Re: Securing DNS traffic

2020-05-25 Thread Michael van Elst
aa...@zadzmo.org ("Aaron B.") writes: >This isn't really a thing where I live. The ISP's here routinely return >A records to a scammy "search engine" instead of NXDOMAIN. Yes, that was very popular here. But, also for legal reasons, the providers only manipulated the answers of their own DNS

Re: Securing DNS traffic

2020-05-25 Thread Andy Ruhl
So I'm not big into DNS and I don't have a firm grasp on all of these techniques, but I have an idea. This is all just a big game of who are you hiding from right? If you hide from your ISP, now you have to trust the DNS server provider. Who among them are to be trusted? For example I'm pretty

Re: Securing DNS traffic

2020-05-25 Thread Greg A. Woods
At Mon, 25 May 2020 19:51:52 -0400, "Aaron B." wrote: Subject: Re: Securing DNS traffic > > Again, I'd prefer to run my own resolvers, but can't justify the > expense. I would recommend begging or borrowing _any_ old used computer that can run any open-source OS (though ideally NetBSD, of

Re: Securing DNS traffic

2020-05-25 Thread Aaron B.
On Mon, 25 May 2020 12:57:59 +0200 Niels Dettenbach wrote: > I would trust my (paid) ISPs NS much more then any other "free" one by all > what i've seen in my life there - especially if your ISP grants you no usage > logging by contract. This isn't really a thing where I live. The ISP's here

Re: HP ProLiant server running NetBSD 9 setup suggestions?

2020-05-25 Thread Chris Hanson
One of the drives failed and I’d set the drives up as a single volume, oops. I brought up Windows temporarily to do the one firmware update I didn’t seem to be able to do any other way (the storage controller) and then reinstalled NetBSD. Now that I’ve reinstalled, have a dmesg:

Low power system with built in GPS, WiFi?

2020-05-25 Thread Andy Ruhl
I'm currently using a Raspberry Pi Zero with a camera for something (using raspbian), and I want to do something similar but I'm hoping to get onboard GPS. I want to run it on a battery. Also if the WiFi adapter could do hostap, this would be a bonus. Does such a thing exist? A USB camera could

Re: Securing DNS traffic

2020-05-25 Thread Steffen Nurpmeso
Sad Clouds wrote in <20200525152338.beed20b18e42642ec3403...@gmail.com>: |On Fri, 22 May 2020 22:38:19 +0100 |Sad Clouds wrote: | |> It seems there are two main security enhancements for DNS: |> |> 1. DNSSEC - digital signatures for DNS records to verify they haven't |> been tampered

Re: Securing DNS traffic

2020-05-25 Thread Niels Dettenbach
Am Sonntag, 24. Mai 2020, 20:02:45 CEST schrieb Aaron B.: > I'm also worried about this, but also fear datamining by my ISP. So I > completely ditched Google, and split my queries between Cloudflare and > Quad9 - neither gets the complete picture. This relys on a typical misunderstanding what most

Re: Securing DNS traffic

2020-05-25 Thread Niels Dettenbach
Am Samstag, 23. Mai 2020, 12:09:09 CEST schrieb Sad Clouds: > I was thinking about this as well, but is there any real evidence that > public DNS providers misuse your personal data? Depends from what you "expect" as "misuse". Running "free" public NS to i.e. "just collect domain names" and

Re: Securing DNS traffic

2020-05-25 Thread Sad Clouds
On Fri, 22 May 2020 22:38:19 +0100 Sad Clouds wrote: > It seems there are two main security enhancements for DNS: > > 1. DNSSEC - digital signatures for DNS records to verify they haven't > been tampered with. > > 2. DNS over TLS - encryption of DNS traffic for privacy. This goes via > port

Re: Securing DNS traffic

2020-05-25 Thread Sad Clouds
On Mon, 25 May 2020 10:17:56 +0200 Jörn Clausen wrote: > Hi! > > I was not arguing for "no security at all". It's just this motivation > for DoT/DoH (disguising the request from your ISP) that I don't get. > > I have only a cursory knowledge of these technologies, but I think > DNSSEC is the

Re: Securing DNS traffic

2020-05-25 Thread Jörn Clausen
Hi! I was not arguing for "no security at all". It's just this motivation for DoT/DoH (disguising the request from your ISP) that I don't get. I have only a cursory knowledge of these technologies, but I think DNSSEC is the far better approach against the type of forgery you mentioned. Why do