rdme

20 ms·

1.
by rdme 12d ago
I'm using numa( https://github.com/razvandimescu/numa ) for ad filtering and odoh mode for privacy (shameless plug)
2.
by rdme 1mo ago
I run a small local resolver (numa, github.com/razvandimescu/numa). When configured on doh or odoh upstream it would protect you from attacks such as this one
3.
by rdme 1mo ago
running my own resolver as system DNS i can confirm apple devices fire _dns.resolver.arpa on every network join, but since verified DDR needs a TLS cert covering the resolver's IP it's effectively public-resolver-only, so for a LA
4.
by rdme 4mo ago
might want to check https://github.com/alexandru/social-publish
5.
by rdme 4mo ago
actually that is exactly how i am currently running it - dogfooding from my Mac sudo numa install handles launchd, numa then becomes tailscale's fallback resolver docker socket service discovery - on the roadmap
6.
by rdme 4mo ago
honestly, nothing major, just deployed the docker-compose to a hetzner $5 instance https://github.com/razvandimescu/numa/tree/main/packaging/re... then submit a pr to Frank https://github
7.
by rdme 4mo ago
sovereign naming without ICANN or registrars - pkarr through DHT (not blockchain)
8.
by rdme 4mo ago
no, you are actually telling the relay where to redirect your question from the start (because you are encrypting the question with the public key of the destination resolver) - the relay sending the question where it wants would result in
9.
by rdme 4mo ago
The relay sees IP + ciphertext, the target sees question + relay's IP. No single party gets both
10.
by rdme 4mo ago
I agree with you, however that's a separate problem that needs to be solved
11.
by rdme 4mo ago
They solve different things. ODoH hides your question, not who you're talking to.
12.
by rdme 4mo ago
The relay is a systemd unit on a VPS, Caddy for TLS, SSRF-hardened (regex-strict hostnames, no IP literals). eTLD+1 same-operator check rejects relay+target run by the same org by default. HPKE is odoh-rs from Cloudflare ``` cargo install n
13.
Show HN: Running the second public ODoH relay(numa.rs)
125 points by rdme 4mo ago|41 comments
14.
by rdme 4mo ago
this must be some a/b testing as i’m not seeing anything different actually it does have a dismissable banner i haven’t even noticed
15.
by rdme 5mo ago
How would this work? One would connect it's repository to a cloud platform that would then act based on the existing daemons of the repo?
16.
by rdme 5mo ago
Just shipped numa v0.13.0: added request hedging (fires a parallel query after 10ms if the primary stalls, inspired by Google's Tail at Scale paper) wire-level cache with serve-stale (RFC 8767) and a DoT client for encrypted upstream.
17.
by rdme 5mo ago
should be fixed by #54 in 0.10.3 thanks again!
18.
by rdme 5mo ago
Thanks for pointing this out! I’ve created https://github.com/razvandimescu/numa/issues/36
19.
by rdme 6mo ago
let me know how it goes
20.
by rdme 6mo ago
Split DNS already works — Numa auto-detects Tailscale forwarding rules from the system config. Queries matching .<ts.net> go to Tailscale’s DNS, everything else goes through Numa If you want to skip Tailscale entirely for home servers
21.
by rdme 6mo ago
This was started as a learning project, went from the start to the lowest level then I've just added features I wanted one by one, it just made the most sense
22.
by rdme 6mo ago
let me know if you do it!
23.
by rdme 6mo ago
Numa can do recursive resolution from root nameservers + DNSSEC, .numa local domains with auto HTTPS for dev, and LAN service discovery. What features would you be interested in?
24.
by rdme 6mo ago
It definitely is and you can see it in the git commits. The DNS wire protocol parser was the original learning project I wrote to understand the spec. Later features (recursive resolver, DNSSEC validation, the dashboard) were built with the
25.
by rdme 6mo ago
exactly, I'll add a pr soon that tells the os (and browsers) that is'a a valid domain
26.
by rdme 6mo ago
also in romanian nume = name(dns) and I also get the easter egg of that well known Romanian song numa numa :) https://www.youtube.com/watch?v=YnopHCL1Jk8 On OpenWRT — it's musl-based Linux so the binary should run the
27.
by rdme 6mo ago
Yes — numa install generates a local CA and stores it in the system trust store. When you register a .numa service, it generates a per-service TLS cert signed by that CA
28.
by rdme 6mo ago
With 390K blocked domains: ~31MB total process footprint. Breakdown: - Blocklist: 23.4MB (390K domains) - Cache: 3.8MB (4.4K entries)
29.
by rdme 6mo ago
Multiple blocklists already work - https://github.com/razvandimescu/numa/blob/main/numa.toml#L4... The pieces are already there for libnuma, it could be done, would you share what use case you have in min
30.
by rdme 6mo ago
I hit reply on the wrong post and you can't delete comments or at least I don't see how it can be done

More ›