dingo
Security and privacy
encrypted dns proxy
SHOW HN2016
How HN took it
2 positive, 10 neutral or asking, 0 mixed, 7 critical, out of 19 comments about the project. Thread score -0.27.
Privacy: 1 for, 3 againstExecution: 1 for, 2 againstIdea: 0 for, 1 againstDocs: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful for encrypting DNS traffic on untrusted networks.
From 2 comments
When you are out and about with your laptop you are usually making your DNS calls to the local router which many view as a big privacy concern. Even if you use something like…
dexterdog on HNWhen you connect to any site, your browser sends the domain in clear-text (even for HTTPS - see SNI). The only way to avoid this is to use a VPN, but then you can route regular…
icebraining on HN
Objections
Using go run made adoption hard; no prebuilt binaries at launch.
From 2 comments
The use of `go run` here makes adopting this very hard. The benefit of using Go for projects (in my experience) is that you can build for multiple OS/Arch super, super easy. I'd…
wyattjoh on HNI think the point wyattjoh was making is that having to install the go toolchain is hindering adoption and that giving downloadable binaries that you could run directly, like…
gouggoug on HN
Relies on normal DNS to resolve the server hostname.
From 2 comments
Am I the only one who took a quick look at this and went "How can this DNS be 'secure' if it has to use normal DNS to look up dns.google.com?"
ShakataGaNai on HNBecause you validate the certificate presented so that you know the endpoint is really Google.
advisedwang on HN
Code needs gofmt and linting.
From 1 comment
This code needs a pass through gofmt, among many of the other Go linting technologies.
jzelinskie on HN
Not a Google project; it only uses Google's endpoint.
From 1 comment
DNSCrypt (https://dnscrypt.org/) would be more elegant here (DTLS also okay) and is in-band wrapper for DNS. It's what TLS is for HTTP but for DNS and keeps things UDP. Worth…
davidu on HN
Requests
Ship downloadable binaries.
From 2 comments
The use of `go run` here makes adopting this very hard. The benefit of using Go for projects (in my experience) is that you can build for multiple OS/Arch super, super easy. I'd…
wyattjoh on HNI think the point wyattjoh was making is that having to install the go toolchain is hindering adoption and that giving downloadable binaries that you could run directly, like…
gouggoug on HN
Use DNSCrypt or DNS over DTLS instead of HTTP.
From 3 comments
DNSCrypt (https://dnscrypt.org/) would be more elegant here (DTLS also okay) and is in-band wrapper for DNS. It's what TLS is for HTTP but for DNS and keeps things UDP. Worth…
davidu on HNEncryption is nice, but does it have to be the overhead of HTTP? What would be a sensible alternative protocol?
allendoerfer on HNDNSCrypt or RFC7858 (dprive) are probably closest equivalents.
zokier on HN
Questions
Why random padding up to 500 bytes in requests?
From 1 comment
It seems like this includes up to 500 bytes of padding in a request. Is there a reason for that?
nickodell on HN
Is SNI used for censorship?
From 1 comment
"It can even \"spoof\" the TLS SNI string to avoid HTTPS firewalls..." Are you confirming SNI is being used for censorship?
textmode on HN
What problem does it solve?
From 1 comment
What problem does this project solve? It's not immediately obvious what the thing does from the description.
vemv on HN
Alternatives named
DNSCrypt and openresolve.com resolver.
From 1 comment
DNSCrypt (https://dnscrypt.org/) would be more elegant here (DTLS also okay) and is in-band wrapper for DNS. It's what TLS is for HTTP but for DNS and keeps things UDP. Worth…
davidu on HN
gdns-go by ayanamist.
From 1 comment
My friend also wrote a similar tool in Go. This tool uses Taobao's API to detect your external IP address so edns will not be fixed string. https://github.com/ayanamist/gdns-go
yegle on HN