Noisy: Random DNS, HTTP/S traffic noise generator

When I took my first networking class a billion years ago (the 1990s) the kindly professor who had written most of the networking textbooks in use at the time started the first week off by teaching us how to use the ping command.

But first he warned us: make sure you always use the -c flag if you're pinging something on the internet. This is to specify the count of pings sent out. If you didn't it would ping forever and generate too much traffic, and this useless noise would make you a "bad netizen". He explained this and everything to us so kindly and with such sincerity it was like watching Fred Rodgers speak.

Now we have to randomly barf noise onto the network to maybe have a better chance at some privacy. And that's on top of the half dozen browser extensions and the vpn and whatever other tools you need to have a moderately good experience on the network.

How did we let the internet become this awful?

While I appreciate the intent of this and other "chaff" tools, I can't help but think ten years from now I'll be seated under a single 200W light bulb hanging from a string while some federal official with 100,000 printed out pages of logs sneers at me saying "and then on December 10th of 2023 you visited www.elderlydogswhosquirt.com. You disgust me." And then I try to explain how it was the bots in my computer, not me. The bots I tell ya!

If you're worried about getting in trouble for some HTTPS or DNS traffic then why would you trust this? Someone snooping on your traffic could see you generating traffic that looks incriminating.

If you're not worried about getting in trouble for some HTTPS or DNS traffic then why would you use this?

In short I don't understand the use case for this script. Anyone analyzing your traffic looking for specific DNS requests or specific SNIs will still see them.

Keep in mind that the data is still there, and motivated people will figure out the noise from the signal.

Use dnscrypt: https://dnscrypt.info/ which has an easy macOS integration too.

this kills my caching, but I'd love to integrate this in dnsmasq. right now I'm running a patched dnsmasq¹ that can handle blocking urls based on regex (e.g. kill anything with unicode in addition to whatever I have in my SteveBlack's /etc/hosts blocklist²). So having noise generation in dnsmasq which is ignored by caching would be an ideal solution for me.

__

¹https://github.com/lixingcong/dnsmasq-regex

²https://github.com/StevenBlack/hosts

Is this intended to be a solution for people who are unable to do DNS-over-TLS (which seems like a much better solution to this problem).

Really ought to just use coreDNS as a local stub resolver and point it at cloudfare's TLS enabled DNS resolvers. That's what I do.

A good way to be blacklisted.

Security^W Privacy through obscurity. Not bulletproof but better than nothing.

Can't fail to remember the same trick used by megacorps outside Internet. Once Coca-Cola wanted to be certified as kosher. It of course did not want to uncover its secret recipe. They knew though that a mix of plant-based components is normally considered kosher is each component is also kosher. So they presented a huge list of such components and claimed that all components of Coca-Cola are listed there, among other, unrelated components. The list was considered kosher, and thus Coca-Cola the drink, too.

The difference is that they only had to do it once to keep their secret. This software needs to do it many times per real request.