Yes, I know, I'll likely be the one working on this having requested it.
Admittedly, there are a lot of usability issues with redirecting outbound DNS queries from the Android resolver to a local resolver. Most problematic are when the DHCP-specified DNS servers are to be trusted (such as on trusted WiFi or trusted VPN that has "private" address information).
Assuming that those could be worked through in some reasonable way (I haven't looked at what M offers for notification and the like, but am not terribly happy with the way that WiFi Privacy prompts when it finds an unknown MAC), I'd like to suggest that "we" look at unbound as it supplies DNSSEC, as well as being arguably more robust and secure than something like dnsmasq.
There has been some good work done on the executable port:
https://unbound.net/pipermail/unboun...st/003976.html
https://github.com/smarek/android-unbound-dns
There will likely be additional complexities with Google dropping OpenSSL in favor of BoringSSL.
(The SSL library change will likely impact ssh and rsync on my phone, which I use for backup, so getting both of those to build again under M will be a higher priority for me)
I think the most challenging parts will be the UX on how to control it as well as getting the redirection to play nicely with widely used firewall tools out there such as AFWall.
I'll at least be thinking about that UX part. Without that, it won't have the utility to balance the cost.
Admittedly, there are a lot of usability issues with redirecting outbound DNS queries from the Android resolver to a local resolver. Most problematic are when the DHCP-specified DNS servers are to be trusted (such as on trusted WiFi or trusted VPN that has "private" address information).
Assuming that those could be worked through in some reasonable way (I haven't looked at what M offers for notification and the like, but am not terribly happy with the way that WiFi Privacy prompts when it finds an unknown MAC), I'd like to suggest that "we" look at unbound as it supplies DNSSEC, as well as being arguably more robust and secure than something like dnsmasq.
There has been some good work done on the executable port:
https://unbound.net/pipermail/unboun...st/003976.html
https://github.com/smarek/android-unbound-dns
There will likely be additional complexities with Google dropping OpenSSL in favor of BoringSSL.
(The SSL library change will likely impact ssh and rsync on my phone, which I use for backup, so getting both of those to build again under M will be a higher priority for me)
I think the most challenging parts will be the UX on how to control it as well as getting the redirection to play nicely with widely used firewall tools out there such as AFWall.
I'll at least be thinking about that UX part. Without that, it won't have the utility to balance the cost.
No comments:
Post a Comment