Hacker News Reader

Comment by Semaphor | Hacker News Reader

For those wondering: it's DNS blocks, so only affecting those using ISP DNS.

Regardless of censorship, I don't recommend anyone to use ISP DNS servers. They are often slow, flaky and don't respect record TTLs.

Quad 1/8/9 isn't optimal alternative (too much centralization if everyone uses those by default) but running your own is easy.

some ISPs make it difficult to use other DNS servers

There's DNS over HTTPS they can't viably block, so thankfully they get the short end of the stick here.

edit: Thinking of it, anyone knows if it's possible to use that for OS-wide DNS resolves, not just for the browser?

Yes, on both macOS and Windows 11. On Mac you have to create/use a simple .mobileconfig profile. On Windows you have to separately provide both IPv4 and IPv6 addresses.

Or set up a forwarder such as unbound(8) in the LAN and set up the network to use it as the DNS server.

Interesting. UK ISPs have had a similar block/filter list for many years (mostly covering copyright-infringing torrent websites and the like). But it’s more robust than a simple DNS block. A VPN can bypass the block, but changing DNS providers will not.

What / how do they do it then? SNI inspection?

The ISP's blackhole the IP for some blocked domains. So changing your DNS to 8.8.8.8 will resolve the domain, but the IP won't work. A VPN avoids this, since the traffic goes via the VPN IP.

How would that work with cloudflare and similar though?

Cloudflare works with the UK government to facilitate blocks within their infra, I assume in exchange for being allowed to access UK network infrastructure.

In the case that a blocked site resolved to a Cloudflare IP, it would likely be kicked off of Cloudflare, or geo-blocked for UK users (by Cloudflare).

https://www.ispreview.co.uk/index.php/2025/07/cloudflare-blo...

Ironically that url is forbidden for me, I was under the impression that CF were fairly anti censorship, or at least they inferred that they should not be the one calling the shots (in reference to kiwifarms)

Wow that’s intense.

I remember hearing someone complain on HN of their site getting blocked because it shared an IP with an illegal soccer livestream. I can’t imagine they’re doing this to IP blocks owned by CDNs like Fastly, CloudFlare, or CloudFront though. Or are they? Does this regularly break most of the internet for UK customers?

Spain ISPs block CloudFlare IPs during La Liga matches.

Do you have a source for this claim?

TBH it is not ALL cloudFlare IPs but a significant quantity of sites using and not using CF CDNs. You cannot imagine what a pest that is even for legit users of legit collateral damage pages. CloudFlare is in the courts appealing/countering initial court allowance to blockade and ISPs are bound to comply to blackout requests. You can look at https://hayahora.futbol (traslation: is there soccer match now?) to see affected domains.

https://protonvpn.com/blog/spain-laliga

While I am not some reputable source per-se, I have some tailscale presence over there and can corroborate my exit nodes find cloudflare sites blanket blocked on weekends.

In that case it like someone controlling the DNS records for a banned site could cause some mischief

I've never hit one. Flipping DNS works for (for example) Anna's Archive. Have you got an example?

Transparent DNS proxies on ISP side. Easy thing for them.

DNS over HTTP is a thing also, though.

If this is the case, someone running their own recursive DNS server (like Bind9 or Unbound) can trivially bypass these restrictions. Doing this is a sensible step towards more privacy, regardless of censorship.

They don’t need to run their own DNS server, just configure a DNS server other than the ISP-provided one, like Quad9 or Google.

Using Google - one of the largest data mining companies out there - rather than my trusted ISP doesn’t sound d like a step towards privacy

Maybe this is a good place to ask: what is the easiest way to use my own DNS entirely in user mode (not a server when I can't change which DNS is pointed to, since not an admin), a SOCKSv5 proxy?

It looks like this is possible with Chrome-based browsers using a command line flag (--host-resolver-rules) or in Firefox settings. Is there a better way?

"private DNS". Configure your own (with ad blocking) on nextdns.

If you are on Linux, install unbound and set your DNS server to localhost, done.

Worth mentioning NextDNS and ControlD under this! I migrated from the former to the latter about six months ago, but both are a solid choice.

Free trial then $20USD per year for ControlD. Is that what you use? If so, why do you use this over another service?

Not GP, but I just run my own dns inside the network (unbound on a little openbsd sbc) with a cronjob that pipes oisd.nl into it every night, works great..

Not OP but I also use ControlD. I admittedly like NextDNS interface better, but honestly, I rarely need to login anyways.

So why ControlD? Because I don't want to run my own piHole, basically. They maintain ad block lists that you can edit as you see fit to add things or relax things that may cause issues(which you can't do easily with public ad blocking dns servers).

Why ControlD then and not NextDNS? First, because their support was awesome when I had an issue. AFAICT it was the founder actually emailing me back and forth, and it ended up being my ISP's fault, but I only knew that based on research provided to me by support. Secondly, I got a good deal on a 5-year subscription at one point.

Happy to answer any questions, not affiliated but a fan of the service.

I am curious why SNI-based block isn't used.

Shhh, don’t give them ideas

It won't be relevant in a couple years when 90% of sites will be using ECH, meaning the SNI will be encrypted as well.

Just enabling ECH doesn't stop this, firewalls can see it and mangle the data to force a downgrade because most servers need to support older protocols. It's more accurate to say that once sites only support ECH, then they'll be forced to stop downgrading or deal with angry users.

TLS 1.3, including the ECH extension, does not permit downgrading, unless your implementation is broken.

Trying to downgrade or strip extensions from any TLS 1.3 connection will simply break the connection.

In the wild, that's not true at all[0][1]. The corporate firewall at my employer actually wasn't able to block ECH until they updated it then it was able to block sites as usual.

0: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Ho...

1: https://docs.broadcom.com/doc/symantec-ech-whitepaper (see page 8)

This is literally impossible. What your corp fw likely does is mitm outer SNI because your IT department installed your company CA in every client's trust store. So unless you do that at national level your only other option is to block ECH entirely.

Edit: actually totally possible but you need build quantum computer with sufficient cubits first =)

Last I heard, the QCbros were still trying to find the prime factors of 15.

(I remember using quantum algorithms to find prime factors 25 years or more ago, using the Quantum::Suppositions Perl module.)

I ready the FortiGate link and this is the gist:

  The DNS filter setting on the FortiGate analyzes the DoH traffic and strips out the ECH parameters sent by the DNS server in the DoH response. If the client does not receive those parameters, it cannot encrypt the inner SNI, so it will send it in clear text.

So basically they mess with DoH ECH config and trigger fallback behavior in the clients. I don't think any browsers do this yet but I think this loophole is not gonna last.

I'm surprised that works. Doesn't TLS1.3 do the thing where it crosschecks (a hash of) the setup parameters after key-agreement to protect against exactly this kind of downgrade attack?

(My phone screen is too small to look through the RFCs right now.)

I think what you're describing is TLS1.3 Finished verification so that happens after DoH response during the actual handshake. Basically this works because ECH is fairly new and there's no HSTS-style "always use ECH for this site" configuration yet. And ofc this only works if you configured FortiGate as your DNS (corp network) or if it's doing MITM (though I'd expect browser would verify cert fingerprint for DoH connections as well).

Is there even a push for ECH? I don’t imagine big tech and other powerful players particularly want it.

Cloudflare and all the major browsers have supported it for a couple years now.

Computers have supported dnssec for years and it’s barely in use. Support != a push for.

As a reward for freeing yourself from the de facto government DNS, you will now be gifted free movies for eternity

Reply on news.ycombinator.com