178
Google, Cloudflare & Cisco Will Poison DNS to Stop Piracy Block Circumvention * TorrentFreak (torrentfreak.com)
submitted 2 years ago by to c/piracy@lemmy.dbzer0.com
27 comments fedilink hide all child comments
 

Run your own unbound or bind resolvers!

all 29 comments

sorted by: hot top controversial new old
[–] 75 points 2 years ago (1 child)

A French court has ordered Google, Cloudflare, and Cisco to poison their DNS resolvers...

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
    • [–] [S] 48 points 2 years ago (2 children)

    https://unbound.docs.nlnetlabs.nl/en/latest/use-cases/home-resolver.html

    https://www.perfacilis.com/blog/systeembeheer/linux/setup-a-public-dns-server.html

    Or even better yet, why not join OpenNIC and help a more democratic alternative to DNS root.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 6 points 2 years ago (1 child)

    Opennic should be the default DNS of everybody!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 19 points 2 years ago (2 children)

    Apparently Cisco operates a popular DNS resolver? Never heard of that before.

    And definitely don't learn how to use a VPN. Or set up Unbound or Bind or PowerDNS Recursive...

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 30 points 2 years ago (1 child)

    Cisco bought OpenDNS a few years ago,

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 7 points 2 years ago (2 children)

    Ah crap, good to know. This sucks though, I was thinking of using it to replace CF. What's left? Quad9 and the unbound type?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 8 points 2 years ago

    ATM I'm using Quad9 and OpenNIC but I'm not sure how much of everything do they cover. I'm also not well aware of any other good "flat DNS" alternative (aka: one you can put right into your /etc/resolv.conf / Windows LAN config, without need of extra internal service).

  • permalink
  • fedilink
  • source
  • parent
  • [–] 10 points 2 years ago (2 children)

    Cisco operates from the ISP side, they'll poison DNS through their routers. And you should be aware that your ISP will employ Deep Packet Inspection which can also be done with Cisco routers. That means they can intercept internet traffic, especially if your internet connection is not encrypted.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
    • [–] 14 points 2 years ago (1 child)

    ELI5…?

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 62 points 2 years ago (1 child)

    DNS is when your browser asks where to find a website. You enter Lemmy.One in your browser, and your browser asks the DNS resolver the address of the computer the website is hosted on.

    Most people will use their internet company's DNS, and it sounds like France ordered these companies to block some illegal streaming sites by having the DNS server point to a page saying it's blocked instead of to the website server.

    More technical users changed their settings to get DNS from google, Cloudflare, etc instead of the internet company, so now France is going to make those companies block the sites too.

    ELI5: France is lying to your computer when it asks where to find the websites

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [+] 13 points 2 years ago* (last edited 2 years ago)
    [deleted]
  • permalink
  • fedilink
  • source
    •
    [–] 8 points 2 years ago (2 children)

    Is it possible to get unbound to talk to the root servers via TLS/HTTPS by now?

    I'm currently using Quad9 because they support DNS over TLS and DNS over HTTPS.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 5 points 2 years ago (1 child)

    Yes its possible 👍

    Use:

    forward-zone:
  forward-addr: 9.9.9.9@853#dns.quad9.net
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 years ago (1 child)

    That is what I'm doing currently but now unbound doesn't talk to the root servers anymore, it sends all queries to Quad9.

    Both scenarios are not ideal because you always end up with one entity knowing all your queries.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago

    Perhaps you could configure more than unbound service behind a loadbalancer. Each unbound instance is configured to use different upstream dns servers.

    Double check if unbound doesn't allow you to randomly hop between dns upstreams first, but the above solution should work if that's unavailable atm.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 2 years ago (1 child)

    Not sure you would even need encryption. Surely It can't be illegal to ask the root servers (and all the other DNS servers involved, because the root servers only have IPs for TLD DNS servers) for IPs

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 4 points 2 years ago

    I just want to point out the Technitium project as an alternative to unbound and bind resolver as well.

    Regardless, it's really easy to setup your own DNS resolver that resolves to DNS roots.

  • permalink
  • fedilink
  • source
    •
    [+] 3 points 2 years ago
    [deleted]
  • permalink
  • fedilink
  • source
    •
    [–] 1 point 2 years ago

    I'm glad it's only the football streaming sites, but I don't much like that companies get this kind of legal power.

  • permalink
  • fedilink
  • source
    •