Hacker News Reader

There are only like 3 major ones. You can block those IPs too.

There's a ton of minor ones, it's easy to spin up your own, and the hope is that eventually, with ECH, it won't be possible to block them without blocking basically the entire Internet like North Korea does.

By the time you're spinning up your own there isn't any issue. The controversy is that they're switching everyone to Cloudflare by default.

What do you propose they do instead? They obviously can't trust the network-provided one, since the whole point is that that one is often malicious.

Malicious DNS in terms of returning bad results is generally irrelevant because if you can't trust the network then returning the wrong IP address and routing the right IP address to the wrong server are the same. Also, you're using HTTPS/TLS/SSH/etc. on the actual connection anyway, right?

So the point of this is to prevent Comcast from seeing your DNS queries. And then it works fine to trust the network to say "no, really, use this one and not the default DoH one" as long as that setting is one that Comcast would get in trouble for misusing. Notice that they don't return bad results for use-application-dns.net as it is.

Reply on news.ycombinator.com