Hacker News Reader

"... where the client relies on a trusted source (their ISP's DNS server..."

Well, for several major ISP's, maybe even most ISP's worldwide, you can't trust them not to use their DNS servers to show you ads or a sponsored "search engine" if you type a domain name that is not registered.

If a user really wanted a "trusted source" for DNS RR's she would be best to contact the appropriate authoritative nameserver directly, not an ISP's resolver.

View on HN

It's true that we still haven't secured the connection between the user and his ISP's DNS server, which I agree is a problem. DNSSEC only helps between the DNS servers themselves.

We are now down to either a) run your own DNS server locally on your machine or b) use a third-party DNS server that we trust.

Personally, I use Thomas' (the person mentioned in the article itself) free, uncensored, DNS service called CensurFriDNS. You can read more about it here: http://censurfridns.dk/

Reply on news.ycombinator.com