vavrusa

6 ms·

1.
by vavrusa 7y ago
Sorry about that, I'll look into it in a bit.
2.
by vavrusa 7y ago
Hi, I answered it in another comment below.
3.
by vavrusa 7y ago
This is not the privacy concern, check out the https://tools.ietf.org/html/rfc7871#section-11.1 discussing it. Yes, if you open a connection to the target IP, then all transit networks between client and the target IP
4.
by vavrusa 7y ago
Disclaimer: I work on 1.1.1.1. You might not consider your /24 as personally identifying, but others might. The original RFC discusses these problems fairly well ( https://tools.ietf.org/html/rfc7871 , Privacy notic
5.
by vavrusa 7y ago
That's good, I missed that. Thanks for highlighting the project, I'll keep an eye on it!
6.
by vavrusa 7y ago
This is interesting as a lighter alternative to DNS over Tor. Where is the padding going to be? Basic clients won't add EDNS padding by default, but intuitively there has to be padding somewhere. It reminds me of https://odn
7.
by vavrusa 8y ago
From operational perspective, it may be easier to maintain a certificate (after all, that's what you already do for an HTTPS service) than a DNSSEC signed zone. It is also easier if you have a multiple DNS providers, since you don&#x27
8.
by vavrusa 8y ago
I wrote a not very well known LuaJIT to BPF compiler as a part of bcc precisely because of this. It doesn't depend on anything besides LuaJIT (no LLVM, no C, no libbpf, etc). Caveats: it's Lua, it doesn't fast track all the l
9.
by vavrusa 8y ago
HTTPS gives you clear upgrade path to QUIC and handshake costs of TLS 1.2-3 as well. This is the very goal of this study - to determine how feasible is it in the real world and what's the performance impact.
10.
by vavrusa 8y ago
Cloudflare publishes transparency reports https://www.cloudflare.com/transparency/ It also promises not to store your IP associated with the DNS requests https://developers.cloudflare.com/1.1.1.1/c
11.
by vavrusa 8y ago
DPRIVE maintains a list with current implementation status https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Implement... (you're looking for TLS encryption + OOOR + pipelining)
12.
by vavrusa 8y ago
DNSSEC is orthogonal to this. Its goal is to prove integrity of records between authoritatives and the closest validator. The validator is most often the resolver doing the recursion, not the client. The client can either revalidate all the
13.
by vavrusa 8y ago
It's worth mentioning that encrypted DNS is not just about privacy, but also integrity. It's more difficult to intercept or spoof in hostile networks. ISP can still see the target IP address and SNI. The IP address is sometimes me
14.
by vavrusa 8y ago
This is a great comment. The ping time is so much less meaningful for recursive service than for authoritative. The latency difference between cached answer and uncached answer is in several orders of magnitude. The cache hit ratio also plu
15.
by vavrusa 8y ago
4.2.2.x (Level3) is one of those resolvers hijacking negative answers and redirecting your to their "search pages".
16.
by vavrusa 8y ago
I ran a full recursor on my laptop for about two years. It's not a great choice, especially if you're not stationary. A lot as a lot of environments intercept DNS and poison your cache, the answers for lb'd names also change
17.
by vavrusa 8y ago
QNAME minimization just minimizes the name to one label under a delegation, there's no randomization. So root zone would only get 'com.' (and type NS). It's unfortunately easy for authoritative servers (below TLD level)
18.
by vavrusa 8y ago
As it should fail in any validating resolver. The CNAME signature recently expired: http://dnsviz.net/d/www.immigration.govt.nz/dnssec/
19.
by vavrusa 8y ago
Yes, there's a cap on both negative and positive cache lifetime. The reason is reducing the blast radius as accidents happen, and it hurts especially on long infrastructure records (mistake during repointing NSs, bad glue, expired DS e
20.
by vavrusa 8y ago
There's a public list of IP ranges on the website: https://www.cloudflare.com/ips/ There's troubleshooting utilities in the CHAOS class, e.g. dig @1.1.1.1 id.server ch txt
21.
by vavrusa 10y ago
It wasn't mentioned in the article, but I've recently merged LuaJIT to BPF compiler. So you just write Lua and the kernel bits get compiled into BPF bytecode and loaded. No C. See https://github.com/iovisor/bc
22.
by vavrusa 11y ago
That is consented filtering and that's fine. I do the same thing locally and I'm okay with a public network operator refusing to serve certain zones (nudity, malware, illegal content). Refusing to lookup a name != MitMing every qu
23.
by vavrusa 11y ago
I reckon that depends on where you are. I don't have any hard data on this, just a lifetime of disappointment with hotel wifis. It's not the captive portal on first use what irks me, but continued DNS intercepting after you pass t
24.
by vavrusa 11y ago
Yes you're right, I just hoped that this may be a useful mnemonic (admittedly maybe a confusing one, but worked for me) for people starting with Lua. A simplification. How the index with negative offset is computed is explained in deta