undefined | Better HN

0 pointsgruez8mo ago0 comments

It doesn't say they sell traffic logs outright, but they do send telemetry on blocked domains to the blocklist provider, and provides "a sparse statistical sampling of timestamped DNS responses" to "a very few carefully vetted security researchers". That's not exactly "selling traffic logs", but is fairly close. Moreover colloquially speaking, it's not uncommon to claim "google sells your data", even they don't provide dumps and only disclose aggregated data.

0 comments

daneel_w8mo ago

Disagree that it's fairly close to the statement "they resell traffic logs" and the implication that they leak all queried hostnames ("secret hosts, like for your work, will be leaked"). Unless Quad9 is deceiving users, both statements are, in fact, completely false.

https://quad9.net/privacy/policy/#22-data-collected

gruezOP8mo ago

>and the implication that they leak all queried hostnames ("secret hosts, like for your work, will be leaked").

The part about sharing data with "a very few carefully vetted security researchers" doesn't preclude them from leaking domains. For instance if the security researcher exports a "SELECT COUNT(*) GROUP BY hostname" query that would arguably count as "summary form", and would include any secret hostnames.

>https://quad9.net/privacy/policy/#22-data-collected

If you're trying to imply that they can't possibly be leaking hostnames because they don't collect hostnames, that's directly contradicted by the subsequent sections, which specifically mention that they share metrics grouped by hostname basis. Obviously they'll need to collect hostname to provide such information.

daneel_w8mo ago

I'm implying that I'm convinced they are not storing statistics on (thus leaking) every queried hostname. By your very own admission, they clearly state that they perform statistics on a set of malicious domains provided by a third party, as part of their blocking program. Additionally they publish a "top 500 domains" list regularly. You're really having a go with the shoehorn if you want "secret domains, like for your work" (read: every distinct domain queried) to fit here.

1 more reply

j / k navigate · click thread line to collapse

0 pointsgruez8mo ago0 comments

See: https://quad9.net/privacy/policy/

0 comments

daneel_w8mo ago

https://quad9.net/privacy/policy/#22-data-collected

gruezOP8mo ago

>and the implication that they leak all queried hostnames ("secret hosts, like for your work, will be leaked").

>https://quad9.net/privacy/policy/#22-data-collected

daneel_w8mo ago

1 more reply

j / k navigate · click thread line to collapse