Learning that I don't have to specify servers there is a lot more
variety even if I start requiring more things, as Sedric says to
see 33 live servers, I guess dnscrypt servers in general respect
privacy. However I guess I still have to trust on what the servers
say as AFAIK dnscrypt-proxy is only that, a proxy, and won't start
validating dnssec by itself.
* add invictus, it's not mine, but neither are roubaix (dnscrypt-proxy
dislikes dashes?) and this file is meant for just my use, so does it
matter what it contains?
At the moment I am having problem with mikaela.info being in HSTS
preload list and when I begun this list, I was hoping to use something
conflict free and thought that mikaela.info would be the least bad
choice while reading the reserver domains.
Now I have searched on the issues more and encountered .internal TLD
that seems to be what I am after and I hope it will become official.
https://github.com/wkumari/draft-wkumari-dnsop-internal
I think I can change these addresses safely as I am not using them
anywhere as I worry about accidentally sending them to the internet and
that opening new problems. This will mainly benefit me with web
browsers, I hope.
I will still have to link other people to direct IPv6 addresses that
won't change with the platforms I use or mikaela.info will not be in the
HSTS preload lists at time I need it. I wouldn't memorize IPv4 addresses
though or start telling them someone in quick chat.
It took me some time a few days ago to figure out this (and notice that
port 80 was already used by automatically installed Apache that was
doing nothing).
I have understood that ports 443 (Orport) and 80 (Dirport) are the best
for users behind strict firewalls especially if they aren't needed for
anything else on the system running Tor relay.
* Comment that the fastest server is automatically picked.
* Explicitly don't filter AAAA requests.
* Require provider to not do filtering
* which is implied by DNSSEC which would get broken.
* Use Google DNS B as fallback resolver and explain what it does in
comment.
* Add commented options for using Tor.
Polipo is no longer maintained and it seems that I am doing the same
thing with Privoxy except censoring accept-language which I need to
investigate. I think Privoxy warned about changing headers possibly
making ones fingerprint more unique and thus trackable? But aren't those
also going inside https so maybe there is no point?
Dnscrypt-proxy appears to handle multiple servers by itself nowadays and
does it in the config file. The servers listed may also be down.
Ref: #92 where I remembered these files still being here.
I have no idea why I even have this file :(
I guess the number four has something to do with Windows as resolv.conf
actually doesn't take more than three, am I preparing for situation
where there is no network, but ISP DNS is down or something? Why? When has
that actually happened?
I want DNSMasq to behave a little differently from the NetworkManager
defaults.
The default cache size of 150/400 seems a little small and 10 000 probably
won't be full soon and I am sure modern systems at least at home where I
am using dnsmasq again won't suffer from it.
By default dnsmasq started by NEtworkManager only listens on 127.0.0.1
while ::1 also exists, I want it to be also listened on in case anything
decides to try querying with it.
DNSSEC is not checked by default while I want that behaviour, but as I
am using OpenDNS I cannot make it verify unsigned zones are unsigned :(
Also add symlink to trust-anchors.conf that should ship with DNSSEC to
avoid having to deal with it manually. It should work as a reminder that
it's also needed.
It fails on laptops thanks to not being able to do DNS resolution thanks
to network connection not existing during boot.
Now it fails to `Download snap "ubuntu-core" (423) from channel "stable"
(cannot authenticate to snap store: Provided email/password is not
correct.)` which is process and appears to not be my issue.
Only oidentd.socket and miredo.service were copied instead of being
units that exist in the system and they don't need to do anything
else than fix the issue I have with the stock units.
* oidentd.socket is IPv6-only on my systems unless is BindIPv6Only=both.
because of net.ipv6.bindv6only=1
* miredo.service is here because it starts before there is network
connection (network-online.target) and there is never network
connection with laptops before they are connected to WLAN even if
NetworkManager might be up seeking/connecting to network.
