Shutting down our public encrypted DNS

Posted by mywacaday 4 days ago

Comments

Comment by pbhjpbhj 4 days ago

>We want a public service to be available. Going forward, we will support Quad9 instead of running it ourselves. Running a privacy-focused public DNS service is a highly specialized undertaking, and the Quad9 Foundation is the undisputed leader in the field. Rather than duplicating their efforts to achieve only part of what they do, we're putting those resources toward financially supporting Quad9 instead.

Brilliant.

Comment by assumed_throwaw 4 days ago

Unfortunately, Quad9 is censoring some domains in Europe (notably in France and Italy) following injunctions issued by rights holders [1]. That was not the case with Mullvad's DNS.

[1] https://quad9.net/news/blog/italian-blocking-demands-followi...

Comment by loup-vaillant 4 days ago

> The German courts entirely disregarded our use of geo-IP lookups on queries, and asserted that since tests via a VPN were able to resolve the domain, we were in breach of court orders

Seriously, what the fuck? So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up? I really don't like where this is going.

Comment by johnhtodd 3 days ago

What's even worse: the court fined us because they claimed this use case was in some way in contempt of their ruling. Then, when we won the overall case, that money was never returned because it wasn't specifically referenced by the final court. The response from the lower court was effectively: "Well, you will need to sue the court to get that money back." <table flip>

Edit: I'm with Quad9 (CTO)

Comment by u1hcw9nx 3 days ago

>wasn't specifically referenced by the final court.

Maybe your lawyer fucked up? Did you immediately appeal the fine or request a stay pending the main action?

Appeal court ruled on the substantive case. My understanding is that in Germany it has no procedural jurisdiction to order the state treasury to refund an enforcement fine. You need restitution claim that makes the thing yet another hoop.

Comment by johnhtodd 3 days ago

Cost and staff time to pursue were not significantly higher than the return. We just want to help people with security and privacy and do DNS stuff - this legal fighting is absurd and misplaced and a spectacular waste of time, but here we are.

Comment by avhception 3 days ago

The hubris of the courts can be stunning. Sorry from Germany.

And thanks for the great DNS service, I'm using it everywhere!

Comment by n0on3 3 days ago

That’s insane. Thank you for the service you provide.

Comment by anonzzzies 2 days ago

Maybe Mullvad can help fight this type of nonsense?

Comment by jwitthuhn 4 days ago

The entire point is that it can't be reasonably enforced with any granularity. Rights-holders want it to be like that so a copyright win in a single country means something has to be taken down globally.

Comment by u1hcw9nx 3 days ago

The decision was reversed in the appeals court.

The appellate court ruled that independent recursive DNS resolvers are too far removed from the actual infringement to be held liable.

Comment by Henchman21 4 days ago

Sounds more like we should end copyright worldwide.

Comment by brookst 3 days ago

There may be a middle ground between the current maximalist copyright regime and ending copyright altogether.

Comment by PinkSheep 3 days ago

And this is why I will continue supporting the position of "ending copyright altogether":

Average of (current maximalist copyright; ending copyright) is what you called middle ground.

Average of a sensible position like (current maximalist copyright; ending copyright divided by 2) still does not yield a sensible world where culture and art - or even human interactions - can thrive.

Comment by aleph_minus_one 3 days ago

> There may be a middle ground between the current maximalist copyright regime and ending copyright altogether.

The trenches between the different factions are far too deep for any middle ground to have any chance.

Comment by Henchman21 3 days ago

Are you proposing this as a bridge to eliminating it entirely? Because to be quite frank, the “copyright holders” don’t deserve a damned thing. They’ve already robbed the commons and will continue to do so. Appeasement is the same as capitulation. And quite frankly the way things are shaping up… association is the same as guilt and I am not in a forgiving mood, having been robbed blind by these same people for my entire life.

Comment by account42 1 day ago

And ending copyright altogether would move us much closer to any such middle ground compared to where we are now.

Comment by throwaway050920 3 days ago

As language models are tolerated that is only fair in my opinion. If they are allowed to be trained with GPL licensed, copyrighted and so on data then copyright should vanish also for everyone else. The existence of LLMs with the current laws is just unfair.

Comment by jMyles 4 days ago

Indeed it needs to happen, and even here on HN, it can be difficult for some to admit and acknowledge.

It'd be great for this to be the first major relinquishment of nation-state power to happen without violence, without backroom deals, without wedge politics and flag waving.

Just... let it go.

It's beyond obvious that copyright is not going to exist in 1000 years. Every creature on earth - especially the internet - survives by copying information. It's the most basic life force in the universe.

Copyright is serving exactly nobody today. It's time. Are there elder stateswo/men in the room who can see the writing on the wall and act with grace?

Comment by otterley 4 days ago

> Copyright is serving exactly nobody today

Except for nearly everyone who writes anything (including software) or other artistic pursuits to make a living. This includes a majority of people here on HN.

Comment by brainwad 3 days ago

Most hackers here are not relying on copyright to make their living. Either you work on open source but make your living off services on top of the code, or your code is a trade secret protected via contracts.

Not to mention that everyone using coding agents probably aren't even protected by copyright in the first place, at least in the US, since the courts are taking a pretty hard line on human authorship being required...

Comment by otterley 3 days ago

Free Software as a concept could not exist without copyright. Copyright is what allows the license to declare the terms under which a copy is permitted, including the provision that the source code ship with the binary form. (This is discussed in the commentary to the GPL.)

Despite the SaaS model under which many of us build, there is still a tremendous amount of packaged and distributed software that people use every day: your phone and its OS and apps, most computer OSes, databases, medical records, transportation, communications—the list goes on—that many of us work on to put food on the table.

Comment by brainwad 3 days ago

Copyleft software couldn't exist. But all software would be free by default, because all source would be in the public domain, and all reverse compilation of binaries would produce public domain code.

Comment by otterley 3 days ago

Sure, but if all software is in the public domain, then the profit motive for developing software will be completely wiped out, and much less will be produced as a result. Software development be reduced to a hobby or developers will have to seek out patronage like artists did in the 1600s. That’s not a world that most of us want to return to.

Comment by brainwad 3 days ago

Why do you think so much open source software is written, if you need a profit motive for software to be created?

Also, let's be real - human written (and therefore copyrightable) code is dying already. When the machines can write anything on demand, why do you need a profit motive?

Comment by otterley 3 days ago

> Why do you think so much open source software is written, if you need a profit motive for software to be created?

That's like asking why gardeners like to grow food and flowers in their backyards, or why hobbyists like to build furniture in their garages. Some people need a creative outlet. It doesn't mean that a lot of people won't grow food, flowers, or furniture for free, and that there's no demand for food, flowers, or furniture to be bought.

> When the machines can write anything on demand, why do you need a profit motive?

Machines still need humans to power them. They're like any other tools that need direction and guidance, by humans that possess the innate creativity.

Comment by brainwad 2 days ago

Ok, but unlike hobby gardening, open source maintainers actually write the core software we all rely on. That's where the analogy falls over - the "hobbyists" are producing a sufficient bounty already, without a profit motive. A lot of them are paid employees of corporations, but those corporations often don't make profit on the open source software they contribute to either.

> Machines still need humans to power them. They're like any other tools that need direction and guidance, by humans that possess the innate creativity.

Yes but ideas are not copyrightable, only the fixed expression of those ideas in (in this case) written form. If the actual writing of the code is delegated entirely to machines, then software copyrights are dead.

Comment by loup-vaillant 3 days ago

Or have a universal income. Capitalism isn't inevitable. And it will end anyway, at it hits planetary limits. Better start thinking of alternatives before one of the worst ones gets imposed on us.

Comment by WrongSideWon 3 days ago

[flagged]

Comment by account42 1 day ago

We had arts and sciences being funded long before copyright even existed. Your concern is not based in reality. If people want something to exist they will be willing to pay for its creation.

Comment by aleph_minus_one 3 days ago

> But all software would be free by default, because all source would be in the public domain, and all reverse compilation of binaries would produce public domain code.

I am not aware of any open-source license which tries to approximate the "there is no copyright" situation:

- Such a license would not compulse you to publish the source code of any modification you make for it.

- Such a license would allow you to distribute compiled programs only.

- On the other hand, such a license must not restrict you to de-compile, modify or re-destribute any binaries built from the source code.

- But any such derivate of such a binary or source code would have to stay under the same license (this is a different kind of virality than "normal" viral licenses).

Comment by brainwad 3 days ago

CC0 is an explicit attempt to emulate public domain in license form, isn't it?

Comment by aleph_minus_one 3 days ago

> CC0 is an explicit attempt to emulate public domain in license form, isn't it?

Public domain is something different from an emulation of "there is no copyright":

You can take public domain material to build some program binary:

- In the current legal system, you can enforce restrictions on the usage of this binary, and can forbid redistribution, reverse-engineering, ...

- In a "no copyright world", you cannot enforce such restrictions.

Comment by otterley 2 days ago

> In the current legal system, you can enforce restrictions on the usage of this binary [from a public domain source], and can forbid redistribution, reverse-engineering

IAAL and am pretty familiar with U.S. copyright law, and am curious where support for this proposition in the law is found. Can you provide sources, please?

Comment by aleph_minus_one 2 days ago

I don't know the US law (I live in Germany), but the intuition is clear:

1. Take some CC0/public domain source code.

2. Build a binary out of it and sell licenses for your software.

Case study: SQLite's source code is public domain. On the other hand, it is embedded in many commercial software products that are sold - and you are not allowed to reverse-engineer the software or redistribute binaries of it. This would be possible/allowed in a no-copyright world.

Comment by 2 days ago

Comment by ralferoo 3 days ago

"your code is a trade secret protected via contracts" isn't enough to replace copyright because the contracts are only enforceable to the signing parties.

Let's say you write some software for your employer and they sell the product to several customers with a contract not to distribute it. However, the product appears on some pirate website anyway, and you can't identify who allowed the product to be leaked. Once it's there, your contracts are worthless as nobody who downloads it from the pirate site will be bound by your contract. You need copyright laws to prevent subsequent distribution.

Without copyright laws, you'd then end up in the situation where people who paid for the software then are bound by the contract and would have to keep paying, and those who just downloaded it from a pirate site would be completely fine legally and could use the software with impunity. That would create a disincentive for anybody agreeing to buy the software and entering into a contract in the first place, essentially killing the industry.

You might not see a problem with that if you believe in Open Source, but most licences require copyright laws to exist to protect the software freedoms so that people don't just take the software and close source it.

Comment by brainwad 3 days ago

Yeah, I'm assuming most people here aren't selling proprietary code to customers directly. I assume most professionals here work somewhere that sells SaaS or uses the software they develop internally only.

Comment by loup-vaillant 3 days ago

If I recall correctly most software work goes to custom software. Note that in many, possibly most, cases, the (sole) customer retains the exclusive rights to the source code, making the software effectively Free per the FSF definition (because the user is free).

Almost my entire career was spent on such custom software. The rest was internal software. And even that one I was doing as a contractor, so in a way we could argue it was custom software even there.

Comment by ralferoo 2 days ago

Even if they don't sell the code to the customers directly (or even binaries, because that's what most customers actually care about), somebody in the chain is selling that software to the end customer and that money is going up the chain. It's kind of obvious really - if the work you're doing isn't creating saleable value, then your company won't be able to pay you.

But there is far, far more in the world that just SaaS or internal only software. Sure, companies are generally shifting towards SaaS (in part because it allows them another way to combat piracy, but also to extract recurring revenue rather than one off purchases), but there's still plenty of software you can go out to the shop and buy. Most of that wouldn't exist without copyright laws, because those developers would have found some other way of making a living instead.

Comment by brainwad 2 days ago

> somebody in the chain is selling that software to the end customer

Not necessarily? Any infra software is invisible to the end consumer. It's bundled into the price the customer pays for what they see, but they themselves don't know or care about the former.

> there's still plenty of software you can go out to the shop and buy

... is there? I haven't bought software in a shop in 20 years at least. Outside of games, I don't really buy software digitally, even. It's either FOSS or it's a subscription.

Comment by otterley 3 days ago

That is a false assumption.

Comment by denkmoon 3 days ago

yeah I wouldn't be able to put food on the table if my employer didn't have exclusive license to the glue we use to stick together all that open source code we rely on. Which we now generate exclusively using AI, products of which are of unclear copyright status.

Modern IP law inhibits productivity more than it helps, imo. LLMs have fundamentally changed our line of work, and they have done so by completely ignoring the existing legal framework for IP. We should not defend the current implementation just because some people might suffer reduced earning potential.

Comment by otterley 3 days ago

Copyright was not designed to maximize productivity. It was designed to maximize creativity and inventiveness (or, as stated in the US Constitution, the progress of science and the useful arts).

Comment by ekianjo 3 days ago

> t was designed to maximize creativity and inventiveness

If you look at outcomes it has completely failed while making big corps very rich in the process

Comment by hnlmorg 3 days ago

Unfortunately that will happen irrespective of the law.

If you want permissive rules then corporations will just resell your IP (like we see with SaaS). And if you want tighter rules then you just create a higher barrier for entry that benefits corporations rather than independent entities.

Either way, it’s easier to operate when you already have a leading position.

Comment by loup-vaillant 3 days ago

Then just outlaw big corps. Put a hard cap on company size or capital, possibly on a per-domain basis. Or just put what has to be big infrastructure under direct state control. Worked wonders in practice in France.

Oh, and also put a hard cap on individual wealth while we're at it. No one, no matter how hard working, deserves a billion dollars. And no one should be trusted with that much power, it's too goddamn dangerous.

(The caps should be indexed to stuff like median income or wealth. Wanna get richer? There's a way: help everyone get richer. That way we're actually in this together.)

Comment by furyofantares 3 days ago

Linux is a marvel of the world and a large amount of its contributions have been made by people being paid to do so for commercial purposes - and I am not sure that would be true without the GPL. Is there a convincing argument there?

And outside open source there has been a staggering amount of creative work at all quality levels done for commercial purposes under the protection of copyright. Is there a convincing argument that the last century of software and music and books and etc would have been just as staggering without copyright?

I would love to hear such an argument. In my youth I thought copyright was blatantly stupid and should be abolished. I still sorta think that but I don't have a convincing argument in the face of the absolutely massive amount of good work that has been produced under it.

Comment by jMyles 3 days ago

> Is there a convincing argument that the last century of software and music and books and etc would have been just as staggering without copyright?

> I would love to hear such an argument.

Fortunately, one of the many tentacles of the octopus most obviously at the forefront of the zeitgeist of the freedom that arises from a culture of free information - The Grateful Dead - had the outcome of producing - in the form of gripping autobiography - an extremely compelling, and seemingly utterly true and beautiful and good, instrument to fulfill your request:

https://www.goodreads.com/book/show/36750087-mother-american...

If you don't want to read a whole book and just want a stump speech which kicks ass in the department of argument you're requesting, it's here:

https://www.youtube.com/watch?v=rLbqgG6o1n8

Comment by otterley 3 days ago

Nonsense. Thousands of new TV shows, songs, and apps that come out every year and put food on the table for hundreds of thousands, if not millions, of people that help produce them.

Yes, some people and companies benefit disproportionately, but those tend to be the ones who finance the process and bear the risk of loss due to failures and flops.

Comment by cannonpr 3 days ago

I’ve written software all my life, copyright has never been relevant to my earnings at all, trade secrets have been to some extent. Frankly copyright was meant to enable more sharing and benefiting the public domain, instead it’s become a cancer…

Comment by otterley 3 days ago

For every rule there is an exception.

Comment by 3 days ago

Comment by loup-vaillant 1 day ago

I love the self contradiction in this one.

Comment by jMyles 3 days ago

I'm guessing you didn't click my profile before writing this knee-jerk, but I'm a professional musician. And I've worked in software engineering, across a zillion different licenses, for many years.

I'm not just shooting from the hip here.

Comment by otterley 3 days ago

I'm a trained attorney who specialized in intellectual property law, and I happen to know a little about both the performing arts and software industries. It does serve people and power entire industries.

You wrote "copyright is serving exactly nobody today." If that's not what you meant, choose your words more carefully next time. This is a forum of writing, and, much like songwriting, the right words and nuance matter.

Comment by jMyles 3 days ago

> I'm a trained attorney who specialized in intellectual property law, and I happen to know a little about both the performing arts and software industries.

To be frank, it sounds like you are part of the problem, and that your income may partly be derived from rent-seeking via the intellectual property regime. Is that correct?

> You wrote "copyright is serving exactly nobody today." If that's not what you meant, choose your words more carefully next time.

Well, I suppose it depends what sorts of engagement we can understand as "serving". By "serving", I do not mean merely enriching. Of course we all recognize that there are massive industries which are enriched by this system; where we may disagree is whether any actual services in rendered to the folks doing the writing and recording and touring in exchange for that enrichment.

At present, I think it's perfectly reasonable to observe that _musicians_ are not _served_ by this configuration. To the contrary, it has spawned a complicated system of publication, with many musicians facing the subpar customer service experience of services like distrokid and cdbaby facilitating distribution to services like spotify and apple music, while the RIAA and MPAA employ legal threats and harassment to the more musician-friendly DRM-free and direct-to-consumer counterparts.

I think it's also fair to say that, since the beginning of music, no musician ever has wanted a system whose function is to call the cops of their fans. And ultimately, that's what copyright is - it lets me send the cops in to fuck with fans who... try to share my music with their friends? It's awful from first principles, even if the implementation weren't as rotten as it is.

You said, "Except for nearly everyone who writes anything (including software) or other artistic pursuits to make a living" in response to this statement. So I think you have no leg to stand on in terms of demanding disambiguity; your statement is flatly and demonstrably false. Every musician I know (including, I'll bet, musicians you listen to) - and I'll bet, every one that you know too - has seething daily contempt for lawyers who make these asinine claims.

Comment by otterley 3 days ago

> To be frank, it sounds like you are part of the problem, and that your income may partly be derived from rent-seeking via the intellectual property regime. Is that correct?

That is not correct. My current role is a technical one, not a legal one.

> where we may disagree is whether any actual services in rendered to the folks doing the writing and recording and touring in exchange for that enrichment.

Besides studio time, connections to expert studio musicians, producers, engineers, advances and royalties? You may think the amount of support is insufficient, but that's different from claiming it's zero.

> no musician ever has wanted a system whose function is to call the cops of their fans

Have you ever heard of Metallica, Dr. Dre, or Slipknot? (https://en.wikipedia.org/wiki/Metallica_v._Napster,_Inc.) While they didn't call the cops on their fans, they fought hard against businesses who facilitated mass copyright infringement and made it known they were vehemently against piracy. They took a lot of heat for it from entitled children, but the vast majority of fellow artists quietly supported them.

> Every musician I know (including, I'll bet, musicians you listen to) - and I'll bet, every one that you know too - has seething daily contempt for lawyers who make these asinine claims.

Of course they do, but they sure as shit aren't giving up their advances and royalty checks that feed themselves and their families.

I would humbly suggest you spend some time among professionals in Hollywood (music, movies, and TV). You'll learn a lot. There are entire neighborhoods--not just posh ones in the hills--of people who earn their daily bread in the industry. I know; I grew up among them. Middle class, salt-of-the-earth folks.

Comment by jMyles 3 days ago

> That is not correct. My current role is a technical one, not a legal one.

Well then I apologize for my presumption.

> Besides studio time, connections to expert studio musicians, producers, engineers, advances and royalties?

The first four of these have nothing to do with IP schemes and are widely available to those of us who grind not only our music but our social connections. I publish all of my music as CC0 or CC-BY-SA (and of course all DRM-free, as is nearly all bluegrass now), and I think my studio records and collaborations show quite clearly that I have not suffered from lack of access to top talent. If anything, the notoriety of my IP activism and development of p2p tools seems to have made me _more_ interesting to most of my favorite bluegrassers; I'm not sure I'd have been able to make either of my studio records without the good will that has come from this.

Royalties are obviously a complex topic with a strange history, but I see no reason to lose confidence that we can engineer a system by which funds flow form fans to musicians in a way that is at least as just (and is more direct) than royalties.

Advances are obviously an issue, I grant that. And it's not just the check getting cut, but the negotiating power from the label side to do the tour launch, get on the studio and mastering calendars, push to playlisters and radio stations, etc. - a lot of these activities are (in my opinion, cringely) crosswired with the systems of contracts and advances.

I have almost no familiarity with the motion picture industry, and only a passing connection to soundtrack musicians.

But I have repeatedly been shocked to find that even when one of my friends writes a big hit, they receive what seems to be a joke in terms of financial compensation.

Yes, of course Metallica made that fuss. But they didn't outwardly say, "we want our fans arrested" - they dressed up their complaint as a qualm toward an industry too tolerant to the presence of p2p file sharing (what today we might even call freedom of general purpose computing).

In other words, they kept the quiet part quiet. And in any case, if that's the closest thing we can picture to a band wanting to call the cops on their fans, I feel reasonably secure in my assessment.

Much of your comment seems designed to question why I want to take money out of the pockets of these entire neighborhoods of salt-of-the-earth folks. I don't. My contention - the obvious observation I believe - is that the framework of casting their work as intellectual property has impoverished rather than enriching them, and that a better way is coming.

If you stand on the east bank of the Cumberland and look west, I hope you notice that nearly all of the glitzy logos atop the high-rises are financial firms - Third Fifth, Wells Fargo - I can't immediately remember the rest. Obviously the batman building notwithstanding. :-)

The intensity of financial firms in and around downtown Nashville is a testament to how many billions have been diverted from their fan-=>artist path and have instead made their way into the pockets not only of studio execs, but their underwriters and insurers.

Since the internet seems wont to route around IP laws anyway, I feel strongly that we live at a moment of opportunity to right this wrong.

Comment by otterley 2 days ago

> the framework of casting their work as intellectual property has impoverished rather than enriching them

Some hit artists might disagree with you.

Besides, the ones who flopped don’t owe the rightsholders money from their own pockets. It’s not a “heads I win, tails you lose” situation for the artists. In some ways an advance is a better deal than a typical business loan. In fact, a business loan is a pretty good approximation of a typical early record deal. The challenge is that it’s often difficult to get artists to understand that.

> The intensity of financial firms in and around downtown Nashville is a testament to how many billions have been diverted from their fan-=>artist path and have instead made their way into the pockets not only of studio execs, but their underwriters and insurers.

Well, yeah. For every hit artist there are thousands of flops. Someone has to bear the risk of developing the artists, building repertoires, fronting the money to make first records, and marketing. It’s an axiom of capitalism that the party that takes the biggest financial risk gets the biggest share of the rewards.

I think what you’re really saying is that you think artists deserve a bigger share of the profits. That’s a fair position to hold, but it’s a rather differ one from the statements I was previously responding to.

Comment by ekianjo 3 days ago

People made a living juste fine before copyright stop spreading myths

Comment by bruce511 3 days ago

>> Copyright is serving exactly nobody today.

Are you sure about that?

So just to be clear;

You're advocating for the end of software licensing? Ie the removal of GPL or Open Source licenses? A landscape where any source code (or binary) can be snapped up by say Amazon or Microsoft and run via a paid subscription?

You're advocating for a business model which removes your access to local code and only allows access via a terminal or browser?

Because removal of copyright doesn't mean corporations go away. Rather it incentivizes business models that protect their products in other ways.

In the 80's and 90's, pre-internet, binary programs were distributed on media. An arms race of copiers and copy protection ensued. The copiers won, and since copyright enforcement has always been weak, business changed to favoring remote access (with subscription) over running locally via purchase.

At the same time Open Source and Free Software have thrived. Copyright protects that software being used outside the terms of the license. Indeed there's even outrage when it's used within the terms of the license (by AWS etc.)

Of course OSS still thrives under a copyrightless environment. (Free Software less so). But equally it means AI can simply be trained on it (probably no great loss since it's likely most of OSS will be AI generated anyway.)

Business however will adapt. And the easiest way to prevent coping now is simply remote execution. With a suitable Terms Of Use declaration.

Outside of software it would destroy music, movies, books etc. Basically it becomes a race to the bottom in terms of production costs (think user-generated You-Tube as the high-water mark.) But I assume you meant in the context of software.

Yes, I agree, that in much less than 1000 years copyright is dead. Because by then so much is in the public domain it doesn't matter anyway. Also because by then the last human programmer is long dead. AI will write anything you want, only you won't even ask because computer interfaces and abilities will be long past where we are now. You would have no need to create software any more than you need to build a plane or car today.

And those industries have taken less than 150 years to invent, explode, consolidate and commoditize. Indeed most of the complexity disappears when we go EV.

In 1000 years copyright is gone. But today it serves a lot of people.

Comment by ElFitz 3 days ago

> Copyright is serving exactly nobody today.

As a budding wannabe fiction author, I certainly hope you are wrong.

Comment by 3 days ago

Comment by lyu07282 3 days ago

> It'd be great for this to be the first major relinquishment of nation-state power

Intellectual property serves corporate interests and the idea of "nations" you are forced to have in your head are the exclusive servants the interests of capital. Ironically, tragically, that's what's holding us back from dismantling it in the first place, even a critic of it can't articulate it properly.

Sorry that will be undecipherable for HN. Let me try again: The defense you get in this pigstall is the individual that copyright is protecting. You just hate the small businesses and individual artists. Instead of the trillion dollar industry holding the copyrights and the practice of exploiting copyright on works by authors who died decades ago. The commodification of copyright of something produced by the lowest bidder, crappiest AI and cheapest third world labor you can get your literal bloody hands on. Or even a vaccine against the literal plague or cure for cancer protected by intellectual property.

To make something immaterial with no cost to reproduce, a commodity, to trade and invest and speculate in is the part to argue if you want to dismantle it, identify the rotten bits of the system even peasants can smell. If you are a billionaire or even trillionaire then just argue like everybody on HN always does, because it's identical.

Comment by loup-vaillant 4 days ago

My fear exactly.

Comment by sparkling 4 days ago

>So you're supposed to block VPNs as well? What's next, Tor exit nodes? New VPN and Tor nodes as they pop up?

Trivial to do nowadays: https://focsec.com/

>I really don't like where this is going.

German courts think the internet revolves around German laws. There are some really insane cases, sometimes they will consider a website to fall under German jurisdiction simply for having a German-language version (somehow ignoring that Austria and Switzerland exist, ignoring German-speaking minorities in other countries, ignoring that a fully automated translation in 100+ languages is now possible at the click of a button).

Comment by numpad0 3 days ago

German federal LE agencies have been doing it for years. Threatening to put you on lists of wanted and sanctioned individuals as a basically islamic suicide bomber for not taking down tiny things globally.

That kind of thing isn't unheard of for police agencies with moral and oversight issues, though. Orgs start seeking for bigger reasons. A simple copyright issue creatively expounded into an imaginary global drug bombing cyber trafficking crime ring takedown creates a massive internal win. So they do that.

Comment by dotBen 3 days ago

In related news, the Spanish soccer league LaLiga successfully won an injunction against Cloudflare so that during Spanish soccer matches ISPs have to prevent access for their users to the entire Cloudflare CDN network.

The reason is that the CDN network is/was being used to illegally stream games so access to the entire CDN network is closed.

https://apnews.com/article/laliga-cloudflare-piracy-spanish-...

https://hayahora.futbol/#sobre-los-bloqueos (click "IN" to view in English)

Comment by rz2k 2 days ago

There’s a reasonable solution. Banks and vital services that use Cloudflare need to win an injunction that enjoins LaLiga from playing matches.

Comment by thi2 4 days ago

German courts and technology are not always the best friends

Comment by itsamario 3 days ago

Funny aspect is law is building demand for more capable ISP equipment devoid of principles.

Anybody can change their DNS and for an ISP to perform a man in the middle on all dns they would need to inspect every packet. Impossible

Comment by mikestorrent 4 days ago

There's some irony in Germany using censorship for the purpose of ensuring people don't get into reading materials that might convince them to become... fascists who censor people

Comment by p-e-w 4 days ago

There is no irony. The German government is proto-fascist, and has been for a while, as are several other European governments. Apparently the UK now arrests more people per capita for online speech than China does.

Comment by ahartmetz 4 days ago

I would like to see your definition of fascism under which the German government is proto-fascist.

Comment by p-e-w 3 days ago

An authoritarian state that exercises oppressive power through legalistic institutions in league with a corporate oligarchy.

Comment by panarky 3 days ago

Germany has its problems, but it's consistently in the top 15 most democratic nations in the world.

Calling a solidly democratic nation "fascist" is a rhetorical reversal straight out of the authoritarian playbook.

Comment by p-e-w 3 days ago

> Germany has its problems, but it's consistently in the top 15 most democratic nations in the world.

According to what? Some think tank’s “democracy index”, carefully constructed to preserve the illusion that Western countries are free and democratic? That’s begging the question.

Comment by peterfirefly 3 days ago

Germany does not look "solidly democratic" from the outside.

Comment by ahartmetz 3 days ago

Source: Russia Today?

Comment by antonkochubey 3 days ago

Germany’s last officially fascist government was democratically elected

Comment by panarky 3 days ago

Citation needed.

Comment by sekh60 3 days ago

For Hitler? He won the most seats of all the parties in the Reichstag in 1932 with 37 or so percent of the vote. That majority would normally have gotten him appointed as Chancellor (by tradition).

He used violence and backroom dealing to get from that majority to become Führer, but without a doubt Hitler did get his foot into the door democratically.

Comment by panarky 3 days ago

He was never democratically elected.

Comment by ajjahs 4 days ago

[dead]

Comment by zmgsabst 4 days ago

[flagged]

Comment by ahartmetz 4 days ago

Mentioning evil Soros is like a 100% reliable political crackpot indicator, even though this here is a quite original take. He is usually an evil Jewish globalist, i.e. a nefarious leftist.

I think he seriously pissed off the right people in Russia who are now throwing whatever shit they can think of at the wall, and some of it sticks. They do not try to be consistent at all, anything that will convince someone is fine.

Comment by zmgsabst 1 day ago

I’m American — I just view politics through form rather than propaganda. Eg, the concept of “left vs right” arises from USSR propaganda distancing themselves from fascists, who believed in similar practices.

You should also respond to the substance of what I said, rather than engage in ad hominems.

Comment by lqstuart 3 days ago

At this point my vote is to just shut off the internet entirely in the EU

Comment by pbhjpbhj 4 days ago

On the Quad9 website:

>Since Quad9 already performs DNSSEC validation, DNSSEC being enabled in the forwarder will cause a duplication of the DNSSEC process, significantly reducing performance and potentially causing false BOGUS responses.

This sounds dodgy. Surely that means Quad9 can poison my DNS?

Comment by usr1106 3 days ago

I use Clouldflare DoT and enabled validation in systemd-resolved some time ago. Not because I would be particularly paranoid, but more out of curiosity how it works. I noticed no problems, except for with Atlassian. They use 2 second level domains (at least), one under .com signed and one under .net (unsigned) (IIRC). Most things worked like normal, but some Jira extension stopped working. Turned out that systemd did reject their signed subdomains. Could not figure out whether the rejection was justified or not. When I asked Claude 7 times about it, I also got 7 contradicting answers... Reported to Atlassian support that their signing is incorrect (some delegation missing). To my surprise they replied: Are you using systemd? And gave a bug number that systemd handles validation wrong in their case.

Haven't had time to study the bug and really understand the whole issue myself. Just left it there with the takeaway that local validation is currently not for non-experts.

(Sorry not at my computer. Details rather vague from memory.)

Comment by Arainach 4 days ago

Not if Quad9 is using DNSSEC, no.

What's the specific threat you're envisioning? If it involves Quad9 themselves being malicious, what would DNSSEC on the forwarding prevent?

This page explains how all of this works in detail: https://quad9.net/news/blog/quad9-enables-dnssec-on-all-serv...

Comment by zamadatix 4 days ago

DNSSEC validation on your forwarder would prevent a maliciously modified record from Quad9 (or others) from being accepted locally - i.e. "Quad9 can poison my DNS".

I've always been of two minds on this. On one hand, that concern is beyond any reasonable level of security/performance/reliability tradeoff for most any user. At the same time, it is a bit of a shame DNS doesn't have a more scalable & performant approach to security which can just always be done without having to consider it a tradeoff, however minor in practice.

Comment by justsomehnguy 4 days ago

You are rely here on the assumption what your resolver already knows what the zone is DNSSEC signed. If your forwarder or resolver strips that information?..

Comment by zamadatix 3 days ago

At a high level, one of 3 things happens:

1. The forwarder gets a response claiming the record is supposed to be DNNSEC signed from the parent (recursively traversing from the root). The forwarder checks the signature of this claim. If the signature is valid, the forwarder continues on to validate the signature of the record and checks its validity to know if the info was secure. If the signature is invalid, the forwarder knows any information any information is not able to be validated as secure

- Somewhere during the recursive checks through the root, the forwarder gets an unsigned (no DNSSEC) or invalidly signed (e.g. your stripped response) response. The forwarder knows any information is not able to be validated as secure.

- A claim for lack of configuration or support of DNSSEC records comes back. The forwarder knows any information is not able to be validated as secure.

So you always know whether or not the information was secure, it's just if it was insecure you don't know if it's because it was just never secured or if someone tried to tamper with it. And that should make sense, an insecure message is by definition one which you can't tell if it has been tampered with.

Comment by tptacek 2 days ago

You have two recursers (or recurser-capable systems, in the case of a forwarder), an upstream that you tentatively trust and a downstream one you trust completely (because end systems use stub resolvers and have to blindly trust a recursive resolver somewhere).

Can you be more specific about how, using current DNS software, that downstream resolver can reliably detect whether a zone is DNSSEC signed? The upstream recurser can erase every DNSSEC record in the tree if it wants. What does the downstream recurser do short of jettisoning the upstream and doing all its own recursive lookups?

Comment by zamadatix 1 day ago

Your other comment was [dead] before I could get to it for some odd reason so I'm going to reply here again since I know you're not a bot or anything :).

Perhaps the confusion comes from the context of the above being "what Quad9 says to do to your forwarder's DNSSEC configuration" and it'd be easier to ask this question with a fully fresh situation & context?

Comment by zamadatix 1 day ago

I can sense the doubt in the questions but I assure you what I'm discussing is just the defaults behavior of most DNS server software. E.g., I'll walk through below with BIND's default behavior when configured with recursion and a forwarder entry. The downstream forwarder (our BIND server) asks for all of the relevant DNSSEC records for the query to "example.com." from the root on down the FQDN. The upstream responds with a set of record responses. One of 3 things happens:

1) The signature chain checks out all the way to the root, who's key info comes from a file included the DNS software rather than a DNSSEC query. The integrity of the end record is trusted (not the upstream itself) and the process is complete.

2) The signature chain checks out but part way down it (explicitly) ends early. E.g. "example" is not configured for DNSSEC but "com" and "." are so .com ends the signature chain with a signed "example will not be signed" handoff. The process is complete, the record is securely known to be insecurely defined by the authoritative servers for "example" per the signatures from the .com records and the local security anchor (e.g. bind.keys file)

3) The signature chain doesn't validate at some point. This could be because the malicious upstream tried to modify a record or it could be because the malicious upstream tried to fake lack of record response even though it can't fake the parent domain's signature of that (recursively to the root because the root keys are local to the server). In this case, the invalid records from the malicious upstream are jettisoned in favor of trying to get valid responses via recursive resolution.

Tying it all back together: Because the downstream forwarder is only looking for the signature chain to trust the record, it just wants to get those records as fast as possible. BIND determines the most likely way to get a quick response is to ask the forwarder. It then checks the full signature of all of these, almost always bind was right - the forwarder had the records needed cached and didn't try to modify them. If the forwarder was malicious or just in error bind throws these away and tries to recurse the answer directly.

Quad9 wants people to disable it because it's extra record requests, most people don't care, and, if you trust Quad9, you can just send your request in a DoH or DoT tunnel to secure the last hop more efficiently while they do the validation of the record itself.

Comment by tptacek 1 day ago

I think we're talking past each other. There's no uncertainty about how DNSSEC works between servers. Any recursive lookup can validate a signature chain.

The question is how DNSSEC breaks down in the last mile, where recursive lookups aren't happening. A stub resolver --- every resolver on an ordinary workstation is a stub resolver --- can absolutely be tricked by its upstream DNS server. Quad9 can lie to clients about whether it validated DNSSEC, or whether DNSSEC was present at all.

Comment by tptacek 4 days ago

Wait, I must be misunderstanding you, because if you're resolving off Quad9, they can definitely poison your DNSSEC-signed records. Between a stub resolver and a recursor DNSSEC collapses down to a single "yes it was signed" bit in the header.

To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead.

Comment by joveian 3 days ago

I don't know the details but knot-resolver asks for DS records of the domain being looked up when forwarding to avoid needing to do a full recursive lookup to validate DNSSEC. As I recall from what I've read this works almost everywhere, including Quad9, but not Google DNS due to a bug that they claim to have identified three years ago but haven't fixed. But as I understand it this is not how recursive resolvers validate so it is extra data that the forwarding server needs to request and cache.

Comment by QDwQ1 4 days ago

> To protect yourself from an upstream resolver using DNSSEC, you need to be doing something akin to a full recursive lookup yourself. This is a flaw in the DNSSEC design and a reason why DoH took off instead.

What? I don't see how you can call that a flaw in DNSSEC when DoH is no better in this regard; it doesn't even attempt to protect against a malicious recursive resolver. The only way to do that is to validate DNSSEC on the client.

Comment by tptacek 4 days ago

DNSSEC and DoH provide different security services. But to get the benefit of DNSSEC, you need to resolve recursively. DoH works for stub resolvers. That's all I'm saying.

Comment by thenewnewguy 4 days ago

Technically yes, in practice the odds your local resolver is validating DNSSEC is slim (and if you're intentionally configured it to do so, switch to a provider that isn't Quad9).

Comment by oofdere 4 days ago

Quad9 doesn't have an adblocking DNS service though, so it's not really a replacement.

Comment by ripdog 4 days ago

That's something people should run themselves. I run Adguard Home on my router. Unlike the main Adguard product, Adguard Home is fully FOSS. It's been rock-solid for me, and improves on pi-hole in various ways - like full IPv6 support.

Comment by godelski 4 days ago

  > That's something people should run themselves. I run Adguard Home on my router.

I'll second this. People should really be flashing their routers. OpenWRT is simple enough that if you're on HN I think you'll easily be able to do it. And like most routers, you set it up and forget it.

But you'll also get a bunch more benefits from OpenWRT, to make it worth your while.

  - I was able to buy a router for <$100 that was WiFi 7 capable (W1700K[0]) and had better hardware than most consumer routers. You can find plenty of cheaper routers that are flashable and more capable.
  - Adguard Home
  - Split tunneling/VLANs: Since we're talking Mullvad, you can put devices behind Mullvad on a VLAN. So activate Mullvad by changing SSIDs.
    - Trivial to put IOT devices on a VLAN (can make one directional too so you can access from your main network but they can't reach back. I throttle everything IOT)
  - Tailscale
  - QoS (Control the speed and prioritization of different connections)
  - It's a fucking computer, you can even run shell scripts

[0] You don't need something like this unless you're getting >1Gbps from your ISP. Big thing I wanted is the 2 10G ports.

Comment by sgc 4 days ago

It's probably the software I trust the most on my network to 'just work', and with the local caching I can use slower upstream dns providers and still have sub 1ms average latency (no performance worries by excluding google and cloudflare). I don't use it for dhcp, but it is a good fit that it's available as well. Couldn't be happier.

Comment by Brybry 4 days ago

I use Mullvad's adblocking DNS server on my phone which is not always behind my home router.

Comment by godelski 4 days ago

If you're on Android, FF supports add-ons.

If you're on an iPhone, uBlock is now supported: https://apps.apple.com/us/app/ublock-origin-lite/id674534269...

There's also Orion browser, but I found it to be a bit more glitchy, especially around sites like YouTube (fuck the app, I'm not watching videos there): https://orionbrowser.com/

Comment by Brybry 4 days ago

Yes, I use Firefox on Android with ublock origin, it works great. But using adblocking DNS on your phone will also block most in-app ads which is a big quality of life improvement.

I could also use a VPN to keep my phone always on my home network and thus behind my own ad blocking DNS but Mullvad's adblocking DNS was really nice and convenient.

Comment by nibbleyou 3 days ago

You can use NextDNS as your dns provider on your phone or use Rethink DNS app like me

Comment by godelski 3 days ago

Really? I never found it effective unless I messed with certs on my phone.

For example, DNS blocking isn't going to block YouTube ads if you're using the app since they don't need to respect your DNS, but it will if you're in browser because they can't control that.

For apps I always use revanced.

Comment by Brybry 3 days ago

Ads from providers like Google AdMob and AppLovin are blocked. Apps could bundle their own DNS or DoH resolver or use hardcoded static IP addresses but in my experience most do not.

Youtube ads do not get blocked by DNS adblock because Youtube ads are served from the same domains as the content and thus DNS blocking would be counterproductive. I don't think it has anything to do with respecting DNS.

I don't have the Youtube app installed to test but the Internet suggests that at least in 2023 it was very possible to block the Youtube android app (content and all) via DNS, which hints it does not bypass system DNS. [1]

[1] https://superuser.com/questions/713289/blocking-youtube-andr...

Comment by godelski 3 days ago

Are you explaining my comment or rebuting it? I really can't tell what the intent is. Maybe the internet has trained me poorly in thinking most replys are generally rebuttals. But it really does seems like you're just explaining my comment.

Comment by Brybry 3 days ago

Mostly a clarification of what I find DNS ad blocking works for on Android, which seems to be somewhat different from your experience (probably we use different apps).

A weak rebuttal of the reason why DNS adblock doesn't work for Youtube and the Youtube app.

Comment by exhilaration 3 days ago

FYI I don't see YouTube ads on Android + Firefox mobile + uBlock Origin

Comment by Denatonium 4 days ago

The uBlock Origin lite that can run on iOS is very limited compared to the uBlock Origin that runs on Firefox Android.

Comment by godelski 3 days ago

Sure, but you're on iPhone. It's better than nothing.

I'm on your side but telling people to buy a new phone doesn't solve their problem. Short of that uBlock and/or Orion are their best options

Comment by oofdere 4 days ago

It's not the same thing at all. Mullvad DNS blocks all ads across the system.

Comment by windexh8er 3 days ago

I've been using NextDNS [0] for a long time. It's worth the price because you can set up all kinds of different blocking profiles and have different ones on different devices, allows you to have overrides for local network items (or internals like on a Tailnet, Pangolin, Wireguard, etc) and a lot more. The ad blocking ends up working so well a lot not only are ads blocked on web pages but it works with some streaming audio ads as well as VoD that has ads injected. Highly recommend.

[0] https://nextdns.io

Comment by godelski 3 days ago

Up until the developers roll their host files into their app. That's why a pihole doesn't stop ads when you use the YouTube app.

Look, I still run AdGuard on my router, but it's not the same thing

Comment by oofdere 4 days ago

I could, but DoH/DoT seems very involved to run yourself, and sometimes I need to give a recommendation to someone less tech-savvy.

Comment by XenoCyber0 4 days ago

I stopped recommending anything I host myself for those people. When it breaks I'm the support team, and I'd rather not be. NextDNS free tier is what I give them now, takes two minutes, and I never hear about it again.

Comment by PhageGenerator 3 days ago

I'd argue you don't need to run DoT/DoH yourself if it is just for your local network.

Setting up a local resolver, such as a Pi-Hole or Unbound on a firewall can serve unencrypted responses to your devices. Those resolvers in turn can use DoT/DoH with their upstream resolvers to encrypt the requests that go through untrusted networks on the Internet.

This is the best of both worlds, the simplicity of unencrypted DNS while encrypting traffic where it matters.

Comment by ornornor 4 days ago

Mullvad had adblocking, malware blocking. And they didn’t block websites from governments blacklists in France and Italy. None of these features are available on Quad9.

Maybe it’s time to try nym.com?

Comment by 1970-01-01 4 days ago

This is a very important detail. Adblock in 2026 is necessary and DNS will transparently do a lot of that work for you. It isn't just about lightning fast lookups and five-nines uptime anymore.

Comment by cortesoft 4 days ago

For blocking, I would much rather run my own service.

Comment by LetsGetTechnicl 4 days ago

I've been loving the Pihole setup I just set up. It uses Quad9 as the upstream provider and then I do all the blocking myself. I used to use NextDNS but this is so much better and free!

Comment by vardalab 4 days ago

Technitium is also really good as a performant local blocker and recursive dns server. I have been running mine for years now and it is fast as well.

Comment by upcoming-sesame 3 days ago

How do you block ads when you're outside of your home network? Do you expose your pihole outside?

Comment by LetsGetTechnicl 23 hours ago

I set up a WireGuard VPN and use that to connect back to my home network. It's fast enough for what I do on my phone.

Comment by cortesoft 3 days ago

VPN back to your home network?

Comment by LetsGetTechnicl 23 hours ago

Yeah I have a VPN set up. I don't have the best internet so sometimes it's slow (mostly just app downloads seem to take the longest, so I'll just disable it and then re-enable it.) But it works just fine for streaming, including video

Comment by upcoming-sesame 3 days ago

I've assumed the latency suffers then

Comment by cortesoft 3 days ago

You could set it up to only route DNS, but that might be complicated for most people

Comment by BatteryMountain 3 days ago

My setup goes like this:

Fiber ONT -> Proxmox x86 -> OpenWRT -> Adguard Home -> unbound -> Quad9.

Browser: Firefox + ublock origin & privacy badger & strict privacy setting & Https-only.

My internet is rock solid and super fast, extra low latencies. OpenWRT shapes my traffic to 90% of line speeds, so zero bufferbloat on my end. All my devices connect to this setup. The proxmox box is just an old dual core mini-pc with 8gb ram and 2x 1gbps NIC's and a wifi 6 module for 2.3gbps wireless (only 5Ghz, no 2.4Ghz). I want to replace this box with a new one to get 2.5gb ethernet & better power efficiency as my box is a 51W cpu, but total powerdraw is about 20w without causing wifi to drop. Aggressive power saving can make wifi unstable.

Comment by zormino 4 days ago

I've been using Control D and have been happy with it so far

Comment by seany 4 days ago

I'm all for supporting quad9; but what if we just disable dnssec instead, it really solves nothing and continued support of it just makes it show up in compliance guides unnecessarily.

Comment by subscribed 3 days ago

Terrible. No malware / trackers / ad blocking on 9999.

I hope at least they'll keep these options in their tunnel configuration but if not there's not much sense in keeping their service....

Comment by mentalgear 4 days ago

I'm always wondering whether those centralized privacy services are not the easiest first target for three-letter-agencies to infiltrate to gain access to the most relevant users to track - and what currently would prevent them from doing so if they haven't already ? Maybe, as with the case of many TOR nodes , they might be running them.

Comment by autoexec 4 days ago

I don't think there's any company with useful information on the American public that isn't being forced to regularly hand over that data. That's probably been true to some extent for a long time (see Room 641A) but it's certainly gotten worse. At this point you can't check out a book from the library without the feds demanding that your librarian turn over a list of everything you've ever read, or rent a hotel room for a night without the hotel being forced to provide your information to the government.

Use an online service that's new enough and small enough and it might not be compromised, but the moment it gets popular men with guns and national security letters with gag orders will show up to install hardware on their prem, take over entire offices, or just demand reports.

VPNs and secure DNS services aren't there to keep your data from the NSA, ICE, or even the police. They are useful for keeping your ISP from selling your browsing history to anyone willing to pay them (https://www.mitnicksecurity.com/in-the-news/republicans-just...). It'll help keep a little of what you do online away from data brokers, keep your ISP from sending you DMCA notices, and not much else.

Comment by morserer 4 days ago

For clarification, this is completely true of the US, without needing to speculate, thanks to a combination of FISA 702, the ECPA, CALEA, EO 12333, and the CLOUD act. It all has legal footing in the States.

However, it's not at all the reality of a vast swath of other countries (or, at least, not yet; see Chat Control v2). The US is particularly foul (and effective) when it comes to this practice, but anything outside of US jurisdiction that doesn't have an office in the US can't be touched by laws like these, and the laws of most other countries tend to be significantly less invasive than American ones when it comes to data interception and the practices surrounding it.

Comment by hulitu 2 days ago

> However, it's not at all the reality of a vast swath of other countries

Citation needed. At least in DE it is also true.

Comment by ajjahs 4 days ago

> and what currently would prevent them from doing so if they haven't already

they arent gods. some people actually have moral standards and dont just do whatever a foreign agency wants them to do

Comment by greyface- 4 days ago

Adversaries don't always ask nicely. Sometimes they break in and silently take the data. These services centralize traffic flows and make it so that an adversary only needs to tap one or two circuits to get a full picture for all users of a service.

Comment by tancop 4 days ago

CIA is not stupid enough to break into a guarded data center in Switzerland or one of the less America friendly EU countries. They tell the NSA to look for security holes and spread narratives that only criminals use VPN hoping that a politician will notice and try to ban them, like what's happening in the UK.

Big tech services are less private than you think but almost every provider who cares about privacy is safer than you expect. Most of the people who work there are committed to their mission, and if they ever get a gag order someone will leak it in no time because they know exactly how to do it without exposing their identity.

Comment by pocksuppet 3 days ago

Are you sure? Someone broke into a Hetzner data center and a Linode one, physically intercepted the Ethernet cables for jabber.ru, and got certificates signed on their behalf.

https://notes.valdikss.org.ru/jabber.ru-mitm/

https://news.ycombinator.com/item?id=37961166

Comment by PinkSheep 3 days ago

dear sockpuppet =) I think the above commenter meant illegal physical access. The jabber.ru MitM situation was likely carried out by a cybercrime unit of the German police forces with a court order... and this is the adversary most people forget about.

Lesson to learn: Let's Encrypt does not protect against MitM by a state-level actor, unless you take precautions. *let's assume network admins won't MitM your server for personal vengeance reasons

Comment by hulitu 2 days ago

> Lesson to learn: Let's Encrypt does not protect against MitM

But S in https stands for secure, or ? /s

Comment by greyface- 4 days ago

Why would they serve a secret subpoena and gag order, when instead they can just drive to a secluded location 5km away from the super secure datacenter, dig a few meters down, passively tap a strand or two, facility and service operators none the wiser?

Comment by radicaldreamer 4 days ago

They’ve already done both. When they can get a cooperative party (AT&T, for example), they colocate their splitter equipment. When they can’t, they tap undersea and overland cables.

When it’s a hostile environment entirely, they hack and do secret operations and bribe.

Comment by mrtesthah 4 days ago

The data would/should be encrypted; while the NSA did successfully tap Google's inter-datacenter traffic before the Snowden leaks, since then it is encrypted, too. Hopefully other providers won't fall for that trick anymore, either.

Comment by greyface- 4 days ago

IIRC, Google addressed the incident you're referring to by adding E2E encryption to sensitive inter-DC RPC sessions, rather than by fully encrypting inter-DC traffic at the link level. It would be nice to be able to reasonably expect carrier/ISP backbones to be secure against this threat, but in our actual reality this seems like fantastical thinking.

Comment by hulitu 2 days ago

> Google addressed the incident you're referring to by adding E2E encryption to sensitive inter-DC RPC sessions

And they don't provide the key to law enforcement because ... they care about your privacy. /s

Comment by ajjahs 4 days ago

[dead]

Comment by hulitu 2 days ago

> CIA is not stupid enough to break into a guarded data center in Switzerland

They don't need to break in guarded data centers. See Crypto AG

> or one of the less America friendly EU countries.

Besides Spain, there is no such country in EU. And even Spain might change its mind.

Comment by dunder_cat 3 days ago

This feels like a nitpick but it's important to mention anyway

> Mullvad Browser uses them [ the DoH servers ] by default when you're not on Mullvad VPN, preventing your ISP from seeing the domains you visit.

This is a half-truth until Encrypted Client Hello (ECH) is in-use for most of your traffic. Sure, you won't have clear-text DNS floating out there in the series of tubes. However, without ECH the hostname you're connecting to is exposed in the SNI field during TLS handshakes.

I imagine most sites we are browsing will eventually be able to leverage ECH, so this should become less of an issue over time, but in the event you frequent any self-hosted operations (e.g. no Cloudflare or similar), encrypted client hello could still reveal identifying information since it requires still exposing an "outer SNI" that a valid certificate needs to be presented for. You only get to easily hide in with the masses when you use a big infrastructure provider as a consequence, since the common outer SNI of cloudflare-ech.com doesn't really reveal anything different than an IP <-> ASN database would. But if the outer SNI is "dunder-cat-enterprises.com", then all I've protected you from is your ISP snooping on the subdomain or pinpointing exactly which one of my domains you might be talking to.

Comment by jiveturkey 3 days ago

Even ECH isn't that helpful. ISP still sees the IP addresses you connect to. Even when non-dedicated IPs are used, I'd be surprised if a quite basic traffic analysis (say, bytes transferred on first visit) wouldn't identify the domain.

VPN providers at the tier of Mullvad should be precise about this stuff -- I think it's more than just a nitpick, considering the audience. oh god did I just use an emdash.

Note that you need some flavor of secure DNS to enforce ECH. The protocol is designed to be downgradable.

Comment by iamnothere 4 days ago

Quad9 is a reasonable choice given the stance on privacy and the similar jurisdiction (Mullvad would probably face the same takedown orders as Quad9), but really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver. Unbound is a great choice.

Unbound can also be used to block malware and advertising domains using shared public lists, or you can build your own list. Your resolver’s DNS queries could be piped through Mullvad or Tor if you want additional privacy.

Comment by jcgl 3 days ago

I don’t honestly see how that’s necessarily better. Now your ISP can tap your individual household to see what’s being queried. Whereas if you use Do[THU] to connect to some remote recursive resolver it practically functions as a mixer.

Comment by iamnothere 3 days ago

That’s why I suggested routing queries through a VPN or Tor if that’s a concern. This bypasses centralized DNS services that may face national blocking orders while retaining privacy.

Comment by jcgl 2 days ago

I don't see how that's an improvement over using a big public resolver. Probably worse privacy (you've basically just swapped your ISP for another virtual ISP), and worse performance (likely longer network paths from your resolver to various authoritative servers, as well as not getting the benefits from the nicely-warmed caches that big public resolvers will have).

Comment by iamnothere 2 days ago

A “virtual” ISP may not have my personal details, especially if I am careful about it. I agree that it’s a tradeoff. Some people may live under regimes where big DNS servers are blocked or under legal orders, or they may have concerns about imminent DNS censorship or logging orders.

Comment by jcgl 2 days ago

- Personal details isn't the point (and while a VPN service may have those, a big DNS resolver certainly doesn't)--the point is that correlating DNS traffic with your source/home IP address is likely easier with a big DNS resolver. In any case, I don't see how the VPN approach is superior here.

- People may also live under regimes where VPN providers are blocked. Unless there's some order of magnitude more limitations on DNS resolvers, I don't see how the VPN approach is superior here.

Comment by iamnothere 2 days ago

Anonymizing VPNs, especially multi-hop ones, and Tor in particular makes correlation much more difficult. Mullvad paid in crypto or cash is a very good option.

I agree about blocked VPN providers, but in the real world it’s usually possible to get around those blocks, even in places like China where there are sophisticated national firewalls.

Comment by jcgl 2 days ago

These things you suggest incur significant latency. Also, can you simply pipe DNS over Tor? I don't see how, since Tor is TCP-only. I suppose DoT or DoH could potentially work, but not all authoritative servers may support those protocols. The TCP handshake will also add further latency.

Furthermore, even once you layer all that tunneling on top, it's still unclear how doing recursive resolution from your end of the tunnel is better than going through one of the big resolvers. The privacy benefits seem marginal at best. Overall, I don't think you have convinced me in the slightest of your original point that "really anyone who cares about bypassing national blocking orders should run a local caching recursive resolver."

Comment by iamnothere 2 days ago

If your centralized DNS server receives a blocking order, what are you doing to do? You’ll have to do something. Give me another alternative then. In the current geopolitical environment, this is not idle speculation, it’s a real threat.

Latency is a tradeoff, I mentioned there are tradeoffs. For an individual or home network, the latency should not be a problem especially with caching.

As for TCP/UDP, current RFCs say that DNS servers must accept TCP, but not all may follow the standard and some misconfigured firewalls may block it. But it doesn’t seem to be an issue when tunneling all traffic over Tor using something like Tails. So I don’t think this is really a problem.

Comment by jcgl 2 days ago

Same thing as if something equivalent happens to your VPN service I guess? Switch to another one.

Oh yeah crap, you're right about DNS over regular TCP. I totally brainfarted on that.

Comment by dbmnt 2 days ago

[dead]

Comment by david_shaw 4 days ago

It's not that I don't trust Quad9 or dns.sb or any of the others, it's just that I trust Mullvad more.

Sad to see this going away, but I assume this is so Mullvad can focus on their primary services.

Comment by burner420042 3 days ago

For awhile I self-hosted adguard dns server. It supports iphone profiles thus forcing iOS DNS. I eventually disabled it due to timeout issues specific to iOS. Issue was something DNSSEC related.

While reproing the issue I noted the average recursor round trip time from my OVH server hosted in Oregon to the default upstream DNS - Quad9 - was around 70ms. When I changed it to Hurricane Electric the roundtrip dropped to a steady 20ms. Later I changed it again to Cloudflare and the roundtrip was a consistent 2 to 3ms.

Comment by johnhtodd 3 days ago

Hi - I'm with Quad9 (CTO). I'm going to try to put together a single post replying to some of these topics.

First: We welcome the Mullvad users who will be shifted onto our systems, and we appreciate that Mullvad contacted us instead of doing this unilaterally. Since we have no signup process, they could have just moved users across but we very much appreciate their cooperation and communication, both with us and with the users of the service - this is exactly how an ideal transfer should go, at least from our perspective.

I'll try to make some short summaries of some of the points here, and a reply on each.

"You should just run your own DNS server - it's easy." - Yes, we agree that for a small company or home running your own recursive resolver is a reasonable solution. You probably won't get the threat mitigation depth of service that Quad9 offers, but you may not want that. Privacy also suffers a bit, since it's still the same IP address (your home "public" address) sending queries to authoritative servers, probably unencrypted. A good middle compromise is to run PiHole or AdGuard software, and forward your queries to Quad9 via an encrypted connection. (see below) This mixes your queries in with a large number of other users, and gets the potential improvements of having a much larger active cache nearby which will have "hot" answers. Running a home resolver for yourself or even a few dozen (or even a few hundred) people is not difficult. But with all services, things change with scale. As the query volume and number of locations grow, you soon find yourself hitting all possible exception cases, instantly. Many millions of requests a second requires a lot of time, expertise, and money to ensure nearly 100% uptime. We are admittedly quite a small group - less than 10 full time - but even that is under-staffed for supporting more than 100 million daily users. We do quite a bit with a very small resource set, and I doubt it could be done less expensively with the same robustness for the same scale. Again, we appreciate Mullvad's sponsorship to help keep this expanding at our normal weekly growth rate of around 2%.

"I want ad blocking, and Quad9 doesn't do that" - Correct, Quad9 does not do ad blocking at this time. There are good solutions like PiHole or AdGuard extensions that provide this functionality, and getting local control and logging of your DNS queries is probably useful for power users. There are also commercial platforms that provide this capability, and they may provide significantly more "knobs" for what you want to block. Quad9 is a non-profit - we're not out to corner the market, and as long as privacy and security is increased for the end user, we're all for commercial solutions!

"Quad9 blocks domains in Germany" - Currently there are no mandatory blocks that Quad9 is integrating or enforcing on our DNS platform, from any external party. We did briefly block some domains as a result of legal actions against us in Germany. The good news is that we won that case in Germany, after two years and three appeals and an enormous amount of time and money (which despite Germany's "loser pays" rule, is not even close to expenditures.) https://quad9.net/news/blog/quad9-turns-the-sony-case-around... The bad news is that the identical thing is happening now in France where we have a number of legal cases open against Quad9, and we do not see an end to this any time soon as long as there is an open question in the EU about what a content-neutral intermediary is and is not required to do.

"Mullvad exiting creates more centralization, and that is bad." On the fact that centralization is bad, we agree. DNS resolver centralization is not a great thing, and it seems to be trending in the wrong direction. It's not just large public resolvers - consolidation in the ISP industry is causing more and more of the world's internet-using population to utilize a smaller number of recursive servers. Those servers are operated (mostly) by law-abiding companies, and so there is a strong interest by various parties interested in control of content to "put a hand on the available throat" even though it's the wrong throat to choke. We're busy with some ideas of how to solve this, both from a legal defense position as well as a technology position - stay tuned in the coming months. In the meantime, you can contribute a few euros/francs/dollars to us and we'll have more funds to pay for legal defense in France and hopefully up to the EU courts. https://quad9.net/donate/

"Government agencies can tap data" - Quad9 is based in Switzerland. Despite what may be common knowledge from movies, there is a very formal and rigorous process for governments (Swiss or non-Swiss) to demand data. It is (ultimately) transparent, and managed in a way that is quite well structured - this is, after all, what the Swiss have been doing with financial data for many years. More importantly: Quad9 stores no user data about queries. There isn't anything to demand - the box of data is quite empty. Because of this technological decision and our wide announcement of it (https://quad9.net/about/transparency-report/) we have never received a request for data. As for technological methods: Quad9 operates in 200+ widely-separated locations, with no backbone or central data transport network - it is intentionally 'islanded'. It would be a significant challenge to intercept data at all those locations, though we're certain that there are many queries that are observed due to their presence on various ISP or cable networks which are under surveillance. We support all major DNS encryption methods today (even the two that run on QUIC - HTTP/3 and DOQ) and we encourage users to use one of those for their communications to us. We are also one of the few major resolvers experimenting with ADOx, which encrypts messages between the recursive resolver and authoritative server. (https://dnsprivacy.org/adox_status_and_deployment/)

Comment by PinkSheep 3 days ago

> On the fact that centralization is bad, we agree. DNS resolver centralization is not a great thing, and it seems to be trending in the wrong direction.

It seems all too similar to the degradation of peer-to-peer networks where nodes are replaced by few supernodes. You mentioned a couple reasons yourself: consolidation and legal pressure. Add to this the technical qualification aspect and time investment (Mullvad's position), and the financial cost of sustaining such a non-profit project. Suddenly there are very few people or even organizations worldwide, who can bear the burden.

Thank you for existing and your tireless work.

Comment by ignoramous 3 days ago

> Quad9 is based in Switzerland. Despite what may be common knowledge from movies, there is a very formal and rigorous process for governments (Swiss or non-Swiss) to demand data.

Due to Lugano Convention [0] / Budapest Convention [1] / Hague Convention etc, I don't see how Switzerland is any more insulated than, say, Norway is (both these countries are part of EFTA & signatories to various UN/EU/EFTA treaties). Per this article [2], Switzerland ranks below Ireland, Portugal, Denmark, France in Data privacy laws (in fact, it ranks the same as the UK).

If I am being honest, at this point, "based in Switzerland" (or Cyprus or Sweden or Gibraltar) comes across as marketing gimmick VPN companies are notorious for.

[0] EU civil & commercial law enforcement in Switzerland: https://www.legal500.com/guides/chapter/switzerland-enforcem...

[1] Mutual Legal Assistance Treaty (MLAT) is bypassed: https://rm.coe.int/16802e726c

[2] https://www.comparitech.com/blog/vpn-privacy/surveillance-st...

Comment by johnhtodd 3 days ago

Our goal is not "insulation" as much as it is "transparency." Governments that do not adhere to legal frameworks like the ones you reference above are also governments that have inconsistent or easily-changed legal structures - we are not hiding in some obscure and possibly unstable nation that ignores international standards. Our jurisdictional choice of Switzerland is the opposite of that. Switzerland has a strong history of making legal enforcement events transparent, with processes that follow expected process. We cannot avoid following the law, nor is that our goal.

Swiss data privacy law is also much more strict on us, which "puts our money where out mouth is" as the saying goes. Violating privacy laws in Switzerland may result in criminal penalties, not simply civil penalties - jail time, rather than just fines.

Comment by ek_erilaz 3 days ago

Thanks for this! I was looking at your transparency report (https://quad9.net/about/transparency-report/) and I notice 2026 is not included in the 'list of years in which we have not received a request for data', despite the list being updated quarterly according to the text below it. When I saw the page earlier, I assumed that either the list isn't actually updated quarterly, or I'd discovered an exciting example of a warrant canary.

Comment by johnhtodd 3 days ago

No, canaries in our opinion are not a particularly good idea for a variety of reasons. We have not received any requests/demands for information in 2026 - we'll try to update the page to reflect that this is no longer a quarterly update.

Comment by somewhatrandom9 3 days ago

I saw your response about not blocking ads currently. What about blocking adult content, for a child's computer? Mullvad had such an option[1] under family.dns.mullvad.net. Very useful!

[1]https://mullvad.net/en/help/dns-over-https-and-dns-over-tls

Comment by johnhtodd 3 days ago

This is an area that is fraught with challenges. Serving a truly global audience means standards are difficult to measure as to what is "adult content" - it varies widely (Wikipedia in some areas is "adult content", as an example.)

In the near term, there is no filter set that we offer that mimics that functionality.

However, we recognize some variation of "best effort" adult content segmentation is a useful filter to have. We're considering it in the near term, as we have some specific educational institutional pressure to try to meet as well, since students are often easy targets for phishing, classroom computers are rife with malware, and there is also the problem of inappropriate DNS-based profiling of students and schools - problems that Quad9 can help solve.

Comment by somewhatrandom9 3 days ago

Perhaps you could ask Mullvad how they did it? You might protect yourself with disclaimers that your results may not be perfect? You still could create a useful/ effective service even if it's not 100% perfect I would think.

Comment by iamnothere 3 days ago

Thanks for the clarification, I mistakenly assumed you were also required to block sanctioned media (mostly Russian/Iranian), but upon further research apparently that only applies to ISP DNS.

Comment by bjoli 3 days ago

You are probably the guy to ask. I have always found dns over TLS to be the fastest, but with the quic versions making an entrance, maybe things have changed. Which is the one that gives me the fastest replies?

Comment by johnhtodd 3 days ago

We actually quite like DOQ and DOH3, both of which use QUIC.

All modern Apple systems use QUIC. For instance if given 9.9.9.9 via DHCP they will automatically upgrade to encryption via DDR, then then upgrade to DOH3 with no intervention by the end user. We find that encryption load is lower with QUIC-based transports, but we need to really get a formal research paper together on that "in our spare time."

Faster? Probably, but is it measurably "better" remains a question for others to answer. Due to parallelism in most query sets, minor wins with DNS latency matter less than you might think.

Comment by TingPing 3 days ago

Not OP but I don’t think DoQ is very interesting. DoH is nice because it blends in with HTTPS. Both do the protocol level things to avoid connection handshakes. The HTTP overhead isn’t that much really.

DoT is more complex than you’d imagine because it has to try hard to implement its own solutions to avoid handshakes.

Comment by monster_truck 3 days ago

I'm not saying this is a canary, but I think it should be treated as such.

Comment by ianmurrays 4 days ago

Does anyone know of good alternatives that also block ads? Seems Quad9 doesn't.

Comment by Dezvous 4 days ago

NextDNS https://nextdns.io/

Comment by ornornor 4 days ago

Been using them for years. The price is reasonable too. It’s the only way I found to block ads everywhere on iOS (except the YT app, Mullvad’s Albania wireguard did that)

Comment by gmac 4 days ago

The price is so reasonable, I think the risk is that you’re paying mainly with your data?

Comment by mgrunwald_ 4 days ago

https://controld.com/free-dns

Comment by hexfish 4 days ago

https://joindns4.eu/for-public#resolver-options

Comment by mikalauskas 3 days ago

they block duolingo

Comment by radikalerludwig 3 days ago

good. Babbel is superior

Comment by SamDc73 4 days ago

nextdns.io might be an option

https://adguard-dns.io/kb/general/dns-providers/ have a list of options that some of them have ad blocker

Comment by ripdog 4 days ago

https://github.com/AdguardTeam/AdGuardHome/releases

Trivial to self-host, and gives you full control of blocking.

Comment by sparkling 4 days ago

Several (European) alternatives are available: https://eualternative.eu/categories/public-dns/

Comment by kpcyrd 3 days ago

Since this seems to be the thread for public DoH providers, this article is probably worth mentioning (it can sort by DoH, DoT, DoQ, etc support).

https://en.wikipedia.org/wiki/Public_recursive_name_server

Comment by rdme 4 days ago

I'm using numa(https://github.com/razvandimescu/numa) for ad filtering and odoh mode for privacy (shameless plug)

Comment by brnt 4 days ago

So this is something to use instead of pihole?

Comment by MisterMunchkin 3 days ago

I have a router with adguard on it so I can locally filter everything.

Sometimes you need to unblock things to ensure something works properly, so having it be local is better in my opinion.

Comment by immortalist 4 days ago

dot.sb

Comment by leumon 4 days ago

dns.adguard-dns.com

Comment by brettdav 4 days ago

What about Cloudflare’s public DNS? https://developers.cloudflare.com/1.1.1.1/setup/#1111-for-fa...

  1.1.1.2
  1.0.0.2
  2606:4700:4700::1112
  2606:4700:4700::1002

Comment by koeliga 4 days ago

Cloudflare DNS does not block ads, it only blocks malware

Comment by 1vuio0pswjnm7 4 days ago

These was one of the fastest DoH services for pipelined queries over single TCP connection

IME, it was much faster than Quad9 for this purpose

First Mullvad shuts down its Google search proxy

Now its DoH service

What's next

Comment by kennethrc 4 days ago

They lost me as a customer when they got rid of port forwarding, which is nice to have on the high seas

Comment by stutstev 4 days ago

I stopped using Mullvad when they discontinued OpenVPN support (another one to add to the parent list). OpenVPN, if nothing else, provides a wider array of connection options that have a better chance of fulfilling your specific network needs. It supports both UDP and TCP, unlike WireGuard.

I say this respectfully, but Mullvad is perhaps “dumbing down” their VPN service in an effort to simplify their operations and cater to a wider and more general audience.

Comment by ornornor 4 days ago

Curious what alternative you found as a replacement. Could you share?

Comment by RamRodification 4 days ago

I'm not the person you are responding to, but Proton VPN? That's what I switched to after it turned out one of the two Mullvad founders took my money and gave it to a local lunatic politician.

Comment by erxam 4 days ago

I've heard AirVPN being mentioned around, if it interests you.

Comment by UltraSane 4 days ago

I switched to ProtonVPN which has a heavy emphasis on port forwarding.

Comment by Denatonium 4 days ago

I did too, but I really miss Mullvad's static port forwarding system. It's a pain having to continually run a NAT-PMP client, and it doesn't work when you're connecting to ProtonVPN on your router.

Comment by ZeWaka 3 days ago

Switched to Windscribe at the time, quite cheap.

Comment by kennethrc 1 day ago

PIA

Comment by prophesi 3 days ago

> is nice to have on the high seas

For sailing the high seas, or for harboring? I, for one, am glad to not have Mullvad's IP ranges blacklisted everywhere.

Comment by omcnoe 3 days ago

I've found DoH was pretty unusable for me on Windows because the TCP connection doesn't seem to stay open between queries. No idea if it's a software or network issue, but big unpredictable delays on DNS queries broke all kinds of weird unexpected stuff.

Comment by 1vuio0pswjnm7 3 days ago

NB. I don't use Windows and I don't use "Private DNS". I'm referring to using HTTP/1.1 pipelining^1 with a TCP client plus TLS forward proxy or HTTP/2 with an ldns-based client to fetch DNS data in bulk, outside the browser, from the command line. I got some incredible speeds from Mullvad

1. Not every service still supports 1.1, RFC recommends H2

Comment by 1vuio0pswjnm7 4 days ago

Also had a ChatGPT alternative with less surveillance

Discontinued

Comment by 0xbadcafebee 4 days ago

The old heads out there might remember a time when, rather than everyone using one service provider (ex. for Linux binaries/source), we all mutually agreed to use independently run mirrors closer to us. We sort of had to because of bandwidth and latency limits. But it meant that there were a thousand different people providing the same service. Impossible to censor everyone, everyone shares the load, too many places to hack if you wanted to massively compromise, and the users won.

DNS is harder to do that way because it's hard to have limits on DNS. Perhaps DNS could be adapted with QUIC, to allow fast, encrypted DNS that's easier to rate-limit, and then it'd be easier for average people to run public mirrors with limits.

Comment by HelloUsername 3 days ago

What does everybody here think about Daniel Berntsson, founder and co-owner of Mullvad, personally donating 5 million Swedish krona to the populist Örebro party, criticized for its stances on race & immigration?

I'm not trying to start an unhealthy discussion about this topic, genuinely curious about your opinion on the matter.

Comment by fwn 3 days ago

Irrespective of political affiliations, I felt that Mullvad addressed the outrage in a mature and non culture war manner. Because of how they handled the situation, I have a lot more respect for the company.

It's great that they didn't try to cancel the guy or get seduced into driving a wedge into their team. It is great they chose their principle over pleasing the crowd in such a transparent way.

I have been a customer for many years. I once even used the cash payment option out of curiosity.

Here is their statement:

https://mullvad.net/en/blog/donation-controversy

They even linked his (Swedish language) private blog on which he wrote on the issue:

https://dberntsson.info/

Comment by mvid 3 days ago

I stopped paying for or using Mullvad because of that. I have no intention of funding more nazis, when I can help it

Comment by geggo98 3 days ago

I have no insights in Swedish politics. His actions could be really bad, or mean nothing at all. Without proper context, it’s hard to say.

Comment by BatteryMountain 3 days ago

He is in his full right to support whatever party he wants?

Those parties exists for a reason, a response to certain pressures. Nothing happens in isolation. If you zoom out a bit and if you can for a second try to empathize with both sides, you will often find that both sides of an issue is correct, reasonable & rational from their own perspectives. It is often more an emotional response than one of pure survival.

The more you force things on people or suppress them, the more they will resist & push back. The rise of the far-right is not random or just pure evil manifesting out of thin air. It is like a acute inflammatory/immune system response. Obviously it can be exploited by bad actors to further inflame/divide & accelerate certain agendas. Often times extremism takes hold when certain justices are denied (which is in fact evil).

Life is best if you assume the guy on the other side (90% of a group) is just a bro trying to survive & have no real bad intent towards you, they don't know you or have been in your shoes, and the other way around too. Thus it is very important to become non-reactive, become observant who is trying to stoke the flames, who benefits from the chaos and so on.

Comment by iknowstuff 3 days ago

I compared pings recently and was getting like 200-300ms to the closest mullvad DoH server. Quad9 has an adblocking DoH DNS with decent latency.

Comment by brendyn 1 day ago

Apologies for political commentary, but I just say this in drew defaults blog:

“ Daniel Berntsson

Known for: Mullvad VPN (co-founder, co-owner)

Daniel is the co-founder of Mullvad VPN, alongside Fredrik Strömberg. In June 2026, Daniel donated 5M Swedish Krona (~$500,000 USD) to the populist anti-immigration Örebro Party,[source] saying “it’s sad that it’s needed”. The party supports the ethnic cleansing of non-white people from Sweden, and Daniel’s donation represented, at the time, 72% of the party’s revenue. Daniel cited immigration as a motivating factor for his donation.”

Comment by dylanger 3 days ago

I used to use Mullvad's DoH Service because of ad blocking, it worked quite well with SoundCloud etc.

Are there any alternatives?

Comment by papyrus9244 3 days ago

This obviously isn't for everyone, but the solution I use is: my own DNS server at home + wg to access it when I'm away.

Comment by dylanger 17 hours ago

I was considering setting something similar with Tailscale, I have a TS exitnode that sits on a VM alongside my VyOS/home router.

I'd tempted to setup a DNS Forwarder up on that with Ad-Blocking then use Quad9 as upstream, then just have Tailscale be always on.

Comment by upcoming-sesame 3 days ago

How's the latency when you're away?

Comment by vachina 3 days ago

nextdns. I wonder why people use anything else at all

Comment by navigate8310 3 days ago

Quad9 has horrible latency and frequent query failures, I hope Mullvad encourages them to improve their routes

Comment by gertop 3 days ago

I frequently get mini failures with quad9 and my DNS client is too dumb to retry with another server (or quad9 returns a valid but bogus response that prevents my client from hoping to the next server) so I had to ditch quad9.

Quad9 also has worse latency but I could live with it, I just can't live with web pages failing to load several times per day(especially hacker News that has their DNS TTL set to 1 second)

It doesn't happen with my ISP's servers nor with CloudFlare or google or even good ol' L3.

Comment by junaru 3 days ago

Their DoH going down for hours multiple times is what forced me back to cloudflare, i don't trust cloudflare more but at least it works consistently.

Additionally the default of blocking 'malware' doesn't jive with uncensored internet - that should be an opt in and not a default on their flagship address if they want to be taken seriously as unfiltered provider.

If the encrypted endpoint can go down for extended periods and they curate list of 'malware' they are not something that should be considered a gateway to uncensored and open internet.

Comment by seethishat 3 days ago

The announcement only mentions DoH and not DoT... I guess both are going away?

Comment by em-bee 4 days ago

disappointing, because alternatives matter too. quad9 and other well known servers are potentially blocked by some countries, so the more lesser known services there are the better.

Comment by prmoustache 4 days ago

There is always the option of running your own locally.

This is probably service you can host locally with the lowest maintenance and hardware requirements so it isn't even a hassle to do it yourself.

Comment by em-bee 3 days ago

if i live in a country where DNS is filtered then running my own locally is not going to work.

Comment by DemiGuru 4 days ago

Mullvad talks a lot about decentralization, then hands its resolver users to one of the biggest resolvers going. Quad9 is a good operator, and they actually fought Sony in German court instead of quietly complying. They still got ordered to block. That's the problem. A blocking order only hurts as much as the resolver it lands on is used, so every operator that shuts down and sends its users to Quad9 makes the next order a better deal for whoever files it.

Comment by 0dayz 4 days ago

That's a shame, even if I remember their DNS service being a bit unstable (it would at various points not be able to resolve or flat out it was down).

Comment by 4 days ago

Comment by randobando772 3 days ago

[dead]

Comment by Unified-Mentor 3 days ago

[dead]

Comment by lu7897859 3 days ago

[flagged]

Comment by colincowardly 4 days ago

[dead]

Comment by nullmatrix 4 days ago

[flagged]

Comment by erxam 4 days ago

Pretty unapologetically, too. He's still doing it and will keep doing it the more you give him money.

Comment by PufPufPuf 4 days ago

Source?

Comment by snatekay 4 days ago

Translation: one of Mullvad’s two cofounders has donated money to Örebropartiet, a left-leaning Swedish political party that promotes strict and restrictive immigration laws.

Comment by MrDOS 4 days ago

And “donated money” here means “his donations amounted to 72% of the party's entire 2025 revenue”[0].

[0]: https://www.flamman.se/techprofil-ger-miljoner-till-orebropa...

Comment by cynicalkane 3 days ago

They support mass deportations based on race, including of citizens.

If that is what they say before they get power, you need only the basic lessons of history to understand what they might do after they get power.

Comment by pocksuppet 3 days ago

There's no such thing as a left-leaning party that harsh on immigration. Only parties that call themselves left-leaning. You may as well speak of a capitalist party that wants to seize and redistribute the means of production.

Comment by betterbeehome 3 days ago

"There's no such thing as a left-leaning party that harsh on immigration."

This was probably the most ignorant thing I've read today. You're knowledge of political history must not extend very far.

Comment by pocksuppet 2 days ago

Can you elaborate?

Comment by Eufrat 3 days ago

Or that the Nazis are socialist because they have socialist in their name instead of it being a front name to hide their fascist and racist intentions.

Comment by vlyan 3 days ago

which shows how thoroughly they've been subverted by their purported enemy. siding with the capital on its quest to drive the wages down and the rents up will rightfully be their doom. no amount of progressive signaling can make up for that betrayal. the age of unprecedented prosperity is almost over in the west, and the modern left will perish with it.

is there a single party in Europe campaigning on the promise of more immigration, I wonder? if so, how do they fare? :)

Comment by mschuster91 4 days ago

[flagged]

Comment by iamnothere 4 days ago

They are not far right, AFAICT they are “right” Marxists, probably most similar to Albanian Hoxhaism.

If you aren’t familiar with splits inside Marxism-Leninism, the “left” is most often represented by Trotskyism with the “right” tendency being more like Stalinism and North Korean Juche. (Note that these left/right terms aren’t universally used or applied because every faction claims to be correct.)

Comment by csb6 4 days ago

I think it is more accurate to think of them as syncretic. (that is what Wikipedia has them listed as) Their main focus seems to be on nationalism/anti-immigration rather than socialism. Many fascist parties historically flirt with socialist policies as a way to make inroads with working class voters so it is not always straightforward.

Comment by mschuster91 4 days ago

Whoever openly spouts the concept of "remigration" [1] has no business being called anything else but far-right.

> In its political program for the 2026 Swedish general election the Örebro Party writes that they want to "stop the ongoing population replacement" and make Sweden a monocultural society, rather than a multicultural one. The party also writes that this "will be a Sweden where ethnic Swedes are once again the clear majority."

In particular, the "population replacement" is the most clear sign. That's as antisemitic and far-right as it gets [2].

[1] https://en.wikipedia.org/wiki/%C3%96rebro_Party#Immigration_...

[2] https://en.wikipedia.org/wiki/Great_Replacement_conspiracy_t...

Comment by iamnothere 4 days ago

Is Kim Jong Un far right? Seems like a stretch. (North Korea’s immigration policies are even more restrictive than what they want.)

Btw, Malcom Kyeyune, who has a podcast with the party’s founder, is a black child of an immigrant, adopts an avatar on Twitter of Kim Jong Un’s sister, and semi-ironically stans for North Korea on a regular basis.

Comment by pocksuppet 3 days ago

yes, obviously he is. There is also no law of the universe that prevents a black person from interviewing a far right person or supporting a far right party.

Comment by iamnothere 3 days ago

Calling Kim Jong Un “far right” is a special level of ultra-left idiocy. I’m guessing you consider Marx a “moderate” then.

Comment by pocksuppet 2 days ago

Can you elaborate?

Comment by iamnothere 2 days ago

Many left ultras (broadly defined, including Trotskyites, leftcoms, and radlibs alike) have somehow adopted the position that only groups who identify with their cultural agenda qualify as “left”, which is frankly a perversion of the left-right descriptor. It’s why the whole left-right thing should be abandoned, as the waters are hopelessly muddied.

Somehow you now have “radical” neoliberals (lol) and leftcoms both claiming the mantle of leftism while simultaneously casting nearly the ENTIRE HISTORY of Marxism as “rightist”. Like how the fuck is Stalin a rightist? Yet this isn’t an uncommon position in the internet discourse. If you disagree, you are a “tankie” even if you aren’t a Marxist, but are simply fucking educated and understand the history of left economics and politics.

Comment by pocksuppet 2 days ago

... isn't that exactly what you're doing?

As for "how is Stalin a rightist", how isn't he? Looking at his Wikipedia bio he seems basically indistinguishable from Hitler, but he called it a different word.

Comment by iamnothere 2 days ago

No, I am falling back on the entire body of left scholarship with the exception of the French Theory school and the non-DSA New Left, who have hijacked the “left” term and refuse to acknowledge its history.

The DSA, an actually serious left-wing group, acknowledges the broad spectrum of left movements and does not attempt to gatekeep. I would say that ultras should learn from them, but ultras are part of a religion, not a political movement—they are not willing to tolerate dissent.

(Also, the poor state of modern leftism is likely a result of well-documented intelligence and law enforcement interference in left movements. Since the 1960s they have been heavily involved in promoting the “cultural” left over the economic left. This would explain the emergence of the with-us-or-against-us tendency among ultras, it’s a great tool to divide and conquer.)

Comment by 4 days ago

Comment by drnick1 4 days ago

> Running a privacy-focused public DNS service is a highly specialized undertaking

This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a "highly specialized undertaking." It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0].

[0] https://github.com/hagezi/dns-blocklists

Comment by pprotas 4 days ago

You can't compare running a single service in your home network with the operations it takes to serve a public DNS

Comment by ApolloFortyNine 4 days ago

>https://freedns.afraid.org/

This dude has been doing it for 25 years, and actually this is a dns provider for domain names which I'm decently sure makes it more complicated than public dns.

They're allowed to say they don't want to pay for it anymore, I just think their logic is bad. Or maybe their lawyer said they're running risks just ignoring takedown and they didn't want to deal with it anymore.

Comment by blahlabs 4 days ago

> this is a dns provider for domain names which I'm decently sure makes it more complicated than public dns

Can you expand on this? Isn't all DNS for domain names?

Comment by pocksuppet 3 days ago

They mean it's authoritative DNS, not a resolver. The two are completely different services. Authoritative DNS is the side that serves the records for your website, resolver is the part that follows the tree of authoritative servers on behalf of the client.

Hey dang can I get my rate limit removed yet?

Comment by drnick1 4 days ago

This is a scaling problem, not an intrinsic difficulty. Mullvad already had the infrastructure in place. I suspect the real reason is cost-cutting.

Comment by morserer 4 days ago

It's a legal problem (granted, you could still call that both a scaling problem and a cost problem), not a technical nor infrastructural one. That's where Quad9 has specific experience with public hosting that Mullvad doesn't.

I'm sure that the time, effort, money, and exposure that goes into responding and adhering to legal requests for a publicly offered service is something Mullvad wasn't expecting and would rather not be doing considering it's not their core focus.

Comment by anvuong 4 days ago

What is intrinsic difficulty? A product at scale has many intrinsic dimensions, not just technical. Saying scaling is not an intrinsic difficulty is pretty weird given a highly scalable product usually looks nothing like their 1-user counterpart even when they have the same functionality.

Comment by SirSavary 4 days ago

How much traffic is your public DNS serving?