Hacker News Reader

Comment by defrost | Hacker News Reader

While the DNS Privacy Project has a good many suggestions and links it might be time to upgade their "stubby" project.

stubby is a localhost DNS proxy that can work for any app | browser | etc. on a network and use DoT or DoH to any of the common providers.

Given the ease with which national ISPs can MiTM these | intercept calls to Cloudflare | Quad9 | AdGuard etc. it might be good to extend either stubby or it's docs to let people know how to use it access | establish a much broader DNS proxy network to allow for indirect non obvious lookups.

View on HN

Off-topic: Why are you using | instead of / ?

People having their unique implementation of punctuation marks irks me...

At a guess, because regex and/or coding generally. In a number of regex implementations and programming languages, | is used as an inclusive OR

Because I've used it as an "or" symbol in a non unique common as muck manner since 1980 at least when I was taught Boolean logic in an undergraduate university mathematics class.

It's one of many conventional symbols for OR, more common in the pure ASCII days due to a lack of ∧ , ∨ , ¬ et al.

Which rock have you lived under that you've never seen it used an OR before?

People imposing their limited experience of the wide world upon others would certainly irk some, but rest easy, I've not taken offence at your odd assumption of non existent universal convention.

This comment reeks of /r/iamverysmart.

> that can work for any app | browser | etc. on a network

That is an English clause, not a mathematical expression. You even have the abbreviated form of et cetera there.

> non existent universal convention

In English there is a convention for listing alternatives: commonly forward-slashes with no space between them, like 'this/that', or with commas and conjunctions, like 'this, or that'. Or make your life easy, and use some other collective noun such as 'platforms'.

> a lack of ∧ , ∨ , ¬ et al.

English convention dictates 'et al' (or et alia) be used to list authors or people, rather than inanimate objects. Or you could use a collective noun here, too: 'mathematical symbols'.

It'd make sense if you were writing out some Boolean expressions or trying to present something with formal logic. But you're writing English here so it seems inappropriate to a) ditch conventional grammar and b) pass off the criticism as "imposing their limited experience".

[flagged]

To be fair, I've never seen it used in prose like that, and had trouble understanding your comment at first. I did university boolean logic 30 years ago and have been on the internet in programming communities nearly as long.

Sure, different groups have different conventions. I've been commenting on internet forums, threads, and groups since pre WWW Usenet, using | as OR (though more often as { A | B | C }, seen others use the same convention and this is the very first time anyone has ever claimed it as a unique quirk.

With braces or brackets it would have been immediately clear; I have seen that version.

I appreciate | as OR because (like its non-ascii cousin ∨) it uses an lr-symmetric glyph to denote a commutative operation.

EDIT: Backus uses the asymmetric overbarred "or" in 1959, but by 1963 the | we know and love has already taken its place (that ASCII standardisation didn't start until 1961 may have something to do with this?)

https://www.softwarepreservation.org/projects/ALGOL/paper/Ba...

https://dl.acm.org/doi/pdf/10.1145/366193.366201

Consider this the second time. ¿English motherfucker, do you write it?

Knowing it is intended as OR, i can parse it better. I figured it was some item-in-set notation. I also have never seen pipe as an OR outside programming and math.

Some non-alphanumeric characters add brevity and have been more or less adopted by the mainstream, such as ~ being more ergonomic than approximately or approx. Comma, slash, semicolon; these are the ORs of written English and are already the minimal characters count.

I mildly like pipe as you use it but feel it is more confusing and distracting than anything else. A comma or slash would have not interrupted the reading of the sentence. Optimizing for the reader rather than the writer seems a good default position.

Edit: you replied elsewhere using pipe with parentheses or curly braces; very, very clear in those cases. Had you used that in your original, I would have had no confusion

There is a lot of confusion in this thread and in a separate thread discussing the Malaysian DNS redirect legislation where people confound privacy with resistance to censorship. Whilst both do possess a certain degree of overlap, resistance to censorship requires a fundamentally different approach that does not fit within constraints of the DNS framework.

DNS has a decentralised architecture designed to be resilient to failures.

DoT, DoH and similar address the privacy aspect of the unencrypted by default DNS traffic.

None of the existing DNS, DNS extensions, DoT, DoH can circumvent serious censorship attempts at scale due to name resolution requests being encapsulated in an IP packet that exposes enough metadata that (destination address and port number) to allow the packet to be altered, redirected, dropped or blackholed even if the packet is encrypted or obfuscated. Traffic bound to a specific IP address or to a specific TCP or UDP port is the easiest to curb, it does not even require the manual intervention and is widely used by intrusion detection systems to automatically block the detected in real time malicious traffic.

The censorship resistance requires a complete replacement of DNS that would be akin to the GNU Naming System[0], which fulfils all three objectives: it is a decentralised, privacy-preserving, censorship-resistant domain name resolution protocol.

Having gone through https://dnsprivacy.org/ (which is very disorganised, to be fair), I fail to see how stubby could be of any help due to still requiring a upstream DNS server of sorts somewhere, which will be blocked if not automatically then very quickly albeit manually anyway.

[0] https://datatracker.ietf.org/doc/html/rfc9498

> which is very disorganised, to be fair

> I fail to see how stubby could be of any help

I agree fully with the first, partially agree with the second; the DNSPrivacy site needs an overhaul and seems a few years out of date but it does cover most of the privacy related lurks.

As you said the "stubby" | "getdns" module is good enough for privacy, it's no more than a local service shim layer between anything local requiring DNS via a variety of means, all of which can be censored.

I did suggest it could use extension .. and a network of distributed peers to extend to.

It's a project for anyone minded to take it up .. create a secure obfuscated distributed stubby net that can try DoT DoH etc in situ and should they work provide that service to others else fallover to reaching out to others to find peers that can access authorised DNS.

The Windows Portmaster project is an interesting one; it provides a level of network inspection and control to advanced regular users, stubby-like getdns functionality that's a bit easier to use, and offers a VPN layer to subscribers for data.

If the Portmaster maintainers are true to their vision I can see them adding obfuscated distributed DNS to subscribers in the near to mid future depending how they allocate resources and who they onboard now they have funds for a new hire (last I checked, I could be out of date here).

Reply on news.ycombinator.com