nykolasz

Great tool, but not maintained anymore, unfortunatelly.

Will have to give Caddy a try. Been a long time nginx user, but they have been very slow to implement new features (including HTTP/3), unfortunately.

how are the users going to manage the router without it? they just need to do it securely and better ways to auto update.

I would love to see a "child" lockdown mode. Maybe that will be a good option to make the iphone/ipad more young children safe?

Poor kid and a good lesson learned. Hope he doesn't get demotivated because of it. It reminds me of the old "everyone@company" email threads that would flood everyone.

I think 100% of the DNS outages in the past few months have been caused by DNSSEC. For little gain that DNSSEC provides.

Yep. What happens when Chrome adds DoH support? And Safari?

And whatever Gaming app the kids download? Suddenly it will become impossible to manage and maintain.

Not even talking about the troubleshooting nightmare.

DNS should be a system-level setting, not an App-level setting.

IP-based and domain-based. We have a long list of domains/IPs used by VPN providers.

Won't prevent someone from setting up its own SSH-based proxy on port 443, but covers things that are accessible and easy to use by young students (talking about elementary school on our case).

Again, we are talking about a school network with young kids (under 12/13).

Quite the opposite. We don't want MITM and this may force that direction.

Band-aid solution that worked pretty well. Very cheap to implement, widely supported and used by many schools.

Our student's data was still private (no emails or passwords being decrypted) and we did the filtering only based on the domain name. It also didn't require an expensive appliance that would be need if did the filtering based on SNI.

I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause:

I work at a k12 school and I am involved on many k12 IT communities.

Some schools already removed Firefox from the students computers because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS.

There is a fine line between protecting yourself from your ISP and local network operators that NEED to apply some security policies to their traffic. Even Google offers "Safe Search" for schools and libraries that removes porn content.

Unfortunately, on our school network, we also allow BYOD (students with their own laptops and ipads), so we will have to have some strict rules to block DoH, the same way we block proxies and vpns.

The only other option is going to full HTTPS MITM, forcing a root SSL cert to all computers that use our network, which is the last thing that anyone wants to do.

Summary: This may lead to more HTTPS MITM or schools forbidding BYOD AND removing Firefox from their computers.

I work at a k12 school and I am involved with many IT admins from other schools.

Some schools already started to block Firefox from being installed because it was being used as a "VPN" by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS.

There is a fine line between your ISP and local network operators that NEED to apply some security policies to their traffic. Even Google offers "Safe Search" for schools and libraries that removes porn content.

Unfortunately, on our school network, we also allow BYOD, so we will have to have some strict rules to block DoH, the same way we block proxies and vpns.

Glad that they allowed resolvers that filter content based on the user request in there. So good news that Quad9 and CleanBrowsing will be able to make the list.

I need to point out that Norton DNS has been retired and is not supported anymore (and never offered any privacy).

"On November 15, 2018, Norton ConnectSafe service is being retired or discontinued meaning the service will no longer be available or supported. You may continue to use ConnectSafe until November 15, 2018. However, we do recommend that you take a moment to review important details related to this announcement below."

Some alternatives: https://medium.com/@nykolas.z/norton-connectsafe-dns-is-shut...

I am actually surprised he didn't mention CleanBrowsing in their list, which I would recommend as good alternative to Norton and OpenDNS.

Whatever skill you want to learn and will have fun learning. I am trying to learn more about kernel-level programming, because that's something I was always curious about. So that's what I am doing now.

Find your passion.

I would expect a lot more from Slack.

Agree. Isn't that why we have extensions for?

There are multiple extensions and VPN products out there (some better and some worse), so why are they choosing who wins or loses here. I know it is because of $, but I hate the direction they have been taking lately.

First, I would ask: why do you think you need a formal 1-1 with your direct reports?

I would love to understand why Firefox keep adding support for CloudFlare specific features.

And no amount of phishing training will solve it - I don't think. People will still click on links, they will click on buttons and do what they think it is expected for them to do.

On the bright side, Google Safe Browsing is pretty good at catching new untargetted phishing campaigns, so most people get a good level of protection from that. I am also a big proponent of using a DNS firewall* layer to help minimize the exposure to phishing domains.

*I blogged about it here, comparing a few free DNS resolvers, if anyone is interested:

https://medium.com/@nykolas.z/phishing-protection-comparing-...

Really? They both have anycast pops all over the world - and in my tests, very close performance (couple of ms of difference - if that) to be felt by anyone.

ex: https://medium.com/@nykolas.z/dns-resolvers-performance-comp...

First, I think it gives too much power to the browsers. Firefox was already taking some dangerous choices with DNS over HTTPS on some of their recent changes. Chrome as well, doing changes that will benefit Google, in detriment of the rest of the web.

Second, I think it is an overall bad design choice to tunnel a lightweight protocol on top of HTTP on top of TLS. Instead of just tunneling it under TLS.

DNS hijacking is real and very annoying. The main benefit of these protocols is in the integrity of the DNS resolution data. It allows you to use any DNS server you want, without having your ISP modifying their responses.

Here is my story why I tried dnscrypt: https://medium.com/@nykolas.z/ending-dns-hijacking-with-dnsc...

I hope you are wrong. We don't need one more protocol tunneled through HTTP.

Pretty much there are 3 competing implementations for DNS resolution encryption (won't call it security):

  * DNSCrypt
  * DNS over TLS
  * DNS over HTTPS

https://github.com/jedisct1/dnscrypt-proxy

It doesn't get a much love as it should, but it is probably the best way to secure encrypt your DNS requests right now. The protocol was initially developed by OpenDNS, but many resolvers support it right now (cisco, cleanbrowsing, etc). The list of supporting services is impressive:

https://download.dnscrypt.info/dnscrypt-resolvers/v2/public-...

On the other hand, DNS over [HTTPS|TLS] are pretty new and don't have as much support, except for a few players. A good list if here as well:

https://www.reddit.com/r/sysadmin/comments/976aj2/updated_li...

First, I have to say that I love cloudflare, but the last thing we need is the centralization of all our DNS resolution to them. Please Mozilla, don't give anyone too much power.

And if DNS over HTTPS is the way to go (which might be), give the user a choice. There are 3 public resolvers already offering DNS over HTTPS:

  Google[1] (was the first one to support it) 
  CloudFlare[2]
  CleanBrowsing[3] (for security and/or adult filtering)

* 1: https://developers.google.com/speed/public-dns/docs/dns-over...

* 2: https://developers.cloudflare.com/1.1.1.1/dns-over-https/

* 3: https://cleanbrowsing.org/dnsoverhttps

Google and twitter does that by default. If you try to click on any link from their search / tweet feed, it will be blocked if they flag it as phishing.

There are multiple phishing blacklists that any provider can leverage.

The location doesn't matter much. Most of them are anycast, loading from all over the world.

There are 3 major protocols available for DNS privacy:

* DNSCrypt

* DNS over TLS

* DNS over HTTPS

DNSCrypt is the one with better client support and a long list of providers available. If you pick DNS over TLS or DNS over HTTPS you will be restricted to 3 or 4 major players (google, quad9, cloudflare and cleanbrowsing). If you trust them, you are good.

For example, this is the list of providers with DNSCrypt support: https://download.dnscrypt.info/dnscrypt-resolvers/v2/public-...

For DNS over (HTTPS|TLS), there is very little client tools available for troubleshooting. The best one I found was these 2 in PHP:

https://github.com/dcid/dns-over-tls-php-client https://github.com/dcid/doh-php-client