching).

Honestly, isn’t Unbound a better shout if you’re not going to be fiddling with it? Just install, run, and edit /etc/resolv.conf to point at 127.0.0.1.

Well, you're describing exactly how to do it with bind9 :) What make you say Unbound is better?

Unbound is more lightweight. All it does is recursive lookups, it has no option for being authoritative. If that's all you need then that's better.

There are other options too, I don't know what makes Unbound better than PowerDNS Recursor or Knot Resolver.

I prefer Unbound as it lets me set a min-ttl. This of course is taboo and comes with caveats, so you have to know what you are doing and the implications. Unbound has better support for DNSSEC as well.

Unbound is a bit less likely to come with distro-specific oddities in the default config, I think, mostly. It's a matter of preference.

> Bind9 has a poor reputation because of how difficult it is to use it to define zones

YMMV, but bind’s poor reputation in my circles has completely to do with this:

https://www.cvedetails.com/product/144/ISC-Bind.html?vendor_...

What you want is DNSSEC-trigger, which installs Unbound on 127.0.0.1: https://www.nlnetlabs.nl/projects/dnssec-trigger/

I ran a full recursor on my laptop for about two years. It's not a great choice, especially if you're not stationary. A lot as a lot of environments intercept DNS and poison your cache, the answers for lb'd names also change depending on your geolocation (so you have to flush it every time you move). Your queries are also not really private as you the resolver has to talk to multiple authoritatives to get you your name in a plain text. The performance is also not as great even with prefetching, as you don't benefit from a shared cache.

Probably the best thing you can do is to run something like https://github.com/jedisct1/dnscrypt-proxy which at least retains privacy between you and the resolver, and use public resolvers you trust.

If you don't trust any of them, you could start a resolver on a VM somewhere, but then again that can be traced back to you, so it depends on your threat model.

Both of these options are better than running a full resolver on localhost (unless you expect the recursive DNS infrastructure to fail, while authoritative remains operational).

This is the most alarming thing about this trend that has been happening for the last few years

The Internet should be DECENTRALIZED yet it seems we are attempting to do everything in our power to ensure only a handful of companies control access to all information. For what to save 3 ms off a ping time?

Facebook is in hot water over privacy issues, but that is just the tip of the ice berg

Google, AWS, Cloudflare are IMO are larger threat then facebook ever could be.

You're barking up the wrong tree here. DNS is already an inherently centralized service -- using one company's resolvers instead of another doesn't change that.

Yes and No

the problem with Cloudflare is not simply the fact that DNS is centralized, it is a combination of all their services that is concerning for Cloudflare,

between the DDOS Proxy, the CDN, the Other Services, and now DNS that is a lot of services in a single basket, so while it is true that dns is some what centralized, having all traffic and all services dependent upon a single company seems to be a bad idea to me

But clearly everyone sees not issue with it provided they "claim" to providing a "privacy first" service for free (ya riiiiiggghhhhttttt and Facebook cares about their users privacy as well) and they have better performance, who cares what the long term effects are...

We should be working to make DNS less centralized, or replace it with something less centralized, not moving to DNS over HTTP to a few "cloud" providers who also control all of the content...

Reply on news.ycombinator.com