HNHacker News
TopNewBestAskShowJobs

bwoodcock

112 karma · joined August 4, 2016

[ my public key: https://keybase.io/woody; my proof: https://keybase.io/woody/sigs/qGrdT8dfApwkRvBGFgFduTgmjPb5uNc4uMtB-woJUlY ]
submissionscomments
bwoodcock··on DNS over TLS – Thoughts and Implementation
Again, if that's the case, you should open a trouble ticket, so the problem can be fixed. It won't get fixed if there isn't a work ticket and nobody knows where your traffic is coming from or going to.
bwoodcock··on DNS over TLS – Thoughts and Implementation
Did you open a ticket? What AS and city are you originating from, and which Quad9 location were your queries going to?
bwoodcock··on DNS Performance compared: CloudFlare 1.1.1.1 x Google 8.8.8.8 x Quad9 x OpenDNS
One of the issues is that many ISPs don't actually run their own recursive DNS servers... They outsource to companies which provide a "monetized solution," operating the recursive resolvers and paying the ISP in exchange for the customers' data, which they sell. This will become an illicit activity shortly in Europe, as the GDPR comes into effect, but there are many ISPs that have become very used to receiving those payments. And most of them already don't admit to selling their customers' privacy.

So privacy is why many of the people who use a different recursive nameserver are doing so... In order for that to work, you need to use one of the ones which support link-level encryption, like Quad9 (DNS-over-TLS) or OpenDNS (DNScrypt). Other reasons are performance (which at least in Quad9's case should be no worse than your ISP for real-world queries, since it's back-to-back with many of the authoritative servers already, and all of them will give you a large pool of other users sharing the same cache, which helps performance immensely), and security... Going back-to-back with the authoritative servers also collapses the attack surface between them, minimizing the possibility for MITM attacks between the recursive and authoritative servers.

bwoodcock··on Verizon: We Can't Become Dumb Pipes
We (PCH) committed to performing that study every five years, and we're beginning the process again now, for a 2016 edition. Expect results in six to eight months. Based on what I've seen of the industry in the past five years, I'm guessing there won't be any huge change since the last one.

           -Bill
← PreviousPage 3 of 3