Hacker News Reader

Comment by shawnz | Hacker News Reader

> DNS is one important control planes in a network. It essentially allows network administrators to block content based on domain names making it quite useful tool in the arsenal. It is being widely used to provide content filtering services, parental controls, and to block known malware command and control. Its so popular that a lot of people install a locally running DNS server on their home networks to block Internet Ads using block lists.

This is a totally wrong usage of DNS and I wish we would focus more effort into making IP-based blocking easy and accessible rather than wasting time trying to make DNS fit this niche. DNS is not the right tool for this job and maintaining this functionality is not a valid reason to block progress on more private technologies like DoH. And it's totally possible to run a PiHole-style system using DoH anyway.

View on HN

I'm not convinced IP-based blocking can be more effective than DNS blocking. Very often many different sites are hosted on one IP address (e.g. a CDN in the 'worst' case), and IP blocking would mean lots of things become inaccessible.

Users access services by DNS name, so if you want to control access it has to be at that level. Whether DNS can be effectively blocked while maintaining privacy is another issue, but I can't see IP-based blocking helping here.

I agree, CF allows porn and blocking every Cloudflare site isn't a viable course of action for most people. Governments like UK that mandate restricting access shouldn't be doing it for you by DPI'ing DNS.

Instead, any blocking needs to be done on the device, whether it be MDM for any business-related blocking or via Parental Controls/Restrictions for blocking porn.

In my opinion, both DNS- and IP-based blocking are a hack because they fundamentally have to work based on limited information. After all, ad services could pretty easily start doing any of the following:

- proxying ad requests through the server of the website you're visiting;

- accessing ads by IP address directly; or

- using randomly generated domain names.

With a browser-based ad blocker, those measures would still be an obstacle, but at least you'd have a chance - you could switch to more heuristic ways of detecting ads based on, say, the scripts involved, or the content of the media being downloaded, or its size and placement on the page. None of that information is available to network-based blockers, at least not when HTTPS is in use.

Admittedly, those things probably won't happen anytime soon, at least not for regular website ads. (Though as one example, Twitch has already started using fairly sophisticated measures to bypass ad blockers for their video ads...) But I'm an idealist, and I like to fight on favorable territory. When it comes to cat and mouse games, I don't want to be the mouse.

IP blocking (or whitelisting) is useless when your target lives in the cloud. Many CDNs have a massive pool of IPs which change rapidly. Autoscaling systems have TTLs as low as 60 seconds. Not only will you fail to block (or allow) requests, but you will also block (or allow) requests to completely different organizations on the same multi-tenant cloud environment.

Same can be said about IP-based blocking that firewalls employ. IP-based blocking can also be bypassed by using various tunneling techniques but that does not make it useless. Having DNS based control in addition to IP-based control is much useful for most scenarios.

Reply on news.ycombinator.com