A failed connection from a homelab container led the author to compare DNS results from several providers. Plaintext queries repeatedly returned one IP, while Cloudflare’s DNS-over-HTTPS service returned another; an ownership lookup showed the first address belonged to the ISP. The discrepancy exposed the ISP’s interception and alteration of DNS responses. The account clarifies that running Unbound locally does not by itself prevent this: a recursive resolver typically sends its queries to other nameservers over unencrypted DNS unless configured to forward them through an encrypted service. DNSSEC also does not encrypt queries; it verifies signed DNS data, and only works when the domain has a valid chain of signatures. A failed validation can block a forged answer, but the author cites a 2026 census finding that only 7.03% of graded domains had a fully validating DNSSEC chain.
DNS-over-TLS and DNS-over-HTTPS encrypt traffic between the user’s resolver and its chosen DNS provider, limiting ISP surveillance and tampering in transit, but they require trusting that provider. Encryption does not conceal all browsing: an ISP may infer destinations from TLS handshake hostnames or IP addresses, unless traffic is routed through a VPN, which shifts trust to the VPN operator. The author’s setup uses local AdGuard for DNS, with dnscrypt-proxy encrypting upstream queries via DNSCrypt. Some containers also have Cloudflare as a fallback, while keeping local DNS primary; this reduces the risk that a local DNS outage will disrupt containers that need reliable resolution.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Brazil’s Credit Guarantee Fund (FGC) reported unauthorized access to personal data in systems used for guarantee payments, but has found no evidence of disclosure, misuse, or financial loss. It restricted access, blocked unauthorized accounts, notified Brazil’s data protection authority, and continues investigating the incident. (fgc.org.br)
Data collected through ads in popular apps gives police a way to track users’ phones. The surveillance relies on advertising technology rather than direct access to a device. (bloomberg.com)
Mark Cuban says Facebook knowingly runs scam ads featuring AI-generated deepfakes. Documents reportedly estimate the platform earns $16 billion from fraudulent ads. (finance.yahoo.com)
Claude Code allegedly sends users’ email addresses to third-party websites in the User-Agent header during web searches. The reported privacy issue prompted a request to remove the behavior entirely. (github.com)
CVE-2026-83844 is listed as a remote code execution vulnerability in MS Paint. The provided page contains no details about affected versions, exploit conditions, or fixes. (cve.org)
A remote code execution vulnerability affects Microsoft Paint. An attacker can exploit it by getting a user to open a specially crafted file in the app. (msrc.microsoft.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.