Here's Why DNS Matters w/ John Todd from Quad9 - Techlore
video description
Date: 2022-04-15
Related videos
Comments and reviews: 10
zyxwvutsrqponmlkh
While in principle I'm ok with blocking access to 'bad actors' I am also quite concerned that this will become a censorship tool. Most DNS traffic is still not encrypted so MITM snooping would be trivial. Additionally there have been some bad actors in the spam email blacklist space like UCEPROTECT goes out of their way to make blacklists as baud as possible, they are currently blacklisting the entire linode AS number then extorting a considerable amount of money for each IP address to be whitelisted. Let's say one of my customers has a compromised system and is temporarily a zombie in a botnet. What do you block, that IP, the C block, the B block the AS number? What if the customer is behind CGnat and partially shares that IP with 50000 other customers as IPV4 resources are scares.
On an international level we should be blocking all traffic to and from proxy servers, I see no legitimate need for them these days. If an authoritarian nation sate wants to go to that level to filter access to the open internet then it should have no access at all.
reply
While in principle I'm ok with blocking access to 'bad actors' I am also quite concerned that this will become a censorship tool. Most DNS traffic is still not encrypted so MITM snooping would be trivial. Additionally there have been some bad actors in the spam email blacklist space like UCEPROTECT goes out of their way to make blacklists as baud as possible, they are currently blacklisting the entire linode AS number then extorting a considerable amount of money for each IP address to be whitelisted. Let's say one of my customers has a compromised system and is temporarily a zombie in a botnet. What do you block, that IP, the C block, the B block the AS number? What if the customer is behind CGnat and partially shares that IP with 50000 other customers as IPV4 resources are scares.
On an international level we should be blocking all traffic to and from proxy servers, I see no legitimate need for them these days. If an authoritarian nation sate wants to go to that level to filter access to the open internet then it should have no access at all.
reply
Techlore
We are thrilled to have John Todd on Surveillance Report. Tons of amazing information, so be sure to hop around:
00: 00 Introduction
00: 21 History of Quad9
06: 57 What is DNS?
09: 48 What is a -recursive- DNS?
13: 05 Why does DNS matter?
19: 52 DNS & enforcing content policies
20: 59 Why should listeners change their default DNS?
23: 28 What makes Quad9 different and why should listeners consider Quad9?
24: 59 What is Quad9's business/funding model?
29: 03 DoH vs DoT
36: 35 John Todd's 7 DNS/tech predictions for 2022
37: 39 Prediction 2: How can DNS help mitigate or prevent cyberattack?
42: 37 DNS stability vs security
44: 11 Prediction 6: What does the future of privacy regulation hold?
47: 00 Additional thoughts& comments
48: 38 Quad9 vs the Courts (and how you can help)
reply
We are thrilled to have John Todd on Surveillance Report. Tons of amazing information, so be sure to hop around:
00: 00 Introduction
00: 21 History of Quad9
06: 57 What is DNS?
09: 48 What is a -recursive- DNS?
13: 05 Why does DNS matter?
19: 52 DNS & enforcing content policies
20: 59 Why should listeners change their default DNS?
23: 28 What makes Quad9 different and why should listeners consider Quad9?
24: 59 What is Quad9's business/funding model?
29: 03 DoH vs DoT
36: 35 John Todd's 7 DNS/tech predictions for 2022
37: 39 Prediction 2: How can DNS help mitigate or prevent cyberattack?
42: 37 DNS stability vs security
44: 11 Prediction 6: What does the future of privacy regulation hold?
47: 00 Additional thoughts& comments
48: 38 Quad9 vs the Courts (and how you can help)
reply
Be
There is something fishy about this. Why do they want more and more users to use their service, if the service is free and they don't get anything from doing this? They only lose money. Well, they may argue that they care so much about other people's privacy, that's why they're providing this service. Ok, let's assume that this is true. But then why wouldn't you recommend other free services, other than your own? Even better: let people to decide if they want to use your service or not, without doing any advertising, since you don't gain anything from doing this, right?
My spider senses tell me that they are working for the government. You don't have to take my word for it, because I don't gain anything either if you do believe me or if you don't believe me.
reply
There is something fishy about this. Why do they want more and more users to use their service, if the service is free and they don't get anything from doing this? They only lose money. Well, they may argue that they care so much about other people's privacy, that's why they're providing this service. Ok, let's assume that this is true. But then why wouldn't you recommend other free services, other than your own? Even better: let people to decide if they want to use your service or not, without doing any advertising, since you don't gain anything from doing this, right?
My spider senses tell me that they are working for the government. You don't have to take my word for it, because I don't gain anything either if you do believe me or if you don't believe me.
reply
Sodium
While I'm sure this is an excellent service, I do have a few concerns that haven't convinced me to suddenly jump onboard. First, the malicious request location data. I don't like that cities are included and think that's too much detail. State/province and country is one thing, but including cities on top of that is a no-go.
Second, they're given a list of malicious domains by their sponsors. Are these domains examined or are they just accepted without question? The issue I have is that IBM could one day put a domain on the list, not because it's actually malicious, but because they disagree with their philosophy. We've seen companies, especially big tech, overstep boundaries to silence critics and political figures.
reply
While I'm sure this is an excellent service, I do have a few concerns that haven't convinced me to suddenly jump onboard. First, the malicious request location data. I don't like that cities are included and think that's too much detail. State/province and country is one thing, but including cities on top of that is a no-go.
Second, they're given a list of malicious domains by their sponsors. Are these domains examined or are they just accepted without question? The issue I have is that IBM could one day put a domain on the list, not because it's actually malicious, but because they disagree with their philosophy. We've seen companies, especially big tech, overstep boundaries to silence critics and political figures.
reply
Jimmy
One can also use a local DNS server controlled by the user as a cashing proxy for DNS requests.
To filter requests,
paranoid way is to block all and only allow what you -want-
(can be very tedious, also not actually that clean, as many services/sites uses -aliases- to hide their actual purpose.
Also can be used to stop some tracking,
example is to run your own font server and have all font services redirect to it.
As a bonus you will detect the malicious sites very fast.
Down-side is a lot of work can be required by the user.
reply
One can also use a local DNS server controlled by the user as a cashing proxy for DNS requests.
To filter requests,
paranoid way is to block all and only allow what you -want-
(can be very tedious, also not actually that clean, as many services/sites uses -aliases- to hide their actual purpose.
Also can be used to stop some tracking,
example is to run your own font server and have all font services redirect to it.
As a bonus you will detect the malicious sites very fast.
Down-side is a lot of work can be required by the user.
reply
Malachi186282
Excellent video. Thank you for posting it.
Personally, I use Pi-holes on Raspberry Pi's as my local DNS servers and all my computers and devices on my home network use them to resolve DNS (my router, which provides DHCP, is configured to assign the Pi-holes as DNS. The Pi-holes themselves are configured to use Quad9 as their upstream resolvers.
reply
Excellent video. Thank you for posting it.
Personally, I use Pi-holes on Raspberry Pi's as my local DNS servers and all my computers and devices on my home network use them to resolve DNS (my router, which provides DHCP, is configured to assign the Pi-holes as DNS. The Pi-holes themselves are configured to use Quad9 as their upstream resolvers.
reply
Level
I find the idea of network operators wanting to monitor service as silly, their job is to provide service & we are paying for them to do so. In the case of public wifi then that is a service which they provide to intice customers into their stores. But with mobile data that is increasingly becoming less of an issue.
reply
I find the idea of network operators wanting to monitor service as silly, their job is to provide service & we are paying for them to do so. In the case of public wifi then that is a service which they provide to intice customers into their stores. But with mobile data that is increasingly becoming less of an issue.
reply
wrekced
I think that John's map analogy for DNS is a very good example. Reading a map is much more like a DNS query than a phone book lookup. Thanks for this video. I have changed the DNS settings for all my network and devices to quad9 now. Seems to be just as fast as the DNS servers I was using.
reply
I think that John's map analogy for DNS is a very good example. Reading a map is much more like a DNS query than a phone book lookup. Thanks for this video. I have changed the DNS settings for all my network and devices to quad9 now. Seems to be just as fast as the DNS servers I was using.
reply
Mr.
So, when I go to quad9 dns query website it says -unable to parse query-. what do i do to fix this or is this good? For example do i have to load that url unto the web browser's proxy access [settings]?
reply
So, when I go to quad9 dns query website it says -unable to parse query-. what do i do to fix this or is this good? For example do i have to load that url unto the web browser's proxy access [settings]?
reply
Ryan
Quad9 is great for me as UK law requires all ISPs and mobile networks to collect and store users browsing history for a minimum of 12 months. For mobile networks this also includes texts and calls.
reply
Quad9 is great for me as UK law requires all ISPs and mobile networks to collect and store users browsing history for a minimum of 12 months. For mobile networks this also includes texts and calls.
reply
Add a review, comment
Other channel videos
9:57