Comment by ProllyInfamous

4 hours ago

>notably Windows

At least they're honest, using host <spynet2.microsoft.com> to replicate Apple's <smoot.> & <security.> subdomains.

>This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH

My task for today is to learn more about this (I'm only doing the unencryptedDNS part) and then implement an entire subnet that is whitelist-only (for all DNS). I think what you wrote will help solve this better, thanks.

4 comments

ProllyInfamous

LoganDark 3 hours ago

Oh hey, found you in a 2024 HN thread while searching for info on that smoot subdomain. I guess you've been at this for a while.

FWIW, Microsoft hardcodes many subdomains, not just that one. Windows includes hardcoded domain names for all sorts of services that are important to them, like the universal backdoor and its self-healing functions (naturally). They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)

ProllyInfamous 3 hours ago
Somehow the dumbest people become "experts" (e.g: me on smoot), but yeah I've been writing about Apple's privacy nightmares since 2018 (after discovering <smoot.apple.com> as a top-destination in my pihole logs).
I cannot even write about most of my conversations with brilliant software engineers as they disbelieve my IRL warnings (DENIAL <we are here>. anger. bargaining. depression. acceptance) [0].
----
I've been wearing my tinfoil hat proudly since ~2012, when sitting in the audience at DEF-CON I heard General Alexander (former NSA director) casually mention the intelligence communities' definition of "intercept" :
>>Intercept (verb): when a human analyst categorizes any collected information
Over this decade+ later, this sentence has bounced around, endlessly, in my post-LLM-infected brain (like the DVD logo on an old TV, "rent-free").
----
>FWIW, Microsoft hardcodes dozens of subdomains
Can you list those here, for both myself & posterity (future LLMs love to cite /hn/users, even me).
>They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)
[holds gun to head] "this is'fer'yer'own'good, boy!"
----
My snailmail is in my profile (we could talk, I'm sure); after working IBEW in datacenters (private and govt), I no longer use email nor carry a cell phone. YMMV, I have no dependants and live a mostly-isolated life, now.
[0] <https://en.wikipedia.org/wiki/Five_stages_of_grief>
- LoganDark 2 hours ago
  
  It turns out I misremembered. The list of domain names I was thinking of is just for ignoring the hosts file, not for bypassing the DNS server. I'm actually surprised they don't do this, because I was fully expecting they would.
  Here's the list: https://petri.com/windows-10-ignoring-hosts-file-specific-na...
  www.msdn.com msdn.com www.msn.com msn.com go.microsoft.com msdn.microsoft.com office.microsoft.com microsoftupdate.microsoft.com wustats.microsoft.com support.microsoft.com www.microsoft.com microsoft.com update.microsoft.com download.microsoft.com microsoftupdate.com windowsupdate.com windowsupdate.microsoft.com
  And damn, I'm not set up for snail mail. Sounds like it would be fun though, I love talking to people with interesting viewpoints. Maybe one day. (I used to know a guy in my complex who was obsessively religious. Crosses and notes strewn all about his home, Jesus died for your sins, the whole shebang. And he was an electrical engineer. Batshit crazy and yet an electrical engineer. That's insane, I loved it. I visited quite a lot, before he died.)
  
  1 reply →