Hacker News Reader

Comment by CharlesW | Hacker News Reader

Yes, or — if you're lazy like I am, and don't want to manage another device or container — use something like NextDNS, which has a very generous free plan and an extremely inexpensive yearly plan. Control D is a popular alternative with similar plans.

In the last 3 months, NextDNS has blocked nearly 9% of 10M DNS queries from devices in my household with no ill effects that I'm aware of. (I'm not affiliated with NextDNS in any way, other than as a satisfied paying customer.)

View on HN

Tailscale + NextDNS is a dream. One simple app to get me back to my self hosted services and block ads.

https://tailscale.com/kb/1218/nextdns

Not only can Tailscale directly integrate with NextDNS and therefore not require extra configuration on-device for DNS, but you can use Tailscale ACLs to assign different NextDNS profiles to different devices (for example, a parental control profile to a kid's device or an Apple TV, or an IoT profile, etc)

I did not understand the use case here. Could you please explain further?

I have been using NextDNS for many years now, but I didn't get why I should use Tailscale.

It’s also easy to use Pi-hole with NextDNS as the upstream server using cloudflared as the DNS-over-HTTPS tool[1] to connect to NextDNS in a secure manner

[1]: https://docs.pi-hole.net/guides/dns/cloudflared/

They are a US based company, whether they say they log your data or not, they can be compelled to log your requests and not tell you about it.

Regardless they look like good alternative for users who are unable to setup or are prevented from using a pihole.

> They are a US based company, whether they say they log your data or not, they can be compelled to log your requests and not tell you about it.

If someone wanted your internet traffic, they wouldn't bother with NextDNS. They would just compel your internet provider to give it to them.

This is not a real risk to using NextDNS.

The good ol’ everyone on the Internet is American fallacy.

The good ol' media talks about it happening in America so it must only happen in America fallacy. ISPs can be compelled to divulge data in most places around the world.

This thread is specially about the USA so I didn’t feel the need to clarify that I’m obviously only talking about the USA.

The article isn’t specifically about the USA (the word “American” appeared once in “American English” when explaining the name Pi-hole). The CharlesW comment doesn’t mention the USA. The nik282000 comment says NextDNS is a U.S. company so U.S. government will have access to the data, it never said it’s only a concern for American users. I don’t know where you got the idea that this thread is specially about the USA. In fact, I assume the nik282000 comment is mostly for non-American users.

This thread is about the dangers of using a US-based service provider. People outside the US can use it.

I mean in theory this is absolutely correct and everyone everywhere will follow due process and the data will only become available at the individual level when a court affirms it is appropriate.

As long as due process and checks and balances are respected, there's absolutely nothing to worry about lmfao.

I think you missed my point. Your ISP already has your traffic, and is just as easy to compel as NextDNS. No one is going to NextDNS for your traffic, and even if they do, NextDNS doesn't have any information your ISP doesn't already have.

> They are a US based company, whether they say they log your data or not, they can be compelled to log your requests and not tell you about it.

NextDNS lets you choose where to store your logs, along with a retention time of 1 hour to 2 years. Logging can also be completely disabled.

The choices for log storage are (1) United States, (2) European Union, and (3) Switzerland.

Lets say you have internet from comcast or your phone company in the us, aren't they able to be compelled to log your requests in the same way? Is there any internet access where you have actual privacy? I think not unless you vpn somewhere, and then that other company could be doing it.

But I'd love to hear your ideas.

You can use an encrypted upstream DNS

NextDNS's price of $20/year (or something like that) is the easiest purchase I've ever made.

I still use uBlock origin, but like how NextDNS will block stuff from phones and other devices as well.

Paying does not solve the online ads problem, it only adds to it by creating a market for companies that can profit from online ads while collecting even more data from internet users. DNS query data is probably as close to www browsing history as one can get.

These companies can easily be acquired by Big Tech. Nothing stops them from selling out and selling their customers out. This is a win for the DNS provider, a win for Big Tech and a loss for the internet user.

Google already collects fees from some people who are willing to pay in return for "no ads"; meanwhile Google still collects data on these people; it may be used to support ads shown elsewhere or for any purpose whatsoever. Paying does not stop the online ads problem. If anything it makes online ads even more attractive; they can be used to annoy people into paying fees. Some people will actually pay to have their data collected by an advertising company.

As far as I know, please correct if wrong,, Pi Hole is 100% non-commercial. It is basically a modified dnsmasq with default settings that forward queries to third party DNS providers that profit from ad services, like Google. If online advertising were to decrease or disappear, then Pi Hole is not threatened. Whereas a third party DNS service like NextDNS has a financial incentive to ensure that the online ads problem persists, as it creates their "market". The disapperance of online ads, for whatever reason, would be catastrophic for NextDNS.

I am not a Pi Hole user as I do nmot like dnsmasq. I use other DNS software and map DNS data collected in bulk from variety of sources into local forward proxy memory.

Been using nextdns on both droid and linux and am really grateful for it. Coupled with ublock, I can browse the tubes without having a seizure. I'm so satisfied with it, that I fear someone will come along and prick me happy bubble, explaining why it's bad. But I might just look away.

Nextdns is great

Do you mean 90%?

9% is reasonable. I've got pretty strict filters on my home DNS and it's currently blocking 12%. I imagine that number would be much higher if I didn't have ad block extensions on all my browsers and IoT devices on a restricted VLAN.

Nope! NextDNS blocked 913,294 of 10,287,370 queries over the last 3 months. I'm sure the percentage would rise if I flipped on other options that they provide ("AI-Driven Threat Detection", "Block Newly Registered Domains", etc.), and I should probably revisit those.

Wow! I'm more intrigued by the fact that you did 10M queries in 3 months. I'm going to assume you're using a single profile for everything. I have separated machines/robots (that includes the TV), kids, and other profiles for business devices.

That's a steller idea, thanks for mentioning it! I didn't realize that different profiles assign unique DNS servers, allowing me to partition off devices that don't support DNS-over-TLS/DNS-over-HTTPS/IPv6. I don't think it'd affect total queries, but tighter rules for machines/robots, etc. should increase the percentage of blocked requests.

Reply on news.ycombinator.com