5 ms·

Just a quick note for the unsuspecting: I run two local DNSes, one recursive and one forwarding. The forwarding one uses few services, like 1.1.1.1, 8.8.8.8, 9.

by Habgdnv 12d ago

Just a quick note for the unsuspecting: I run two local DNSes, one recursive and one forwarding. The forwarding one uses few services, like 1.1.1.1, 8.8.8.8, 9.9.9.9, etc. One day I noticed inconsistent responses and started investigating. Turns out that by default 9.9.9.9 have "protection" and for your safety will lie and return NXDOMAIN or something else, for some dangerous domains, taking into account their definition of "dangerous". I am not saying that this is bad, probably lots of non-HN people don't want to run their DNS or anything related and just want a tablet that works because they don't even have laptop. It just hit me hard because I did not expected filtering on these servers.

LeoPanthera 12d ago
You can use 9.9.9.10, which is unfiltered, or 9.9.9.12, which is unfiltered and passes ECS.
rdevilla 12d ago
[dead]
drewfax 12d ago
That is the point and business of Quad9. It's not their fault for you not knowing what Quad9 is. I don't want my family to get malware from sketchy websites. Quad9 offers a simple solution for these usecases. I'll take the false positive anyday over unfiltered DNS.
- yunaflox 9d ago
  Not really. Quad9 also provides an unfiltered version of itself, which I'm currently using. Cloudflare I believe has the same option too.
TacticalCoder 12d ago
Instead of CloudFlare's 1.1.1.1 I like CloudFlare's 1.1.1.3: it filters known porn and known malware sites. By now I expect many sites to be filtered out: too much crap out there. Then I also run my own DNS (unbound) and after seeing a warning from one of my banks about a phishing site where one letter differed in the domain name from the real bank's site, I went ballistic: I did generate hundreds of thousands (maybe millions by now) of variations of the names of banks/brokers domains I use, with every single variation of one character and many variations of up to two characters and I nullroute those too (in addition to known porn and known malware sites). And I nullroute every single Unicode domain name. I don't care. I don't care if you disagree with this: too many homoglyph attacks. Too risky. And the Web Just Works [TM] without accessing any Unicode domain. I null route tens if not hundreds of TLDs. Filtering out every single domain name using any Unicode char is a bit more involved but it's doable (I do it since years, but today you can ask LLMs if you want to do it or patch a DNS software to do it). I know some go further and by default disallow everything and then only allow domains they want to use but I find that a bit too tricky. Now... Should there be something I really want, say I want a shady torrent tracker to download some dubious file, I can always use a VM/container with a more lenient DNS. I'm using such a setup since years. My unbound DNS runs on a Pi 3 that's on 24/7. Works flawlessly. P.S: on another subject I also blocklist entire IP blocks, including entire countries. Same thing: the Web still works totally fine.
- snapplebobapple 12d ago
  I ended up getting rid of unbound, stubby, and a technitium instance and just moving to numa.rs everywhere i needed dns. It simplified my life a lot. Now laptops run it with forward*ng that makes sense for their use case (ie home dns to my home dns vms running numa, work dns forwarded to work dns servers, everything else was recursive resolving but i swi5ched it to their odoh and it worked great while probably being more private
- greggsy 11d ago
  >works flawlessly. Obviously. You’re continually tinkering with it. The vast majority of people do not share the same hobby of troubleshooting and tweaking home DNS of all things.
- spl757 10d ago
  To be thorough, you should check your domain names for any characters that can be changed by a single bit flip. It probably will not look right as far as spelling, but the idea is that eventually something like a cosmic ray will pass through a memory chip and flip that single bit for a connection, and they get redirected to another site set up to handle the request. It's a thing. It takes patience, but but does work. People were doing this to fbcdn.com and other large targets years back.

by Habgdnv 12d ago

LeoPanthera 12d ago

You can use 9.9.9.10, which is unfiltered, or 9.9.9.12, which is unfiltered and passes ECS.

rdevilla 12d ago

[dead]

drewfax 12d ago

That is the point and business of Quad9. It's not their fault for you not knowing what Quad9 is. I don't want my family to get malware from sketchy websites. Quad9 offers a simple solution for these usecases. I'll take the false positive anyday over unfiltered DNS.

yunaflox 9d ago
Not really. Quad9 also provides an unfiltered version of itself, which I'm currently using. Cloudflare I believe has the same option too.

TacticalCoder 12d ago

Instead of CloudFlare's 1.1.1.1 I like CloudFlare's 1.1.1.3: it filters known porn and known malware sites. By now I expect many sites to be filtered out: too much crap out there. Then I also run my own DNS (unbound) and after seeing a warning from one of my banks about a phishing site where one letter differed in the domain name from the real bank's site, I went ballistic: I did generate hundreds of thousands (maybe millions by now) of variations of the names of banks/brokers domains I use, with every single variation of one character and many variations of up to two characters and I nullroute those too (in addition to known porn and known malware sites). And I nullroute every single Unicode domain name. I don't care. I don't care if you disagree with this: too many homoglyph attacks. Too risky. And the Web Just Works [TM] without accessing any Unicode domain. I null route tens if not hundreds of TLDs. Filtering out every single domain name using any Unicode char is a bit more involved but it's doable (I do it since years, but today you can ask LLMs if you want to do it or patch a DNS software to do it). I know some go further and by default disallow everything and then only allow domains they want to use but I find that a bit too tricky. Now... Should there be something I really want, say I want a shady torrent tracker to download some dubious file, I can always use a VM/container with a more lenient DNS. I'm using such a setup since years. My unbound DNS runs on a Pi 3 that's on 24/7. Works flawlessly. P.S: on another subject I also blocklist entire IP blocks, including entire countries. Same thing: the Web still works totally fine.

snapplebobapple 12d ago
I ended up getting rid of unbound, stubby, and a technitium instance and just moving to numa.rs everywhere i needed dns. It simplified my life a lot. Now laptops run it with forward*ng that makes sense for their use case (ie home dns to my home dns vms running numa, work dns forwarded to work dns servers, everything else was recursive resolving but i swi5ched it to their odoh and it worked great while probably being more private
greggsy 11d ago
>works flawlessly. Obviously. You’re continually tinkering with it. The vast majority of people do not share the same hobby of troubleshooting and tweaking home DNS of all things.
spl757 10d ago
To be thorough, you should check your domain names for any characters that can be changed by a single bit flip. It probably will not look right as far as spelling, but the idea is that eventually something like a cosmic ray will pass through a memory chip and flip that single bit for a connection, and they get redirected to another site set up to handle the request. It's a thing. It takes patience, but but does work. People were doing this to fbcdn.com and other large targets years back.