Comment by ignoramous | Hacker News Reader

Comment by ignoramous | Hacker News Reader

Nice. DNS has grown notoriously complex over the years and it is hard work to run a standards compliant service. Congratulations.

A few suggestions:

- Auto-detect OS and suggest specific setup instructions right on the landing page?

- The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that?

- simplednscrypt has been handy for me to DoT/DoH/DNSCrypt with AdGuard DNS on PC. You could include instructions in the Windows section for that? https://dnscrypt.info/implementations/

- Provide a generic DNS endpoint like AdGuard does?

A few questions:

- What's the backend that fronts DoH, DoT, and DNSCrypt queries? Is it simply relayed to Cloudflare underneath the covers? How do you do that?

- Re: Privacy Policy: "We store user data following modern security standards". What user data is stored using what modern standards? I like the terse policy document, but I feel there needs to be a fine print detailing data collection and data retention. Examples: https://s3.amazonaws.com/lantern/LanternPrivacyPolicy.pdf and https://info.ecosia.org/privacy

Thanks.

Thanks!

> Auto-detect OS and suggest specific setup instructions right on the landing page?

It should already pre-select your OS tab on my.nextdns.io on the Setup page? If that's not the case, then it's probably a bug.

> The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that?

Weird, we will have a look.

> simplednscrypt has been handy for me to DoT/DoH/DNSCrypt with AdGuard DNS on PC. You could include instructions in the Windows section for that? https://dnscrypt.info/implementations/

You can use your custom sdns:// endpoint listed on the Setup page, we assumed users using dnscrypt clients would know what this means. Good point, we will add setup instructions for it.

> Provide a generic DNS endpoint like AdGuard does?

We already have them, we decided to not show them on the website as it may confuse users. We may add them back.

> What's the backend that fronts DoH, DoT, and DNSCrypt queries? Is it simply relayed to Cloudflare underneath the covers? How do you do that?

It's a custom-made backend, and we recurse using unbound (we don't forward to cloudflare or anything like that).

> Re: Privacy Policy: "We store user data following modern security standards". What user data is stored using what modern standards? I like the terse policy document, but I feel there needs to be a fine print detailing data collection and data retention.

We will definitely improve that, we had to make some calls on priorities for the launch.

Minor nitpick, but > is universally used to indicate quoted text, and you've reversed the meaning here.

Edited, thanks!

The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that?

Weird, we will have a look.

For those that block JavaScript by default, it would also be nice to get something more than You need to enable JavaScript to run this app. on the main page. At least a short blurb what this is.

(Since the most recent batch of CPU vulnerabilities, I have decided to use uMatrix to block anything but CSS by default.)

> Weird, we will have a look.

What's "weird" is that someone thought to mandate third-party map and chat javascript widgets on what should have been a simple page explaining what the combination of Cloudflare and PiHole is.

It detects my FreeBSD machine as windows.

> Nice. DNS has grown notoriously complex over the years and it is hard work to run a standards compliant service. Congratulations.

Running your own private recursive resolver is very easy.

Edit: I believe people are confusing running a DNS nameserver with running a DNS resolver. The former might be hard, the latter is very easy.

No. Its not. You need to buy hardware, set it up and later constantly maintain it. It requires technical knowledge, willingness to do it and, above all, free time. While initial investment may seem trivial, on the long run it's not. People very often tend to forget that own solutions are not set up and forget. This is why cloud services are a thing in a first place.

You can absolutely just run a recursive resolver on your laptop use that resolver in every[+] network. There is literally nothing special about a recursive resolver except it doing some legwork that a stub resolver / filter resolver (like glibc or dnsmasq) doesn't do.

If you run e.g. Linux or BSD, you'd just install knot-resolver, enable the service and put "127.0.0.1" in your /etc/resolv.conf. That's it.

Similarly if you run something like pihole it is very easy to have it run a recursive resolver as well, I bet pihole has a page on how to set that up, and I doubt it is hard in any way.

If, of course, all you have now is a router provided by your ISP and you want to run your own intranet DNS resolver, then, yeah, you'll probably need some hardware for that. Obviously.

[+] some networks hijack outgoing DNS.

Debian 10 Buster already install Stubby DNS by default as your caching DNS server.

Stubby is, as the name implies, not a recursive resolver. It's a DoT stub resolver.

Reply on news.ycombinator.com