Hacker News

points by jwrallie 3 days ago | 0 comments

My workplace is messing with DNS as well, probably to filter specific websites, and I would not mind it since for the context of my usage that is perfectly fair.

But their DNS responses have latency spikes every couple of minutes of 1-2 seconds that was driving me crazy. I simply enabled DNS over HTTPS in Firefox and everything feels so smooth now.

I have no idea how my coworkers seem to be so insensitive to it.

[–] pbhjpbhj 3 days ago

Enabling DoH on a locked down workplace network sounds like a way to get fired.

But I guess that if they let you do it they're probably not competent enough to catch you.

[–] jwrallie 2 days ago

It’s a university network so things are not as strict as other work places.

They also do not pay for my device, so it’s only fair I can configure things my own way.

I’m pretty sure the worst that could happen is they would ask me to turn it off.

[–] pprotas 2 days ago

No way you would get fired for this, come on man. Maybe someone from IT would ping you to turn it off, worst case.

[–] c16 2 days ago

Happened to me once, my computer had Little Snitch block fortinet. Got a nice message to look into why. Suddenly started calling home.

[–] Cidan 2 days ago

Depends on the workplace, but I've definitely seen people fired for less.

[–] BizarroLand 2 days ago

If you're not working on something highly secretive and valuable (with a salary to match) then they're doing you a favor by flipping out over something so stupid.

[–] c16 2 days ago

For companies with ISO-27001, Web Filtering is a control recently introduced. Protective DNS can tick few boxes and genuinely keep your network a little bit more secure (and ad free).

As an employee I'd be against it, but company device so what can you do. As the one managing the security and ISO process, it made my life a lot easier from both auditing and "why is my computer acting funny lately" perspectives. Showing my own user account having triggered an ad-based block, and the company-wide malware block rate was enough to satisfy the auditor that we has appropriate controls in place for a small company and move on to the next item.

Provided you take the stance of everyone is trusted to do their jobs, so we only need to block ads, piracy and malware lists and don't retain logging except where a block has occurred for auditing, I think it strikes a reasonable middle ground.

[–] pjc50 3 days ago

They might be proxying all your traffic through a "WAF". I've noticed that even quite a lot of regular websites linked on HN on "non standard" domains are simply unresolvable on my work network.

[–] mcmcmc 2 days ago

Have you bothered asking your IT to look into it?

[–] m3047 2 days ago

Ok, free tech support I guess. It could be shitty DNS provisioning, that's pretty common. But are you using wireless? Are you familiar with Buffer Bloat generally, let alone some of the other implicit shenanigans in "traffic shaping"?

A few years ago the cognitive dissonance of people saying "DoH is faster" to the same DNS server(s) started really bugging me: is it really DoH, or is it simply TCP vs UDP? So I wrote a little thing I can install on my laptop to do DNS forwarding over plain old TCP (originally no encryption): https://github.com/m3047/tcp_only_forwarder

Golly, on my wifi TCP was certainly more reliable than UDP. It's due to how wifi devices prioritize and buffer traffic. Maybe they should implement / enable DoH on their own servers.

On the other hand if all of your access from the workplace network to web resources is proxied (and since DoH is a web service), they may not care.