> but at the DNS level
Isn't this a bit like taking the phone numbers out of the phone book? Sure, people can't easily look them up, but if you know the right numbers, you don't need that.
Or is there more than that?
Isn't this a bit like taking the phone numbers out of the phone book? Sure, people can't easily look them up, but if you know the right numbers, you don't need that.
Or is there more than that?
Source: I have been worked for an ISP and I was in charge of that.
Is this done simply by intercepting UDP port 53 requests somehow? I've only ever had to intercept https as part of development, but have no idea how this would work for UDP. Any details you can share?
Naturally, a lot of HNers hate encrypted DoH which solves both the active MITM and passive monitoring problems. Example: https://news.ycombinator.com/item?id=25344358
I’ve worked for several who didn’t. Of course all have the ability to do just that so as a user you can’t tell. If you’re in the EU they can’t sell that data at least.
To make matters worse, they engage in gratuitous blocking; for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...). For example, 192.168.1.1.nip.io won't resolve on my mom's network, but will almost everywhere else.
The solution, as another poster pointed out, was to use DNS-over-TLS.
That's called "DNS rebinding protection", and it's meant to protect against DNS rebind attacks (https://en.wikipedia.org/wiki/DNS_rebinding).
If it isn't a shared IP, your own browser will block it because of a cert mismatch.
The best way to do this is to update your own /etc/hosts file to point the domain at the correct IP.
https://help.dnsfilter.com/hc/en-us/articles/1500008110182-transparent-proxying
Anyway, other programs on your system may be affected too so addressing the issue at the system level is also important.
the courts order blocks, the ISPs block it at dns because it's cheap and easy and pirates are either scared off by the warning message or just use Google dns
It's good enough and mostly non disruptive