Stéphane Bortzmeyer, a French network engineer, writes in French about DNS, routing, TLS, RFCs, and internet standards.
HN commenters link it for technical detail on the Turkey DNS hijack, the WikiLeaks attack, DoH setup, and RFC explanations.
Turns out jblow's right. I banished OpenDNS because it was breaking basic DNS functionality to serve its ads (and is terrible privacy wise), this is the exact bad behaviour from ISP openDNS was supposed to help with.
But don't take my word for it and read this 2009 post from Stephane Bortzmeyer working at AFNIC in R&D in DNS security[1].
As jblow said the whole "no more ads" post reads as PR spin, same goes for your reply to him:
- growth numbers don't tell any story apart maybe from «many people read the "Open" part of the OpenDNS name and turn their brains off» [2].
- DNS nerds run their own DNS and keep away from openDNS for breaking DNS and invading privacy.
- not causing issues for most people doesn't disprove that it did cause issue for many people.
I do remember the browser landscape before openDNS and I'm quite happy to debunk your boasting attempt at being significant. The "search from the address bar" functionality has been around long before google chrome came to existence, actually it was in opera before openDNS existed and even better it allows to choose the search engine and use several with the use of a keyword. This was then added to firefox back in firefox 3. Again don't take my word for it and look a this 2008 post[3].
[1]: http://www.bortzmeyer.org/opendns-non-merci.html
[2]: http://beta.slashdot.org/comments.pl?sid=1297613&cid=28640723
[3]: http://googlesystem.blogspot.fr/2008/06/searching-from-address-bar.html
End-to-end security of the channel isn't necessary. DNS is public. There are clues that DNS is broken in those situations that, as with SSL, ultimately your browser would have to present to you. Local validation is all you can count on. E.g. http://www.bortzmeyer.org/dns-swisscom.html
Personally, I'm now twice as interested in relying on DNSSEC and running my own DNS resolution rather than relying on third-parties. Not least because Google's DNS doesn't always give me the closest servers for CDNs that provide different answers. Frankly, the biggest problem DNSSEC solves is securing that first HSTS response, but every bit counts. That DNS services on open WiFi stop lying... That might never happen. But perhaps future async DNS resolution baked into browsers will warn about DNS as much as SSL for those that care.
This. Websites are supposed to distinguish internal and external links. It makes it way easier to now what kind of information we will be getting when clicking. My first thought is for a blog [1] which does it pretty well: (internal links are underlined.
[1] http://www.bortzmeyer.org/ (fr)
(I could not think of an English-speaking website with a similar differentiation right away)
Edit: just look at Wikipedia https://en.wikipedia.org/wiki/Hacker_news
There is an interesting guide (in French) on best-practices to get DoH up and running with dnsdist (https://dnsdist.org) here: https://www.bortzmeyer.org/doh-mon-resolveur.html.
You might also be interested in looking at https://dnsdist.org/guides/dns-over-https.html
You might be interested in this (in French, but you may try with google translate or other alternatives :)
https://www.bortzmeyer.org/8240.html
It is a very interesting explanation of debates around https://www.rfc-editor.org/rfc/rfc8240.txt
Yes, but it isn't wizardry. Given the right kind of access, it's actually pretty easy. Take a look at http://www.bortzmeyer.org/dns-routing-hijack-turkey.html for more technical details.