alt Hacker NewsShow HN: Running the second public ODoH relay
Every privacy-focused DNS service requires an account: NextDNS, Cloudflare for Families, Apple's iCloud Private Relay (paid, iOS-only). The protocol that doesn’t require one - ODoH - had basically one well-known public relay operator (Frank Denis on Fastly Compute, default in dnscrypt-proxy). I built a second one and the client to talk to it.
Comments
gigatexal • today at 11:56 AM
What would it take to get truly anonymous dns? I guess it’s not really possible no?
➕ show 2 replies
plexescor • today at 12:22 PM
[flagged]
petcat • today at 12:09 PM
[dead]
rdme • today at 10:50 AM
The relay is a systemd unit on a VPS, Caddy for TLS, SSRF-hardened (regex-strict hostnames, no IP literals). eTLD+1 same-operator check rejects relay+target run by the same org by default. HPKE is odoh-rs from Cloudflare
``` cargo install numa
# set mode = "odoh" in numa.toml ```
What’s the selling point of ODoH given the low uptake of ECH which means the name of the server you’re talking to is given away anyway?