NextDNS logging is opt-out, not opt-in as stated on PG's DNS Resolvers recommendations page

[dngray (Daniel Gray)]

@ignoramous

@dngray

We’re not worried by GCP usage.

The point is about their privacy policy lacking any mention of all these “sub processors”.

This is something I raised in a subsequent email to them. I really like for example how Hashicorp does this: Subprocessors

I think their policy is a bit bare bones and could do with improvements.

@ignoramous

Then, what’s the point of NextDNS “storing” logs in Switzerland, if they’re going to be streamed through GCP servers worldwide (because if GCP is streaming logs stored in Switzerland through Indian servers, then Indian laws apply and GCP will comply with those laws)? PrivacyGuides makes it seem as if “storing” logs in the EU etc is a positive thing: You can choose retention time and log storage location for any logs you choose to keep, or disable logs altogether.

You could really argue that about any provider who uses any third party whether it be Azure, AWS or some other platform. If that is the new criteria we should just ban any service that doesn’t own their own servers and not single out GCP specifically.

That will basically mean we’re left with very few services/reliable services and will be throwing out a huge amount of products which actually do work well.

@ignoramous

I worked at BigCloud for more than 8 years: BigCloud don’t own ALL the infrastructure. They themselves use services of other providers who may or may not be in bed with respective governments where they operate. Besides it was routine for teams to comply with legal requests by granting access to actual customer data / metadata to the law enforcement. Some even had an automated workflow to grab all such data and bundle it up for legal. GCP I don’t think is any exception (see section 7.1.2: Cloud Data Processing Addendum | Google Cloud).

Every service will comply with legal requests to some degree. That is the cost of continuing business arrangements. Singling out GCP because of legal requests really doesn’t address that problem and just seems like a misguided degoogle bent.

There is also no way to ensure that doesn’t happen besides throwing all your traffic in an encrypted tunnel and routing it somewhere else. If you’re worried about legal requests and the stream of traffic is persistent, I would not necessarily rely on a VPN provider to keep that confidentiality. They are also susceptible to bribes and other forms of coercion.

There is really no substitute to using Tor for a threat model where you have sustained government interest. Encrypted DNS was never really designed to give you strong confidentiality as there are plenty of other ways in which your usage can and will leak. The point of encrypting queries is stop outside manipulation and snooping at a network level, not thwart legal requests or targeted interest. Also with DNS you often don’t have much of choice about which route those queries take as any provider of size uses anycast addresses.

@ignoramous

@dngray

So with the NextDNS example their privacy policy is the one which is relevant.

A concise privacy policy doesn’t mean it is complete. For reference, here’s Vercel privacy policy that clearly spells out what information is and isn’t available to various tools and services they use: Privacy Policy – Vercel

To be honest, I don’t really have a strong opinion one way or the other, but if PrivacyGuides is serious about avoiding the next Skiff, then transparency from companies must be top priority (and err on the side of caution in absence of clarity).

I don’t think NextDNS is anywhere near a “Skiff”. If you remember Skiff was quite new and pushed their addition to numerous sites very aggressively. Almost as if they were trying to inflate their user count knowing full well that the Notion deal was going to happen.

Conversely NextDNS is not new and they haven’t asked to be mentioned anywhere that I can see. NextDNS does partner with Mozilla and other companies which do care about privacy so that has to mean something. I have sent them another email (maybe the last one went to junk).

@ignoramous

@dngray

Were you approached by dns0.eu or are you saying some other random threat intelligence companies?

Can’t disclose. Under NDA.

That’s unfortunate, I have unfortunately noticed a theme with quite a few of your replies which have an element of argument from authority, without actual counter points other than “trust me, I know stuff”. In your previous reply you said:

@ignoramous

I’ve been approached for such agreements (I’ve declined them every time given the terms invariably include “whitelisting” / “allowlisting” some domains under a strict NDA).

I can’t see how you’d be bound by a NDA on an agreement you didn’t accept.

@ignoramous

@dngray

That information though seems to be mostly public sources and not stuff which is particularly private. I think they do that in order to track spam/botnets etc

I implore you to not assume. Ask them, and see what you get.

This is perhaps something that will require extra research. Are you talking about this? or something else?

We are looking to partner with national and pan‑European hosting providers, threat intelligence providers, CERTs and financial sponsors — talk to us at partners@dns0.eu.

CERTs (Computer Emergency Response Team), and “threat intelligence providers” in pan-European really can only mean one thing, and that is they want more data about threats in Europe for their Zero program.