Hacker News Reader

Comment by wang_li | Hacker News Reader

> read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example,

Don't worry. All the browsers and stuff are bypassing this level of control by moving to DNS-over-HTTPS. You'll either have to deploy a TLS terminating proxy on your network, or give up on this arms race.

View on HN

Would certificate pinning also remove the first option? I wonder if we are moving to a system where inspecting your own traffic isn't a viable option anymore, am I missing a workaround?

If you control the machine you can always defeat pinning, given enough effort. But for an IoT device, yeah, we're already there.

To be fair, if you are geeky enough to run a PiHole you will have no trouble finding the config option to turn off DoH in your browser.

True, but I want all the devices on my home network to have DoH disabled too. Most of them I can't change directly.

Don't turn it off in your browser. If you have control of that setting just install an ad blocker. The point of DNS block lists is to get rid of ads on phones, TVs, and other non configurable things.

And then there is amazon sidewalk, which can only be evaded by unplugging the wifi board on your tv

Except, now you don't really control your web browser either, and ad blockers are getting crippled. It is an uphill battle.

AdBlockers are not crippled on Firefox

>Don't turn it off in your browser. If you have control of that setting just install an ad blocker. The point of DNS block lists is to get rid of ads on phones, TVs, and other non configurable things.

Yes, and...It's not just to block ads. It's also to block various trackers and unwanted/surreptitious "telemetry" and "updates" to those devices you can't control/configure.

The arms race will continue. I think the next gen will be a self hosted archive.ph style host that lets all the garbage load and distills it into a PDF or Web 1.0 style file ready for consumption. I would be fine with a browser extension that learns what I watch the most and preloads it for me, and/or an on demand service that shares prerendered sites bundled into torrents that group together common interests.

Edit: as much as I dislike AI, I concede it would be lovely to tell it to replace all ads with pictures of flowers.

That's what The Internet Junkbusters Proxy / Privoxy excelled so good at.

Yeah DoH was a solution to a really niche US-only problem where their laws provided the ability for providers to sell their users' DNS logs. In normal countries with privacy protections this isn't a thing anyway.

In this model, DoH is only a bad thing because it evades local DNS control.

I know that apps can always roll their own or even hardcode servers, but I hate the way that DoH was seen as some kind of saviour even though it adds zero benefit to European users and only adds negatives.

Your comment makes no sense. The DoH providers can still log requests and sell them.

DoH protects against intermediaries spying on your requests and potentially forging responses. Exactly the same as HTTPS.

Sending anything in clear text over the internet in 2025 is criminally negligent.

HTTPS is not necessary to encrypt DNS traffic. DNS-over-TLS exists, but it has much less traction compared to DNS-over-HTTPS. I am guessing the reason is that HTTPS traffic all goes through port 443, so "censorship" of DNS becomes tricky, since DNS traffic becomes a bit harder to distinguish from ordinary web traffic.

Encapsulating DNS packets in HTTP payloads still feels a bit strange to me. Reminds me a bit of DOCSIS, which encapsulates ethernet frames in MPEG-2 Transport Stream packets (this is not a joke).

Everything other than 80 and 443 is blocked by default, anything-over-https is just a matter of time. With a properly configured TLS MITM proxy only certificate pinning will prevent snooping, but it’ll also prevent connectivity, so you might call it a win for security/privacy, or a loss for the open internet if it’s you who needs to VPN to a safe network from within such an environment…

A port number does not force a certain protocol. You can run everything you want over port 443.

And yeah I also think it's a really bad idea to run everything over https. But I don't think it'll happen.

You can. The client side enterprise proxy/firewall really doesn’t want you to, though. Just a fact of life.

Yeah I wasn't really thinking of enterprise in this whole discussion though. After all, it's about pi-hole.

Yes but in the US the ISPs are the intermediary. And the big DoH providers like Cloudflare have better privacy protection.

Here the ISPs are intermediairs too, but we have laws to prevent them from using our data using DPI etc. And even if you use their DNS.

I agree encryption is important but DoT is much better then. DoH mainly took off because of this in the US.

Jokes on you, I do have a fortinet which does this.... Oh wait, only up to TLS 1.1 or something and it's slow.

I forgot the name of the software but there used to be a few tools to terminate and reencrypt. But yeah dnssec is it's own challenge

You need to get an F5 box instead. :)

Reply on news.ycombinator.com