DNS over HTTPS can be enabled in Menu -> Preferences (about:preferences) -> Network Settings -> Enable DNS over HTTPS. Set "Use Provider" to "Custom," and enter your DoH provider's address.
+
DNS over HTTPS can be enabled in Menu -> Preferences (about:preferences) -> Network Settings -> Enable DNS over HTTPS. Set "Use Provider" to "Custom", and enter your DoH provider's address.
Advanced users may enable it in about:config by setting network.trr.custom_uri and network.trr.uri as the address you find from the documentation of your DoH provider and network.trr.mode as 2. It may also be desirable to set network.esni.enabled to True in order to enable encrypted SNI and make sites supporting ESNI a bit more difficult to track.
@@ -432,4 +432,4 @@ github="https://github.com/jedisct1/dnscrypt-proxy"
-
\ No newline at end of file
+
diff --git a/_includes/sections/privacy-resources.html b/_includes/sections/privacy-resources.html
index a6c51b07..421c3bf2 100644
--- a/_includes/sections/privacy-resources.html
+++ b/_includes/sections/privacy-resources.html
@@ -22,7 +22,7 @@
Security Now! - Weekly Internet Security Podcast by Steve Gibson and Leo Laporte.
TechSNAP - Weekly Systems, Network, and Administration Podcast. Every week TechSNAP covers the stories that impact those of us in the tech industry.
Terms of Service; Didn't Read - "I have read and agree to the Terms" is the biggest lie on the web. We aim to fix that.
-
The Great Cloudwall - Critique and information on why to avoid Cloudflare, a big company with a huge portition of the internet behind it.
+
The Great Cloudwall - Critique and information on why to avoid Cloudflare, a big company with a huge portion of the internet behind it.
Tools
--
2.49.1
From 6c7cc2100ed23d6b831bf2fa5f685264b218212c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A1udio=20J=C3=BAlio=20Ferraz?=
Date: Tue, 27 Aug 2019 21:49:58 +0000
Subject: [PATCH 004/102] Firefox "esni" configuration fix (#1230)
The correct configuration name is "network.security.esni.enabled"
---
_includes/sections/dns.html | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/_includes/sections/dns.html b/_includes/sections/dns.html
index 3fd69f7f..ce9b0747 100644
--- a/_includes/sections/dns.html
+++ b/_includes/sections/dns.html
@@ -395,7 +395,7 @@ github="https://github.com/jedisct1/dnscrypt-proxy"
Firefox comes with built-in DoH support with Cloudflare set as the default resolver, but can be configured to use any DoH resolver. Currently Mozilla is conducting studies before enabling DoH by default for all US-based Firefox users.
DNS over HTTPS can be enabled in Menu -> Preferences (about:preferences) -> Network Settings -> Enable DNS over HTTPS. Set "Use Provider" to "Custom", and enter your DoH provider's address.
-
Advanced users may enable it in about:config by setting network.trr.custom_uri and network.trr.uri as the address you find from the documentation of your DoH provider and network.trr.mode as 2. It may also be desirable to set network.esni.enabled to True in order to enable encrypted SNI and make sites supporting ESNI a bit more difficult to track.
+
Advanced users may enable it in about:config by setting network.trr.custom_uri and network.trr.uri as the address you find from the documentation of your DoH provider and network.trr.mode as 2. It may also be desirable to set network.security.esni.enabled to True in order to enable encrypted SNI and make sites supporting ESNI a bit more difficult to track.
--
2.49.1
From 1d9cedc7fa331ec7171dadc9557564f6916d1f78 Mon Sep 17 00:00:00 2001
From: nitrohorse <1514352+nitrohorse@users.noreply.github.com>
Date: Wed, 28 Aug 2019 04:37:28 -0700
Subject: [PATCH 005/102] Add NixNet DNS (#1226)
* Add NixNet DNS
* No text wrap update
* Add source + state filtering
---
_includes/sections/dns.html | 41 +++++++++++++++++++++++++++++++++++++
source_code.md | 2 ++
2 files changed, 43 insertions(+)
diff --git a/_includes/sections/dns.html b/_includes/sections/dns.html
index ce9b0747..fd1c308e 100644
--- a/_includes/sections/dns.html
+++ b/_includes/sections/dns.html
@@ -261,6 +261,47 @@ github="https://github.com/jedisct1/dnscrypt-proxy"
--
2.49.1
From eb040508e6e180658e79fe056a11616b5d76a730 Mon Sep 17 00:00:00 2001
From: nitrohorse <1514352+nitrohorse@users.noreply.github.com>
Date: Thu, 29 Aug 2019 07:52:07 -0700
Subject: [PATCH 007/102] Center table row values (#1235)
---
assets/css/style.scss | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/assets/css/style.scss b/assets/css/style.scss
index 0cd336a8..db658de1 100644
--- a/assets/css/style.scss
+++ b/assets/css/style.scss
@@ -339,3 +339,8 @@ input#nav-toggle,
.no-text-wrap {
white-space: nowrap;
}
+
+.table td, .table th {
+ vertical-align: middle;
+}
+
--
2.49.1
From 09e1d8593387acdfd5bd637fdd403a2253a5296c Mon Sep 17 00:00:00 2001
From: Dawid Potocki
Date: Thu, 29 Aug 2019 14:52:56 +0000
Subject: [PATCH 008/102] Fix DNS table, it did contain text under it (#1236)
---
_includes/sections/dns.html | 140 ++++++++++++++++++------------------
1 file changed, 70 insertions(+), 70 deletions(-)
diff --git a/_includes/sections/dns.html b/_includes/sections/dns.html
index 37815afb..0b802dc9 100644
--- a/_includes/sections/dns.html
+++ b/_includes/sections/dns.html
@@ -403,74 +403,74 @@ github="https://github.com/jedisct1/dnscrypt-proxy"
-
-
Terms
-
-
-
DNS-over-TLS (DoT) - A security protocol for encrypted DNS on a dedicated port 853. Some providers support port 443 which generally works everywhere while port 853 is often blocked by restrictive firewalls.
-
DNS-over-HTTPS (DoH) - Similar to DoT, but uses HTTPS instead, being indistinguishable from "normal" HTTPS traffic on port 443.
-
DNSCrypt - An older yet robust method of encrypting DNS.
Check the website of your DNS provider. They may have a page for telling "you are using our DNS." Examples include AdGuard and Cloudflare.
-
If using Firefox's trusted recursive resolver (TRR), navigate to about:networking#dns. If the TRR column says "true" for some fields, you are using DoH.
QNAME Minimization - Run dig +short txt qnamemintest.internet.nl from the command-line (taken from this NLnet Labs presentation). You should see this display: "HOORAY - QNAME minimisation is enabled on your resolver :)!"
-
-
-
Worth Mentioning and Additional Information
-
-
-
Encrypted DNS clients for desktop:
-
-
Firefox comes with built-in DoH support with Cloudflare set as the default resolver, but can be configured to use any DoH resolver. Currently Mozilla is conducting studies before enabling DoH by default for all US-based Firefox users.
-
-
DNS over HTTPS can be enabled in Menu -> Preferences (about:preferences) -> Network Settings -> Enable DNS over HTTPS. Set "Use Provider" to "Custom", and enter your DoH provider's address.
-
Advanced users may enable it in about:config by setting network.trr.custom_uri and network.trr.uri as the address you find from the documentation of your DoH provider and network.trr.mode as 2. It may also be desirable to set network.security.esni.enabled to True in order to enable encrypted SNI and make sites supporting ESNI a bit more difficult to track.
DNS-over-TLS (DoT) - A security protocol for encrypted DNS on a dedicated port 853. Some providers support port 443 which generally works everywhere while port 853 is often blocked by restrictive firewalls.
+
DNS-over-HTTPS (DoH) - Similar to DoT, but uses HTTPS instead, being indistinguishable from "normal" HTTPS traffic on port 443.
+
DNSCrypt - An older yet robust method of encrypting DNS.
Check the website of your DNS provider. They may have a page for telling "you are using our DNS." Examples include AdGuard and Cloudflare.
+
If using Firefox's trusted recursive resolver (TRR), navigate to about:networking#dns. If the TRR column says "true" for some fields, you are using DoH.
QNAME Minimization - Run dig +short txt qnamemintest.internet.nl from the command-line (taken from this NLnet Labs presentation). You should see this display: "HOORAY - QNAME minimisation is enabled on your resolver :)!"
+
+
+
Worth Mentioning and Additional Information
+
+
+
Encrypted DNS clients for desktop:
+
+
Firefox comes with built-in DoH support with Cloudflare set as the default resolver, but can be configured to use any DoH resolver. Currently Mozilla is conducting studies before enabling DoH by default for all US-based Firefox users.
+
+
DNS over HTTPS can be enabled in Menu -> Preferences (about:preferences) -> Network Settings -> Enable DNS over HTTPS. Set "Use Provider" to "Custom", and enter your DoH provider's address.
+
Advanced users may enable it in about:config by setting network.trr.custom_uri and network.trr.uri as the address you find from the documentation of your DoH provider and network.trr.mode as 2. It may also be desirable to set network.security.esni.enabled to True in order to enable encrypted SNI and make sites supporting ESNI a bit more difficult to track.
--
2.49.1
From ec1a5d2a934cf4818f7c6b3349de1fea33845a19 Mon Sep 17 00:00:00 2001
From: nitrohorse <1514352+nitrohorse@users.noreply.github.com>
Date: Fri, 30 Aug 2019 10:12:25 -0700
Subject: [PATCH 012/102] Fix LessPass GitHub link (#1238)
---
_includes/sections/password-managers.html | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/_includes/sections/password-managers.html b/_includes/sections/password-managers.html
index 14c153b4..c0f79ae6 100644
--- a/_includes/sections/password-managers.html
+++ b/_includes/sections/password-managers.html
@@ -44,7 +44,7 @@
description="LessPass is a free and open source password manager that generates unique passwords for websites, email accounts, or anything else based on a master password and information you know. No sync needed. Uses PBKDF2 and SHA-256. It's advised to use the browser addons for more security."
website="https://lesspass.com/"
forum="https://forum.privacytools.io/t/discussion-keepassxc/1344/2"
- github="https://github.com/keepassxreboot/keepassxc"
+ github="https://github.com/lesspass/lesspass"
firefox="https://addons.mozilla.org/en-US/firefox/addon/lesspass/"
chrome="https://chrome.google.com/webstore/detail/lesspass/lcmbpoclaodbgkbjafnkbbinogcbnjih"
android="https://play.google.com/store/apps/details?id=com.lesspass.android&hl=en"
--
2.49.1
From 0b92029f238d7aeac98e3d507b63a05ce0e2da8b Mon Sep 17 00:00:00 2001
From: Mikaela Suomalainen
Date: Sat, 31 Aug 2019 19:17:39 +0300
Subject: [PATCH 013/102] browser-tweaks: remove pyllyukko & add an anchor
(#1245)
* browser-tweaks: remove pyllyukko & add an anchor
Resolves: #1240
Resolves: #1244
---
_includes/sections/browser-tweaks.html | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/_includes/sections/browser-tweaks.html b/_includes/sections/browser-tweaks.html
index 62b2ec4e..2fa29e1e 100644
--- a/_includes/sections/browser-tweaks.html
+++ b/_includes/sections/browser-tweaks.html
@@ -144,10 +144,9 @@
-
Firefox user.js Templates
+
Firefox user.js Templates
ghacks-user.js - An ongoing comprehensive user.js template for configuring and hardening Firefox privacy, security and anti-fingerprinting.
-
pyllyukko/user.js - This is a user.js configuration file to harden Firefox's settings and make it more secure.
--
2.49.1
From a88adcc3bfa2b7585d926bda8ee8fdfd2bc40f53 Mon Sep 17 00:00:00 2001
From: blacklight447
Date: Sat, 31 Aug 2019 16:24:03 +0000
Subject: [PATCH 014/102] Change "for Experts only" to " For Power Users only"
in the addons section. (#1251)
* Update browser-addons.html
* Update browser-addons.html
---
_includes/sections/browser-addons.html | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/_includes/sections/browser-addons.html b/_includes/sections/browser-addons.html
index 7fb4028e..6bba6c32 100644
--- a/_includes/sections/browser-addons.html
+++ b/_includes/sections/browser-addons.html
@@ -94,7 +94,7 @@ chrome=""
%}
-
For Experts Only
+
For Power Users Only
These addons require quite a lot of interaction from the user. Some sites will not work properly until you have configured the add-ons.
--
2.49.1
From 0276f52ed234446ecbf84d9d2b1e32fa4468133d Mon Sep 17 00:00:00 2001
From: Mikaela Suomalainen
Date: Sat, 31 Aug 2019 20:05:36 +0300
Subject: [PATCH 015/102] operating-systems.html: add a warning for Linux/CPU
vulns (#1231)
* operating-systemd.html: add a warning for Linux/CPU vulns
* operating-systems: expand the Linux instructions for MDS mitigation
* operating-systems: s/multithreading/hyperthreading/
* operating-systems: address feedback, fix typo
* operating-systems: remove update-grub, close li tags
* operating-systems: @nitrohorse's first feedback
Doing this in a separate commit in case I misunderstood, so I can revert
* operating-systems: address feedback
* operating-systems: dd a duplicate paragraph
* operating-systems: add missing "grub" word
* operating-systems: fix the last step of nosmt
* operating-systems: mention macOS link
* operating-systems: address feedback
* operating-systems: add a dot
* operating-systems: fix link
---
_includes/sections/operating-systems.html | 27 +++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/_includes/sections/operating-systems.html b/_includes/sections/operating-systems.html
index 17700fbf..9dc6d511 100644
--- a/_includes/sections/operating-systems.html
+++ b/_includes/sections/operating-systems.html
@@ -41,6 +41,33 @@ tor="http://sejnfjrq6szgca7v.onion"
When running a enough recent kernel, you can check the CPU vulnerabilities it detects by tail -n +1 /sys/devices/system/cpu/vulnerabilities/*. By using tail -n +1 instead of cat, the file names are also visible.
+
+
+ In case you have an Intel CPU, you may notice "SMT vulnerable" display after running the tail command. To mitigate this, disable hyper-threading from the UEFI/BIOS. You can also take the following mitigation steps below if your system/distribution uses GRUB and supports /etc/default/grub.d/:
+
+
+
+
sudo mkdir /etc/default/grub.d/ to create a directory for additional grub configuration
+
echo GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT mds=full,nosmt" | sudo tee /etc/default/grub.d/mds.conf to create a new grub config file source with the echoed content
+
sudo grub-mkconfig -o /boot/grub/grub.cfg to generate a new grub config file including this new kernel boot flag
+
sudo reboot to reboot
+
after the reboot, check tail -n +1 /sys/devices/system/cpu/vulnerabilities/* again to see that MDS now says "SMT disabled."
Network wide DNS servers:
diff --git a/source_code.md b/source_code.md
index cfda0ba3..4658e1c9 100644
--- a/source_code.md
+++ b/source_code.md
@@ -313,9 +313,11 @@ PowerDNS: https://github.com/PowerDNS/pdns
#### Local DNS servers
+- Namecoin: https://github.com/namecoin
+
- Stubby: https://github.com/getdnsapi/stubby
-- Namecoin: https://github.com/namecoin
+- Unbound: https://github.com/NLnetLabs/unbound
## Digital Notebook
Joplin: https://github.com/laurent22/joplin
--
2.49.1
From d63474012a077285fa475b8be1f19e86cecd563e Mon Sep 17 00:00:00 2001
From: nitrohorse <1514352+nitrohorse@users.noreply.github.com>
Date: Tue, 3 Sep 2019 01:23:46 -0700
Subject: [PATCH 022/102] Replace DNSCrypt with DNSCrypt-Proxy (#1254)
* Replace DNSCrypt with DNSCrypt-Proxy
* Update source_code.md
* Add logo and forum link
* Remove redundant platform links
* Update _includes/sections/dns.html
Co-Authored-By: Mikaela Suomalainen
* Update description
---
_includes/sections/dns.html | 49 ++++++++++++++++------------
assets/img/tools/DNSCrypt-Proxy.png | Bin 0 -> 11516 bytes
assets/img/tools/DNSCrypt.png | Bin 2736 -> 0 bytes
source_code.md | 10 ++----
4 files changed, 31 insertions(+), 28 deletions(-)
create mode 100644 assets/img/tools/DNSCrypt-Proxy.png
delete mode 100644 assets/img/tools/DNSCrypt.png
diff --git a/_includes/sections/dns.html b/_includes/sections/dns.html
index 6e736080..10ab1412 100644
--- a/_includes/sections/dns.html
+++ b/_includes/sections/dns.html
@@ -1,30 +1,37 @@
Domain Name System (DNS)
-{% include cardv2.html
-title="OpenNIC - Service"
-image="/assets/img/tools/OpenNIC.png"
-description="OpenNIC is an alternate network information center/alternative DNS root which lists itself as an alternative to ICANN and its registries. Like all alternative root DNS systems, OpenNIC-hosted domains are unreachable to the vast majority of the Internet."
-website="https://www.opennic.org/"
-forum="https://forum.privacytools.io/t/discussion-opennic/338"
-github="https://github.com/OpenNIC"
+{%
+ include cardv2.html
+ title="OpenNIC - Service"
+ image="/assets/img/tools/OpenNIC.png"
+ description="OpenNIC is an alternate network information center/alternative DNS root which lists itself as an alternative to ICANN and its registries. Like all alternative root DNS systems, OpenNIC-hosted domains are unreachable to the vast majority of the Internet."
+ website="https://www.opennic.org/"
+ forum="https://forum.privacytools.io/t/discussion-opennic/338"
+ github="https://github.com/OpenNIC"
%}
-{% include cardv2.html
-title="Njalla - Domain Registration"
-image="/assets/img/provider/Njalla.png"
-description="Njalla only needs your email or jabber address in order to register a domain name for you. Created by people from The Pirate Bay and IPredator VPN. Accepted Payments: Bitcoin, Litecoin, Monero, DASH, Bitcoin Cash and PayPal. A privacy-aware domain registration service."
-website="https://njal.la/"
-tor="http://njalladnspotetti.onion"
-forum="https://forum.privacytools.io/t/discussion-njalla/339"
+{%
+ include cardv2.html
+ title="Njalla - Domain Registration"
+ image="/assets/img/provider/Njalla.png"
+ description="Njalla only needs your email or XMPP address in order to register a domain name for you. Created by people from The Pirate Bay and IPredator VPN. Accepted Payments: Bitcoin, Litecoin, Monero, DASH, Bitcoin Cash and PayPal. A privacy-aware domain registration service."
+ website="https://njal.la/"
+ tor="http://njalladnspotetti.onion"
+ forum="https://forum.privacytools.io/t/discussion-njalla/339"
%}
-{% include cardv2.html
-title="DNSCrypt - Tool"
-image="/assets/img/tools/DNSCrypt.png"
-description="A protocol for securing communications between a client and a DNS resolver. The DNSCrypt protocol uses high-speed high-security elliptic-curve cryptography and is very similar to DNSCurve, but focuses on securing communications between a client and its first-level resolver."
-website="https://dnscrypt.info/"
-forum="https://forum.privacytools.io/t/discussion-dnscrypt/340"
-github="https://github.com/jedisct1/dnscrypt-proxy"
+{%
+ include cardv2.html
+ title="DNSCrypt-Proxy - Tool"
+ image="/assets/img/tools/DNSCrypt-Proxy.png"
+ description="DNSCrypt-Proxy is a command-line DNS proxy with support for the encrypted DNS protocols, DNS over HTTPS and DNSCrypt. Can cache results to improve speed, and allows filtering, forwarding, and cloaking."
+ website="https://github.com/jedisct1/dnscrypt-proxy/"
+ forum="https://forum.privacytools.io/t/discussion-dnscrypt-proxy/1498"
+ github="https://github.com/jedisct1/dnscrypt-proxy/"
+ linux=""
+ mac=""
+ android=""
+ ios=""
%}