How can it possibly be, that an ISP, which I’m paying for gets to decid, which sites I’m allowed to have access to, and which not?

All the torrenting sites are restricted. I know, I can use VPN, and such… but I want to do it because of my privacy concerns and not because of some higher-up decided to bend over for the lobbying industry.

While on the other hand, if there’s a data breach of a legit big-corp website (looking at you FB), I’m still able to access it, they get fined with a fraction of their revenue, and I’m still left empty-handed. What a hipocracy!!

What comes next? Are they gonna restrict me from using lemmy too, bc some lobbyist doesn’t like the fact that it’s a decentralized system which they have no control over?

Rant, over!

I didn’t even know that my router was using my ISPs DNS, and that I can just ditch it, even though I’m running AdGuard (selfhosted)

  • 𝒍𝒆𝒎𝒂𝒏𝒏@lemmy.oneEnglish
    331·
    11 months ago

    Sadly doesn’t work for gov level blocks that look at the SNI rather than blocking at DNS level

    Edit: correction from ESNI to SNI

    • Eufalconimorph@discuss.tchncs.deEnglish
      381·
      11 months ago

      You mean SNI, not ESNI. ESNI is the Encrypted Server Name Indication that gets around that, though the newer ECH (Encrypted Client Hello) is better in many ways. Not all sites support either though.

      • MigratingtoLemmy@lemmy.worldEnglish
        3·
        11 months ago

        If I utilise a DNS provider who supports ECH (mullvad) with a browser that supports ECH (Librewolf) will I still not be able to access certain websites? I haven’t come across a website blocked by my ISP yet so don’t know

        • noride@lemm.eeEnglish
          2·
          11 months ago

          Most ISP blocking is pretty superficial, usually just at the DNS level, you should be fine in the vast majority of cases. While parsing for the SNI flag on the client hello is technically possible, it’s computationally expensive at scale, and generally avoided outside of enterprise networks.

          With that siad, When in doubt, VPN out. ;)

      • 𝒍𝒆𝒎𝒂𝒏𝒏@lemmy.oneEnglish
        1·
        11 months ago

        Corrected, thanks!

        I’m looking forward to ECH, if i’m not mistaken that relies on DoH which has pretty widespread adoption in browsers at the mo

      • redcalcium@lemmy.instituteEnglish
        0·
        11 months ago

        It’s still require DoH, right? Not sure what my ISP does, but DoH has very high latency and often timeout on my end, probably to discourage their customers to turn on DoH.

          • redcalcium@lemmy.instituteEnglish
            0·
            11 months ago

            Hmm, kinda doubt it’s the DoH provider’s fault (cloudflare). On the other hand, my ISP already transparently redirecting plain DNS requests to their own DNS server, so it’s not a stretch to think they found a way to degrade DoH experience (at least for well known endpoint like 1.1.1.1).

      • Snowplow8861@lemmus.orgEnglish
        0·
        11 months ago

        Bring free on cloudflare makes it widely adopted quickly likely.

        It’s also going to break all the firewalls at work which will no longer be able to do dns and http filtering based on set categories like phishing, malware, gore, and porn. I wish I didn’t need to block these things, but users can’t be trusted and not everyone is happy seeing porn and gore on their co-workers screens!

        The malware and other malicious site blocking though is me. At every turn users will click the google prompted ad sites, just like the keepass one this week.

        Anyway all that’s likely to not work now! I guess all that’s left is to break encryption by adding true mitm with installing certificates on everyone’s machines and making it a proxy. Something I was loathe to do.