rethink-app

at the IP-layer (not DNS), and hence we also build a Firewall (due to limited time, the RethinkDNS + Firewall app is Android-only, for the time being [1]). That said, we do plan to achieve parity with NextDNS, but that's going to happen over a period of time since our team of 3 is stretched thin between building the firewall (too much complexity!) and the dns (too much work!). [0] https://github.com/serverless-dns/serverless-dns [1] https://github.com/celzero/rethink-app

with a resolver of their choosing. RethinkDNS has open-sourced both its client app and a pi-hole like stub resolver: https://github.com/serverless-dns/serverless-dns There's three of us working on RethinkDNS full-time, so it is likely to see feature development at a faster clip than TrackerControl and NetGuard (the latter's been put under maintanence mode by its original developer).

tackle privacy concerns today, but most of the 2B+ Android users don't really want to root devices let alone flash ROMs. Most Chinese OEMs (Vivo, Oppo, OnePlus, Realme, Xiaomi) do bundle in (pretty decent though limited) firewalls but they do not let one visualize or block individual network requests. It'd be quite sometime before the Android/Fuchsia-iOS duopoly is displaced from its perch, but technology-wise, my longer-term hopes are pinned on Linux-based phones (PINE64, Librem) for now. Of course, laws and regulations upholding digital privacy are the real end-game, and it remains to be seen how much headway is made on that front in the coming decade. [0] https://youtu.be/e9yK1QndJSM?t=1261 [1] https://github.com/GrapheneOS/os-issue-tracker/issues/389 [2] https://web.archive.org/web/20110506050715/http://www.whispe... [3] https://security.googleblog.com/search/label/android

his project, so apologies if that appeared to be the case. That said I have used DNS 66 in the past effectively, despite its limitations. Can you suggest where I can read more about its security deficiencies, or by "insecure" do you just mean to say it is an incomplete solution? (i.e. the lack of protocol support and the reliance on the Android VPN framework?)

took me a second to grok that this is really mostly just an OSS Android app with some associated DNS servers you can optionally use with it. Take a second or two more, you've likely missed out on a Littlesnitch-esque firewall which is like 50% of the app; and DNSCrypt v3 support, too; and on-device blocklists; and DNS over Tor support; and support for censorship bypass by protecting against SNI sniffing attacks? It is may be our terrible website design and copywriting skills that did us in. DNS66, as great as it is, doesn't have half the features.

he core firewall is written in Golang, whilst the UI is all Kotlin/Android. We are evaluating a move to Flutter to take this cross-platform, but the immediate focus has been stability and adding support for WireGuard [1]. Currently, the firewall only tracks TCP/UDP flows. We are in the process of rewiring the firewall's network stack to use gVisor's TCP/IP implementation, and we presume that should improve things considerably. RethinkDNS, which is a fork of getintra.org, is also an anti-censorship tool. It can, bypass SNI based censorship in most countries like Iran, India, Saudi Arabia (but not all). Eventually, we forsee adding a mesh-VPN like capability to WireGuard (à la tailscale.com) in the app to enable people who "friend eachother" to share each others connections and IPs, similar to now-defunct uProxy [2], to bypass censorship. RethinkDNS relies on its namesake stub DoH-only resolver for DNS based content-blocking which is deployed to Cloudflare Workers. This is open source, as well. We are working towards making it one-click deployable so that others may run their own stub resolver; Workers' free-tier supports well over 3 devices worth of DNS queries a month. The stub resolver, as of today, supports blocking over 5M domains from around 171 lists. We plan to support all 2400+ blocklists listed on filterlists.com eventually. Since the app and the resolver are both super early, I did not expect it to land on HN. It is what it is, but please be kind :) [0] https://news.ycombinator.com/item?id=23194178 [1] https://github.com/celzero/rethink-app/issues/52 [2] https://en.wikipedia.org/wiki/UProxy