Hacker News new | ask | show | jobs
by creesch 660 days ago
> dns-blocking is evil, no matter who does it.

You really ought to expand on that line of reasoning in order to get anyone to take this comment seriously.

1 comments

see my other comment itt

more or less about trustworthy infrastructure

Assuming I am looking at the right comment, you didn't really expand/explain all that much.

If I am correct, your argument boils down to blocking happening outside the direct control of the user. This technically is true, as you don't have an icon in your browser like you would have with an extension.

At the same time, it being outside the control of the user is not really true if the user is also the person in control of the blocking solution. I don't know how it works with AdGuard, although I assume it is the same. Pi Hole offers extensive insights in what requests are being blocked, from which client and when.

This can even be adjusted on a per client level. Making that argument a more theoretical rather than a practical one.

it's a practical argument as soon as someone else has to use it
Sure, but that is not the context here. So I am still unsure about the "evil" aspect of it all.

Even if someone else has to use it. Certainly, when it is someone in their household who can access the administration for their client devices/applications as well.

Other people affected might be those who make use of the authors wifi. Where the author can also opt for guest wifi using regular DNS. Or not even do it on router basis and really a per-client basis.

The only context in which it is potentially "evil" or malicious is when people unknowingly get things blocked or redirected to the wrong things. But that is pretty far removed from the context of this article.

> The only context in which it is potentially "evil" or malicious is when people unknowingly get things blocked or redirected to the wrong things.

that was kind of my point;

dns-infrastructure should not knowingly give wrong answers because that will make it less useful and more of a hassle down the road

DNS and all the overall infra should do whatever the owner of the infra want it to do.

If i as the network admin don't want you to access some site i will block it, and blocking it at DNS level is one of the ways i have to achieve this and if i catch you trying to circumvent it you will be booted from my network in no time.

That is what local DNS servers are for and what solutions like Pi-Hole and AdGuard Home were desinged to accomplish..

There are many legitimate user cases that require you to mess with DNS. example, you can force google safe search in your network to all devices, google own instructions are to create a cname redirecting www.google.com to safesearch.google.com at your local DNS server.

So no, block or redirecting stuff in my DNS not only is not evil, it is required in many cases.

If you are trying to do something that is being blocked in the local network either talk to the network admin and explain why you need to do that and check if he can fix it for you and if he cant\wont then go do it somewhere else..

Also, most, if not all, the large enterprises do dns level blocking, as they should.. Go try work around this and i bet you they will call you out, insist and you will be job hunting in no time..

> because that will make it less useful and more of a hassle down the road

You can't just say "it is this because it is this". Clearly the sole user of DNS finds it useful to block through DNS.

What sort of hassles do you even have in mind?