![](https://webcf.waybackmachine.org/web/20211130004344im_/https://phiffer.org/media/2021/01/dphiffer-2021-01-12-4089-700w.jpg)
RIP John Baldessari
A small collection of artworks by John Baldessari, an amazing artist who died yesterday. If you’re unfamiliar with his work, A Brief History of John Baldessari is worth watching too.
![Painting of hand-lettered text: Tips for Artists Who Want To Sell. Generally speaking, paintings with light colors sell more quickly than paintings with dark colors. Subjects that sell well: Madonna and child, landscapes, flower paintings, still lifes (free of morbid props dead birds, etc.), nudes, marine pictures, abstracts, and surrealism. Subject matter is important: it has been said that paintings with cows and hens in them collect dust while the same paintings with bulls and roosters sell.](https://webcf.waybackmachine.org/web/20211130004344im_/https://phiffer.org/media/2020/01/baldessari-01-700w.jpg)
Configuring DNS-over-TLS on macOS
Note: this post has been updated to fix a mistake in the knot-resolver configuration. The earlier version would not have provided the privacy it purported to. I regret the error.
Until yesterday I hadn’t thought too much about DNS metadata leakage. Here’s how it works: your computer sends out a request to resolve a DNS hostname, let’s say “topsecretwebsite.example,” and your DNS server responds back with its IP address in a way that’s easy to eavesdrop on. It’s wild that the Internet works like this by default.
What happened yesterday is a company called CloudFlare (a popular and free content delivery network) announced a new DNS service at the IP address 1.1.1.1
. (Yes it launched on April 1, no it’s not a joke.) The service supports a couple of interesting privacy protecting options: DNS-over-HTTPS and DNS-over-TLS. Those technologies don’t guarantee your DNS lookups are accurate (check out DNSSEC for that), or that the DNS provider won’t someday betray you, they just make it’s harder to collect metadata by listening in on DNS’s cleartext port 53.