Statement

This repo was in­com­plete when pub­lished. That’s why some find­ings are kinda ass (ghidra) and some are bet­ter. Going for­ward, only se­ri­ous vul­ner­a­bil­i­ties will be shared (Floci, lib­ssh2, FFmpeg, c-ares).

In re­gard to AI us­age, my fuzzing work­flow was au­to­mated by AI with a strict har­ness. I used GPT-5.5 – 3-Codex-Spark for ALL the fuzzing, as barely any “thought” is nec­es­sary when pro­vided with an ef­fi­cient har­ness. Contrary to the grow­ing nar­ra­tive that I’m just some ran­dom child burn­ing to­kens, I DO ac­tu­ally have a de­gree in the sub­ject and have pub­lished mul­ti­ple pa­pers on fuzzing method­ol­ogy. I spent years re­search­ing and de­vel­op­ing new tools and ideas for how to fuzz. You do NOT need a SOTA model to help you iden­tify these is­sues, I promise! While be­ing able to af­ford a bet­ter model is help­ful, my data seems to show that it is only mar­ginal when paired with de­cent hu­man over­sight and a good har­ness. None of the ac­tual PoCs them­selves were vibe-coded; I did, in fact, hand-type them. I did use AI as­sis­tance for RustDesk, how­ever, as I’m not as fa­mil­iar with the lan­guage. The README files are very clearly en­tirely AI, how­ever, as AI can for­mat a pretty mean Markdown file. I re­viewed them to make sure they were ac­cu­rate.

I’d also like to credit some­one for the ob­j­dump find­ing. It turns out, some­one beat me to the punch (they also have a bet­ter PoC too!). Please give them the credit they de­serve: https://​github.com/​4D4J/​ob­j­dump-Out-Of-Bounds-write

News/Contact

New drops to­day ;) Biggest thing yet (DELAYED, I PROMISE THE WAIT WILL BE WORTH IT! After this, you guys will usu­ally get one new PoC a day)

I’ve also no­ticed a sur­pris­ing amount of “security re­searchers” aren’t able to ad­just the PoC to work in their en­vi­ron­ment. I will broaden the PoCs for those se­lect few…

If you wish to col­lab­o­rate/​dis­cuss with me, con­tact me on dis­cord @ashdfrkl

Sharing this repo keeps me mo­ti­vated to con­tinue drop­ping my find­ings for you all.

A con­sol­i­dated archive of my pub­lic proof-of-con­cept and vul­ner­a­bil­ity re­search write­ups.

Most fold­ers con­tain one of my for­mer stand­alone PoC re­pos, pre­served with its orig­i­nal README and tracked files. New re­search en­tries are added di­rectly here as self-con­tained fold­ers.

Contents

Consolidation Check

This sec­tion ap­plies to the for­mer stand­alone repos­i­to­ries listed above by com­mit hash.

The con­sol­i­da­tion was checked from fresh GitHub clones on June 23, 2026 be­fore the old stand­alone re­pos were re­moved.

The check com­pared each for­mer stand­alone re­po’s HEAD tree against the match­ing folder here us­ing Git tree data rather than a loose filesys­tem diff. For every tracked en­try, the check re­quired:

the same rel­a­tive path;

the same Git ob­ject type;

the same tree mode, in­clud­ing ex­e­cutable bits;

the same Git blob ID.

Matching Git blob IDs means the tracked file bytes are iden­ti­cal. The check cov­ered 12 re­pos and 96 tracked en­tries with zero mis­matches.

This repos­i­tory pre­serves the con­tents of those PoCs. Repository-level meta­data such as stars, is­sues, pull re­quests, re­leases, and sep­a­rate Git his­tory re­main in the orig­i­nal repos­i­tory his­to­ries.

Direct en­tries, in­clud­ing c-ares-tcp-uaf-calc-poc, ffm­peg-rasc-dlta-calc-poc, fire­fox-smartwin­dow-pri­vate-url-ex­fil-poc, floci-api­gate­way-vtl-rce-poc, lib­ssh2-cve-2026 – 55200-poc, lib­ssh2-pub­lickey-list-calc-poc, nghttp2-nghttpx-up­grade-queue-poi­son-poc, nmap-ipv6-extlen-wrap-poc, ph­p857-stream­bucket-soap-rce-rpoc, rust­desk-ses­sion-per­mis­sion-pocs, and sys­tem­in­former-phsvc-trusted-host-lpe-poc, are tracked by this repos­i­to­ry’s com­mit his­tory.

ABUSE

Do NOT, un­der any cir­cum­stances, use any ma­te­r­ial in this repos­i­tory ma­li­ciously. This is good-faith, open-dis­clo­sure vul­ner­a­bil­ity re­search in­tended to get more peo­ple in­ter­ested in ex­plor­ing this area of cy­ber­se­cu­rity.

Cybercrime is cringe.

Today’s links

Zuckerberg’s in­creas­ingly bizarre war on whistle­blow­ers: Under no cir­cum­stances should you rush out and read the book that prompted Mark Zuckerberg to de­mand $111m and eter­nal auc­to­r­ial si­lence.

Hey look at this: Delights to delec­tate.

Object per­ma­nence: Flame war­riors; Cryptography and casi­nos; TSA v dy­ing 95 year old wom­an’s adult di­a­per; Neoliberalism and Brexit; Beyond so­lu­tion­ism; How Thiel cheated with his Roth; Inequality’s sta­bi­lizer; Palm Pilot school; Gillmor on PR flacks; “How I Edited an Agricultural Paper; Conservative judge chokes lib­eral judge; Hollywoodnomics; Rubber fin­ger­tips v fin­ger­print read­ers; Snowden’s telep­res­ence ro­bot; “Shrill”; Moral haz­ard, “Three Rocks.”

Upcoming ap­pear­ances: London, Edinburgh, Sydney, Melbourne, Brighton, London, South Bend.

Recent ap­pear­ances: Where I’ve been.

Latest books: You keep read­in’ em, I’ll keep writ­in’ ’em.

Upcoming books: Like I said, I’ll keep writ­in’ ’em.

Colophon: All the rest.

Zuckerberg’s in­creas­ingly bizarre war on whistle­blow­ers (permalink)

More than a decade ago, a group of young, in­ter­net-con­nected Belarusian dis­si­dents launched a se­ries of in­creas­ingly high-stakes, in­creas­ingly sur­real con­fronta­tions with the cor­rupt, au­thor­i­tar­ian gov­ern­ment of Alexander Lukashenka, a man who is of­ten called “the last Soviet dic­ta­tor.”

Lukashenka’s se­cret po­lice — still called the KGB — rou­tinely ter­ror­ize and kid­nap pro-democ­racy ac­tivists, and all forms of protest are banned. It was against the back­drop of this un­re­lent­ing op­pres­sion that the ac­tivists launched a se­ries of whim­si­cal “flash mobs” that chal­lenged the Lukashenka regime’s will­ing­ness to crack down on even the most in­nocu­ous be­hav­ior.

One of these flash mobs was an ice cream so­cial: ac­tivists con­verged on a pub­lic square to eat ice cream cones. Lukashenka’s thugs beat them and dragged them away:

https://​web.archive.org/​web/​20070609164305/​http://​pics.live­jour­nal.com/​lito­ta_/​gallery/​0000bcch

The pro­tes­tors thought that by dar­ing Lukashenka to ar­rest peo­ple for eat­ing ice cream, they could cre­ate a win-win sit­u­a­tion: ei­ther Lukashenka would be re­vealed as the kind of ass­hole who thinks it should be il­le­gal to eat ice cream, or he’d be re­vealed as the kind of weak­ling who could­n’t keep a lid on dis­sent.

Lukashenka took the bait. And took it. And took it. In the years that fol­lowed, pro­test­ers would be ar­rested for smil­ing, clap­ping, and just stand­ing silently:

https://​www.in­dex­on­cen­sor­ship.org/​2011/​07/​be­larus-pro­test­ers-rally-on-the-web/

The world learned that Lukashenka was a buf­foon, and Belarusians af­firmed their view that this buf­foon would not hes­i­tate to mete out the most vi­cious pun­ish­ments for the most in­nocu­ous ac­tions:

https://​sci-hub.st/​10.1080/​25739638.2021.1928880

Speaking of thin-skinned, para­noid, wildly cor­rupt buf­foons who will stop at noth­ing to si­lence their en­e­mies, how about that Mark Zuckerberg, huh? Sure, all the head­lines these days are about Zuck’s in­ten­tion to trans­form Facebook into a sports bet­ting site:

https://​www.busi­nessin­sider.com/​metas-zucker­berg-en­ters-the-pre­dic­tion-mar­ket-arena-poly­mar­ket-2026 – 6

But in the UK, Zuckerberg’s war on whistle­blow­ers keeps find­ing new, ice cream grade depths of ab­sur­dity to plumb. The whistle­blower in ques­tion is, of course, Sarah Wynn-Williams, au­thor of the in­ter­na­tion­ally best­selling mem­oir Careless People, which de­tails the crim­i­nal­ity she wit­nesses dur­ing her years as the head of Facebook’s in­ter­na­tional re­la­tions team:

https://​plu­ral­is­tic.net/​2025/​04/​23/​zuck­er­streisand/#​zdgaf

Careless People is full of rev­e­la­tions about the gross in­sti­tu­tional mis­con­duct of Facebook, in­clud­ing its know­ing en­cour­age­ment of a geno­cide in Myanmar. But it’s also full of sto­ries about the se­vere per­sonal fail­ings of Facebook’s ex­ec­u­tive team, es­pe­cially Sheryl Sandberg, Joel Kaplan and Mark Zuckerberg.

These three come off as the most colos­sal of ass­holes, cruel, petty and preda­tory. Sandberg comes across as a sex­ual abuser who dreams of traf­fick­ing in poor peo­ple’s or­gans. Kaplan is an oaf whose plan to pro­vide paid in­ter­net ac­cess to refugee camps falls apart once he learns that refugees in camps don’t have any money (he also takes points off of Wynn-Williams’ work­place eval­u­a­tion for be­ing “unresponsive” over a pe­riod when she was in a near-death coma). Worst of all, though, is Zuckerberg, whose sins range from cheat­ing at Settlers of Catan to en­dan­ger­ing the Colombian peace process af­ter a 50-year civil war be­cause he re­fused to get out of bed be­fore noon. Zuck is also re­vealed to have given the Chinese state ac­cess to all of Facebook and the power to cen­sor con­tent they dis­liked, as part of a failed bid to get per­mis­sion to of­fer a Facebook ser­vice in China.

It’s a ter­ri­ble com­pany, with aw­ful prod­ucts, run by the worst peo­ple. Wynn-Williams’ con­di­tions of em­ploy­ment re­quired her to sign a con­tract that bound her to si­lence (nondisclosure), for­bade her from speak­ing ill of the com­pany (nondisparagement), and de­nied her ac­cess to the le­gal sys­tem in all her deal­ings with Meta (binding ar­bi­tra­tion).

Together, these three clauses — rou­tinely used by Meta to si­lence would-be whistle­blow­ers — meant that af­ter Wynn-Williams’s book was pub­lished, Meta got its ar­bi­tra­tor — a lawyer who is paid by Meta to ad­ju­di­cate con­trac­tual dis­putes in­stead of an ac­tual judge — to or­der her to never pro­mote or even speak about her book.

The ar­bi­tra­tor awarded Meta $50,000 for each crit­i­cism that Wynn-Williams levied, quickly com­ing to a to­tal of over $11,000,000. This vastly ex­ceeds the as­sets and life­time earn­ing po­ten­tial of Wynn-Williams and her hus­band (a re­porter with the Financial Times). If this bill ever truly comes due, they will be wiped out.

Which raises an in­ter­est­ing ques­tion: what else can they do to her? Once they’ve se­cured civil dam­ages that ex­ceeds her net worth sev­eral times over, why should­n’t she just flout her agree­ment? “Freedom’s just an­other word for noth­ing left to lose,” and all that.

Nevertheless, Wynn-Williams has scrupu­lously hewed to the ar­bi­tra­tor’s rules, stead­fastly re­main­ing silent about her book, its con­tents, and her ex­pe­ri­ences at Facebook/Meta. When she and I ap­peared on­stage to­gether in London for the launch for my book Enshittification last year, she fell silent and as­sumed a blank ex­pres­sion any time the sub­ject of Meta came up, and she did­n’t sign or sell books af­ter­ward:

https://​www.bar­bi­can.org.uk/​whats-on/​2025/​event/​cory-doc­torow-with-sarah-wynn-williams-chris-mor­ris

When she won the British Book Award, she did not speak to ac­cept it, and the cover of her book was blurred out on the over­head screen (she gave an ac­cep­tance speech on be­half of her co-win­ner, the late Virginia Giuffre, who was abused by Jeffrey Epstein and who ac­cused Prince Andrew of sex­ual as­sault):

https://​www.the­guardian.com/​books/​2026/​may/​11/​sarah-wynn-williams-and-vir­ginia-giuf­fre-jointly-win-free­dom-to-pub­lish-prize-at-british-book-awards

Nevertheless, when she was booked to speak — about a sub­ject other than her book — at the Hay Festival on a stage with Tim Wu and Carole Cadwalladr, Meta sent a le­gal threat to the fes­ti­val and Wynn-Williams, claim­ing that if by speak­ing about any­thing in pub­lic, she would vi­o­late the ar­bi­tra­tor’s or­der. Accordingly, Wynn-Williams main­tained to­tal si­lence and a blank fa­cial ex­pres­sion for an hour on stage, say­ing not one word, while Wu and Cadwalladr car­ried on a dis­cus­sion. Careless People was with­drawn from the fes­ti­val book­shop on the days she ap­peared there:

https://​www.the­guardian.com/​tech­nol­ogy/​2026/​may/​31/​meta-le­gal-ac­tion-forces-face­book-whistle­blower-to-stay-silent-at-hay-fes­ti­val

Nevertheless, Meta has in­formed Wynn-Williams that her silent, mo­tion­less ap­pear­ance on a stage con­sti­tutes a fur­ther breach of her “agreement” and that they are go­ing to seek even more dam­ages from her. This act of anti-ice cream thug­gery has pushed Wynn-Williams over the edge and now she’s sued to in­val­i­date her con­tract:

https://​www.the­guardian.com/​tech­nol­ogy/​2026/​jun/​25/​whistle­blower-sarah-wynn-williams-sues-meta-at­tempts-to-si­lence-her-care­less-peo­ple

Her lawyers have posted their doc­u­ments re­lated to the suit, in­clud­ing a 285-page de­c­la­ra­tion by Wynn-Williams ex­plain­ing the great lengths she’s gone to in or­der to com­ply with Meta’s de­mands, and the com­pa­ny’s ab­solute in­tran­si­gence and ar­bi­trary men­ace:

https://​katzbanks.com/​sarah-wynn-williams-meta-law­suit-doc­u­ments/

Why would Meta be so in­tent on de­stroy­ing this one high-pro­file whistle­blower? Surely they’ve heard of the Streisand Effect. There is no bet­ter way to en­sure that Wynn-Williams’ book (already a NYT #1 best­seller) con­tin­ues to at­tract read­ers than to con­tinue to es­ca­late these threats.

I think they’re per­fectly aware that they are con­vinc­ing more peo­ple to read Careless People (you should read it, it’s gen­uinely ex­cel­lent):

https://​us.macmil­lan.com/​books/​9781250391230/​care­less­peo­ple/

But I think they’ve de­cided that this is a price worth pay­ing, be­cause:

a) They’ve done even worse things since Wynn-Williams parted ways with the com­pany; and

b) They’re lay­ing off thou­sands of work­ers be­cause their gi­ant bet on AI has been a flop, leav­ing them with a mas­sive cash crunch; and

c) By de­stroy­ing Sarah Wynn-Williams, they can ter­ror­ize all those thou­sands of bit­ter ex-em­ploy­ees into si­lence about the even graver sins the com­pany has com­mit­ted.

That’s my the­ory, any­way:

https://​www.busi­nessin­sider.com/​meta-lay­offs-man­agers-soft­ware-en­gi­neers-ai-spend­ing-2026 – 6

Lukashenka knew that ar­rest­ing chil­dren for eat­ing ice cream would make him a laugh­ing­stock abroad. Zuckerberg knows that threat­en­ing Wynn-Williams for stand­ing in wooden si­lence on a stage makes him look like his­to­ry’s most guil­lotine­able bil­lion­aire. But both Lukashenka and Zuckerberg are will­ing to be thought a thin-skinned bully, so long as that means the peo­ple they op­press the most are too ter­ri­fied to ever chal­lenge their au­thor­ity.

Hey look at this (permalink)

You can’t make bil­lions with­out hurt­ing peo­ple https://​www.the­guardian.com/​tech­nol­ogy/​2026/​jun/​24/​cory-doc­torow-on-elon-musk-ai-bub­ble-bosses-cruel-fan­tasies

Cargo Culture https://​www.wheresy­oured.at/​cargo-cul­ture/

Cargo Culture https://​www.wheresy­oured.at/​cargo-cul­ture/

How Do You Beat an Oligarchy? One Bite at a Time. https://​www.the­bignewslet­ter.com/​p/​how-do-you-beat-an-oli­garchy-one

How Do You Beat an Oligarchy? One Bite at a Time. https://​www.the­bignewslet­ter.com/​p/​how-do-you-beat-an-oli­garchy-one

WIKIPEDIA WORKERS TO SEEK UNION RECOGNITION https://​www.cwu.org/​press_re­lease/​wikipedia-work­ers-to-seek-union-recog­ni­tion/

WIKIPEDIA WORKERS TO SEEK UNION RECOGNITION https://​www.cwu.org/​press_re­lease/​wikipedia-work­ers-to-seek-union-recog­ni­tion/

A Reasonable Analysis of the Social Web https://​ri­versee­ber.net/​blog/​post/​a-rea­son­able-analy­sis-of-the-so­cial-web/

A Reasonable Analysis of the Social Web https://​ri­versee­ber.net/​blog/​post/​a-rea­son­able-analy­sis-of-the-so­cial-web/

Object per­ma­nence (permalink)

#25yrsago Actual mu­sic piracy https://​www.the­guardian.com/​uk/​2001/​jun/​13/​ukcrime.nick­hop­kins

#25yrsago Flame war­riors https://​web.archive.org/​web/​20010603044914/​http://​www.win­ter­net.com/~​mikelr/​flame1.html

#25yrsago World court says Arizona mur­dered German pris­on­ers by deny­ing them con­sular ac­cess https://​www.cnn.com/​2001/​WORLD/​eu­rope/​06/​27/​ger­many.court/​in­dex.html

#25yrsago Private school buys every stu­dent a Palm Pilot https://​web.archive.org/​web/​20010709075203/​https://​www.wired.com/​news/​school/​0,1383,44812,00.html

#25yrsago Dan Gillmor’s guide for PR flacks https://​web.archive.org/​web/​20010626230530/​http://​web.sil­i­con­va­l­ley.com/​con­tent/​sv/​2001/​02/​20/​opin­ion/​dg­ill­mor/​weblog/​PR.htm

#20yrsago German pub­lisher at­tacks Bulgarian books-for-blind site https://​web.archive.org/​web/​20060629065445/​https://​protest.bloghub.org/​2006/​06/​27/​fight-for-copy­rights-in-bul­garia-turns-ugly/

#20yrsago Photographer calls crit­ic’s boss to com­plain https://​www.flickr.com/​pho­tos/​thomashawk/​176785431/

#20yrsago Daddle: a kid-sized sad­dle for adults https://​web.archive.org/​web/​20060618012713/​https://​www.cashel­com­pany.com/​dad.php

#20yrsago More on cryp­tog­ra­phy and on­line casi­nos https://​memex.craphound.com/​2006/​06/​26/​more-on-crypto-and-on­line-casi­nos/

#20yrsago Reasons that HD DVD for­mats have al­ready failed https://​www.au­dio­holics.com/​ed­i­to­ri­als/​10-rea­sons-why-high-de­f­i­n­i­tion-dvd-for­mats-have-al­ready-failed

#15yrsago Undercover video from North Korea: starv­ing chil­dren, hun­gry sol­diers https://​web.archive.org/​web/​20110629182200/​http://​www.abc.net.au/​news/​sto­ries/​2011/​06/​27/​3253979.htm

#15yrsago TSA asked 95 year old woman in a wheel­chair in ter­mi­nal stage of leukemia to re­move adult di­a­per for pat-down https://​web.archive.org/​web/​20110627091434/​http://​www.nwf­dai­lynews.com/​news/​mother-41324-search-adult.html

#15yrsago Reading of Mark Twain’s “How I Edited an Agricultural Paper” https://​ia801406.us.archive.org/​22/​items/​Cory_­Doc­torow_Pod­cast_209/​Cory_­Doc­torow_Pod­cast_209_­Mark_T­wain_Edit­ing_an_A­gri­cul­tur­al_­Pa­per-fixed.mp3

#15yrsago Paramount sends copy­right no­tice to Shapeways user over 3D print­able Super 8 cube https://​tod­dblatt.blogspot.com/​2011/​06/​cease-and-de­sist.html

#15yrsago Advice Goddess: How much longer must we be sub­jected to in­va­sive TSA pat­downs? https://​www.ad­vice­god­dess.com/​archives/​2011/​06/​24/​i_­think_y­oure_c.html

#15yrsago Conservative Wisconsin Supreme Court Justice al­leged to have choked lib­eral col­league https://​talk­ing­pointsmemo.com/​muck­raker/​wis-jus­tice-ann-walsh-bradley-jus­tice-prosser-put-his-hands-around-my-neck-in-anger-in-a-choke­hold

#15yrsago Hollywoodonomics: how Harry Potter and The Order of the Phoenix “lost” $167M https://​dead­line.com/​2010/​07/​stu­dio-shame-even-harry-pot­ter-pic-loses-money-be­cause-of-warner-bros-phony-baloney-ac­count­ing-51886/

#10yrsago I’m pro­filed in the Globe and Mail Report on Business mag­a­zine https://​web.archive.org/​web/​20160628142940/​https://​www.the­globe­and­mail.com/​re­port-on-busi­ness/​rob-mag­a­zine/​the-cru­sader-fight­ing-lock-happy-en­ter­tain­ment-con­glom­er­ates/​ar­ti­cle30520282/

#10yrsago Rubber fin­ger­tips to use with fin­ger­print-based au­then­ti­ca­tion sys­tems https://​www.csmon­i­tor.com/​World/​Pass­code/​Se­cu­rity-cul­ture/​2016/​0627/​Fake-fin­ger­prints-The-lat­est-tac­tic-for-pro­tect­ing-pri­vacy

#10yrsago How I grilled the best steaks I’ve ever eaten https://​memex.craphound.com/​2016/​06/​27/​how-i-grilled-the-best-steaks-ive-ever-eaten/

#10yrsago Supreme Court strikes down Texas abor­tion law https://​www.nbc­news.com/​news/​us-news/​supreme-court-strikes-down-strict-abor­tion-law-n583001?cid=sm_tw

#10yrsago Snowden’s flesh is trapped in Russia, but his mind roams the world in a ro­bot body https://​ny­mag.com/​in­tel­li­gencer/​2016/​06/​ed­ward-snow­den-life-as-a-ro­bot.html

#10yrsago China’s $10B/year PR min­istry mired in po­lit­i­cal fight with anti-cor­rup­tion/​loy­alty en­forcers https://​web.archive.org/​web/​20160701235749/​http://​www.econ­o­mist.com/​news/​china/​21701169-xi-jin­ping-sends-his-spin-doc­tors-spin­ning-who-draws-party-line?fsrc=scn/​tw/​te/​pe/​ed/​who­draw­sthep­arty­line

#10yrsago Snowden pub­licly con­demns Russia’s pro­posed sur­veil­lance law https://​www.the­guardian.com/​world/​2016/​jun/​26/​rus­sia-passes-big-brother-anti-ter­ror-laws

#10yrsago Yes Men punk the NRA with “buy one gun, give one gun” pro­gram https://​www.youtube.com/​watch?v=Ik­b66V2rDcw

#10yrsago Shrill: Lindy West’s amaz­ing, laugh-aloud mem­oir about fat­ness, abor­tion, trolls and rape-jokes https://​memex.craphound.com/​2016/​06/​27/​shrill-lindy-wests-amaz­ing-laugh-aloud-mem­oir-about-fat­ness-abor­tion-trolls-and-rape-jokes/

#10yrsago Neoliberalism, Brexit (and Bernie) https://​crooked­tim­ber.org/​2016/​06/​26/​trib­al­ism-trumps-ne­olib­er­al­ism/

#10yrsago McDonald’s 1987 fash­ion cat­a­log is a hor­ror­show https://​www.flickr.com/​pho­tos/​ja­son­liebigstuff/​3050116620/

#10yrsago Beyond “solutionism”: what role can tech­nol­ogy play in solv­ing deep so­cial prob­lems https://​ethanzuck­er­man.com/​2016/​06/​22/​the-worst-thing-i-read-this-year-and-what-it-taught-me-or-can-we-de­sign-so­ciotech­ni­cal-sys­tems-that-dont-suck/

#10yrsago Donald Trump’s an­no­tated Walk of Fame star https://​ddu­ane.tum­blr.com/​post/​146444083461/​someome-spray-painted-the-mute-sign-on-don­ald

#5yrsago New York City’s 100 worst land­lords https://​plu­ral­is­tic.net/​2021/​06/​26/​wax-roth­ful/#​nyc-land­lords

#5yrsago How Peter Thiel gamed the Roth IRA for tax-free bil­lions https://​plu­ral­is­tic.net/​2021/​06/​26/​wax-roth­ful/#​thiels-gam­bit

#5yrsago The Overlapping Infrastructure of Urban Surveillance https://​plu­ral­is­tic.net/​2021/​06/​26/​wax-roth­ful/#​sur­veil­lance-in­fo­graphic

#5yrsago The Doctrine of Moral Hazard https://​plu­ral­is­tic.net/​2021/​06/​27/​the-doc­trine-of-moral-haz­ard/

#1yrago Bill Griffith’s ‘Three Rocks’ https://​plu­ral­is­tic.net/​2025/​06/​27/​the-snap­per/#​9-to-107-spikes

#1yrago Surveillance is in­equal­i­ty’s sta­bi­lizer https://​plu­ral­is­tic.net/​2025/​06/​26/​au­tosta­bi­lizer/#​slicey-bois

Upcoming ap­pear­ances (permalink)

London: Idler Festival, Jul 11 https://​www.idler.co.uk/​fes­ti­val/

Edinburgh International Book Festival with Jimmy Wales, Aug 17 https://​www.ed­book­fest.co.uk/​events/​the-front-list-cory-doc­torow-and-jimmy-wales

Edinburgh International Book Festival with Jimmy Wales, Aug 17 https://​www.ed­book­fest.co.uk/​events/​the-front-list-cory-doc­torow-and-jimmy-wales

There’s a mo­ment in the movie Good Will Hunting which per­fectly sum­ma­rizes all the prob­lems with AI slop and on­line noise and in­fi­nite ad­vice con­tent.

Sean (played by Robin Williams) is sit­ting next to Will (Matt Damon) on a bench in Boston Public Garden. I live here, so I know it well. The area is im­pos­si­bly green, sur­rounded by wil­low trees and a sparkling pond and par­ents chas­ing their kids who are chas­ing some mal­lards who are chas­ing their duck­lings.

If you pause the movie scene at just the right mo­ment, you can ac­tu­ally see the ex­act spot my wife and I took our wed­ding pho­tos as we tor­tured 14 of our clos­est friends in 96-degree hu­mid­ity one July af­ter­noon.

In this par­tic­u­lar mo­ment of the film, Robin Williams de­liv­ers a leg­endary speech.

The en­tire thing is worth watch­ing (allow for five min­utes of sit­ting still af­ter­wards), but in ad­di­tion to the video, I’ve placed the tran­script be­low with my own em­pha­sis added.

If I asked you about art, you’d prob­a­bly give me the skinny on every art book ever writ­ten. Michelangelo? You know a lot about him. Life’s work, po­lit­i­cal as­pi­ra­tions, him and the pope, sex­ual ori­en­ta­tion, the whole works, right? But I bet you can’t tell me what it smells like in the Sistine Chapel. You’ve never ac­tu­ally stood there and looked up at that beau­ti­ful ceil­ing. Seen that.If I asked you about women, you’d prob­a­bly give me a syl­labus of your per­sonal fa­vorites. You may have even been laid a few times. But you can’t tell me what it feels like to wake up next to a woman and feel truly happy.​You’re a tough kid. I ask you about war, and you’d prob­a­bly, uh, throw Shakespeare at me, right? “Once more into the breach, dear friends.” But you’ve never been near one. You’ve never held your best friend’s head in your lap and watched him gasp his last breath, look­ing to you for help.And if I asked you about love you prob­a­bly quote me a son­net. But you’ve never looked at a woman and been to­tally vul­ner­a­ble. Known some­one could level you with her eyes. Feeling like God put an an­gel on earth just for you, who could res­cue you from the depths of hell.And you would­n’t know what it’s like to be her an­gel and to have that love for her to be there for­ever. Through any­thing. Through can­cer. You would­n’t know about sleep­ing sit­ting up in a hos­pi­tal room for two months hold­ing her hand be­cause the doc­tors could see in your eyes that the term “visiting hours” does­n’t ap­ply to you.You don’t know about real loss, be­cause that only oc­curs when you love some­thing more than you love your­self. I doubt you’ve ever dared to love any­body that much.I look at you; I don’t see an in­tel­li­gent, con­fi­dent man; I see a cocky, scared shit­less kid. But you’re a ge­nius, Will. No one de­nies that. No one could pos­si­bly un­der­stand the depths of you. But you pre­sume to know every­thing about me be­cause you saw a paint­ing of mine and you ripped my fuck­in’ life apart.You’re an or­phan right? Do you think I’d know the first thing about how hard your life has been, how you feel, who you are be­cause I read Oliver Twist? Does that en­cap­su­late you?Per­son­ally, I don’t give a shit about all that, be­cause you know what? I can’t learn any­thing from you I can’t read in some fuck­in’ book. Unless you wanna talk about you. Who you are. And I’m fas­ci­nated. I’m in. But you don’t wanna do that, do you, sport? You’re ter­ri­fied of what you might say.Your move, chief.

If I asked you about art, you’d prob­a­bly give me the skinny on every art book ever writ­ten. Michelangelo? You know a lot about him. Life’s work, po­lit­i­cal as­pi­ra­tions, him and the pope, sex­ual ori­en­ta­tion, the whole works, right? But I bet you can’t tell me what it smells like in the Sistine Chapel. You’ve never ac­tu­ally stood there and looked up at that beau­ti­ful ceil­ing. Seen that.

If I asked you about women, you’d prob­a­bly give me a syl­labus of your per­sonal fa­vorites. You may have even been laid a few times. But you can’t tell me what it feels like to wake up next to a woman and feel truly happy.​

You’re a tough kid. I ask you about war, and you’d prob­a­bly, uh, throw Shakespeare at me, right? “Once more into the breach, dear friends.” But you’ve never been near one. You’ve never held your best friend’s head in your lap and watched him gasp his last breath, look­ing to you for help.

And if I asked you about love you prob­a­bly quote me a son­net. But you’ve never looked at a woman and been to­tally vul­ner­a­ble. Known some­one could level you with her eyes. Feeling like God put an an­gel on earth just for you, who could res­cue you from the depths of hell.

And you would­n’t know what it’s like to be her an­gel and to have that love for her to be there for­ever. Through any­thing. Through can­cer. You would­n’t know about sleep­ing sit­ting up in a hos­pi­tal room for two months hold­ing her hand be­cause the doc­tors could see in your eyes that the term “visiting hours” does­n’t ap­ply to you.

You don’t know about real loss, be­cause that only oc­curs when you love some­thing more than you love your­self. I doubt you’ve ever dared to love any­body that much.

I look at you; I don’t see an in­tel­li­gent, con­fi­dent man; I see a cocky, scared shit­less kid. But you’re a ge­nius, Will. No one de­nies that. No one could pos­si­bly un­der­stand the depths of you. But you pre­sume to know every­thing about me be­cause you saw a paint­ing of mine and you ripped my fuck­in’ life apart.

You’re an or­phan right? Do you think I’d know the first thing about how hard your life has been, how you feel, who you are be­cause I read Oliver Twist? Does that en­cap­su­late you?

Personally, I don’t give a shit about all that, be­cause you know what? I can’t learn any­thing from you I can’t read in some fuck­in’ book. Unless you wanna talk about you. Who you are. And I’m fas­ci­nated. I’m in. But you don’t wanna do that, do you, sport? You’re ter­ri­fied of what you might say.

Your move, chief.

***

(Five min­utes of still­ness later…)

***

Okay, I’m ready to talk about it.

Without say­ing it, he’s say­ing it. There’s a dif­fer­ence.

There’s a dif­fer­ence be­tween ex­per­tise and wis­dom, be­tween the­ory and ex­pe­ri­ence, be­tween know­ing and liv­ing. Will has the first in spades. He’s the hu­man equiv­a­lent of ChatGPT, that’s for sure. That gives him a smug at­ti­tude that be­cause he’s read the books and knows the the­o­ries, he’s smart and ca­pa­ble and good. But Sean has some­thing Will lacks. Experience. He’s ac­tu­ally lived all those things first­hand. War, love, sick­ness, loss, hopes, dreams, fail­ures, suc­cesses. Meanwhile, Will has never been out­side Boston, and he’s scared to let him­self get close to any­one enough to get hurt.

That’s this mo­ment, summed up. That’s what WE do as hu­mans and why YOU mat­ter right now, ar­guably more than ever.

AI has read the in­ter­net. It can’t read the room. It has­n’t lived a life.

It knows. It does not feel nor ex­pe­ri­ence. Because it does not live.

But you do, and right now, there are end­less voices con­vinc­ing you to stop liv­ing, mostly so they can sell you their “secrets” to suc­cess or their “magic” tools which pro­fess to know the an­swers you could­n’t pos­si­bly know your­self.

We’ve reached a dan­ger­ous mo­ment. This mo­ment threat­ens to con­vince too many of us that our lived ex­pe­ri­ences do not mat­ter. I see it of­ten. An artist will claim some­thing like, “AI has never fallen in love. It has never failed then per­sisted, with scar tis­sue emerg­ing and dreams still in tact.” Then peo­ple roll their eyes. I get it. I hear it. I know it feels squishy and easy to dis­miss.

Like a gnat buzzing your ear on a park bench.

So let’s make it more con­crete, shall we?

There is a very real dif­fer­ence be­tween read­ing about war and be­ing in war. Can we agree?

Reading about love and be­ing in love are fun­da­men­tally dif­fer­ent things. Yes?

Reading Oliver Twist [giant “Not Equal To” sym­bol] be­ing an or­phan.

Knowing and liv­ing are dif­fer­ent. And right now, the mere idea of “knowing” is win­ning out, when it’s hi­lar­i­ously in­suf­fi­cient to do any­thing ef­fec­tive or mean­ing­ful or good. The in­ter­net and many voices us­ing it would have us con­vinced that be­cause there’s so much to know and be­cause some­one else knows more and be­cause a soft­ware tool can tell you things it “knows,” then all of that should cause you to sit down, shut up, stop feel­ing con­fi­dent in what you’ve done or seen or felt. Because what’s your life in the face of in­fi­nite knowl­edge?

Turns out, every­thing.

Okay fine, we’re still too the­o­ret­i­cal and artsy fartsy for some. I hate it, but I get it. Set aside Sean’s lines and look at Robin Williams’s per­for­mance. Step out of the story and ex­am­ine the act­ing. Robin Williams was given a script. Any other ac­tor could have been handed that script, but ZERO other ac­tors would have per­formed it like that.

The script has all the words, but he brought the words to life. What’s more, he did so by draw­ing on his own life. That’s how artists func­tion. That’s why they can pro­duce things that shock and as­tound and ter­rify and be­witch peo­ple (h/t to Bourdain for ​that line​). Actors and other artists make choices for how to em­body and con­vey the emo­tions of the thing, not just “correctly” arrange in­for­ma­tion for dis­sem­i­na­tion.

I’ve heard it said that sci­en­tific dis­cov­ery would hap­pen re­gard­less of who does it. Science is the search for truth about how the world works. Given enough time and re­sources, Scientist #2 would have dis­cov­ered the same truth that Scientist #1 dis­cov­ered.

Art is dif­fer­ent.

No two artists would pro­duce the same ex­act thing. Given enough time and re­sources, no two ac­tors would have in­de­pen­dently landed on the same ex­act cre­ation, nor even the same sub­tle el­e­ment or mo­ment in that scene or piece or pro­ject. Because it’s not about the search for ex­ter­nal truth. It’s about the syn­the­sis of that truth into mean­ing. It’s all in­ter­nal. And zero hu­mans have lived the same lives beat-for-beat.

That shit mat­ters in our work. I don’t care if you write blog posts for a Fortune 500, host a pod­cast about HR, write books about sto­ry­telling, or paint in your garage. It’s all art. Because art is about mak­ing sense of hu­man feel­ings and ex­is­tence by con­fronting the in­ter­nal, turn­ing it into mean­ing oth­ers can ac­cess. Teach a tac­tic in a so­cial feed or sculpt the next great statue for a mu­seum in Rome, it does­n’t mat­ter. It flows through YOU in ways big and small.

Ignore the “YOU” part at your own peril.

Robin Williams cer­tainly did­n’t.

Where did his per­for­mance come from? How did those mo­ments take shape? Only the ac­tor could tell you, and ac­tu­ally, he prob­a­bly could­n’t. It was sensed more than it was con­sciously con­sid­ered, but the alchemy re­quired his lived ex­pe­ri­ences. Maybe the pause came from a child­hood mem­ory of scuff­ing his knees as he wres­tled on the dri­ve­way with a friend. “Get tougher, Robin!” The glances away from Will might come from a lost love which the Hollywood Reporter never told us the man ex­pe­ri­enced. His face mus­cles weren’t trem­bling so much as echo­ing all the trauma he’d en­dured. He’s not re­mem­ber­ing his life. He’s re-liv­ing it.

So much work we en­counter on­line to­day feels like a script the cre­ator for­got to act. The words are there, but they’re life­less. Then the mar­ket said, “Here’s a tool to pro­duce more of that stuff, and re­mem­ber: you can’t do any­thing bet­ter than this. Because it’s hard, and some­thing that is hard is bad, and also you are bad—un­til you use our tools!”

They want to dis­till every­thing down to a sci­ence. It’s our job to el­e­vate it to an art.

It turns out AI and peo­ple both rely on LLMs as their foun­da­tions. AI has large lan­guage mod­els. People have lit­tle life mo­ments.

But we sim­ply don’t draw on ours con­sis­tently or con­fi­dently enough. Doing so would be their night­mare. They don’t know how to sell the dream to peo­ple too busy day­dream­ing. They can’t dom­i­nate our lives if we’re ac­tu­ally liv­ing.

It’s that stuff which makes our work mat­ter and makes us each mat­ter too, and this mo­ment de­mands more of it from you and from me. The new­comer to a field or topic, the ex­pert with 40 years’ ex­pe­ri­ence, the un­known voice, the broadly known sto­ry­teller—it does­n’t mat­ter. Drawing on our lives and us­ing our own “LLMs” are what this world needs in an era de­fined by AI slop and strip-min­ing every cor­ner of life for eye­balls and dol­lars.

Plenty of oth­ers have sim­i­lar ex­per­tise and skills. Plenty of oth­ers talk about sim­i­lar top­ics. But how you SEE the world sep­a­rates you. Said bet­ter: how YOU see the world.

Everyone’s got a script, but very few un­der­stand how to bring the words to life.

Your au­di­ence can’t learn any­thing from you that they can’t read in a fuck­in’ book … or post or video or AI snip­pet.

Unless you wanna talk about you. Who you are. Then I’m fas­ci­nated. I’m in.

But you don’t wanna do that, do you? You’re ter­ri­fied of what you might say.

Your move, chief.

A liv­ing at­las of open we­b­cams dis­cov­ered on the pub­lic in­ter­net — browse, fil­ter and watch them live from the edge.

A liv­ing at­las of open we­b­cams dis­cov­ered on the pub­lic in­ter­net — browse, fil­ter and watch them live from the edge.

Check if any cam­era near you is ex­posed. Less than 10 sec­onds. No lo­gin re­quired.

Marfa Public Radio Puts You to Sleep

,

Marfa Public Radio is lit­er­ally never asleep. It op­er­ates 24/7 (except when light­ning strikes) and there’s so much that goes on be­hind the scenes to make this hap­pen– fundrais­ing, com­pli­ance, pro­to­cols, emer­gency re­sponse, main­te­nance…the list goes on and on.

Do you lay awake won­der­ing what FCC com­pli­ance en­tails? Ever won­dered what NPR’s code of jour­nal­is­tic ethics in­volves for the news­room?

We may never be able to ex­plain what it takes to op­er­ate the sta­tion, but we can put you to sleep try­ing to.

For this fall mem­ber­ship drive we bring you Marfa Public Radio Puts You to Sleep. It’s a sleep pod­cast wherein we read you the bor­ing doc­u­ments es­sen­tial to our jobs, in the hopes we might lull you into slum­ber.

We do ac­tu­ally hope that you fall asleep lis­ten­ing to this, but when you wake up, help us con­tinue to read our bor­ing doc­u­ments and keep Marfa Public Radio awake by do­nat­ing to the sta­tion at mar­fa­pub­l­i­cra­dio.org/​do­nate.

A few weeks ago, I added a silly, funny ex­per­i­ment on this web­site. I talked about it on this blog post. It was a tiny Town Square at the bot­tom of every page 2.

When you visit the site, you’ll see a small strip pop­u­lated by stick fig­ures. Each fig­ure rep­re­sents an­other vis­i­tor cur­rently brows­ing the web­site. You can see what page peo­ple are read­ing, walk around and send mes­sages. For ex­am­ple, you could see some­one read­ing the same ar­ti­cle as you and start a dis­cus­sion about it.

The goal was­n’t to build an­other so­cial net­work.

It was to bring back a small feel­ing that the web used to have: the sense that there are ac­tual peo­ple on the other side of the screen.

Town Square is in­ten­tion­ally tiny and for­get­ful. There are no ac­counts, no pro­files, no fol­lower counts, no per­ma­nent chat his­tory. Messages ex­ist only while peo­ple are there to read them.

After sev­eral peo­ple asked me how they could add this to their own web­sites, I de­cided to open source it and pro­vide a pub­lic server, so any­one can eas­ily in­te­grate Town Square into their site with no self-host­ing re­quired. I hope it en­cour­ages a few more web­sites to feel like places in­stead of pages.

If you would like to host it your­self, fork it or con­tribute with the pro­ject, the repo is https://​github.com/​caue­napier/​Town­Square/

If you don’t want to (or don’t know how to) host it your­self, you can reg­is­ter your web­site on Town Square.

I have a lot of ideas for what I could to next. It has been a fun, re­lax­ing, small pro­ject so far.

Like adding more props for the char­ac­ters to in­ter­act and im­prov­ing overal user ex­pe­ri­ence on the chat fea­ture. But I’m also very ex­cited about the idea of im­ple­ment­ing the func­tion­al­ity to con­nect your TownSquare with an­other web­site, like a neigh­bour. You would walk to the edge of the site and trans­port to the neigh­bour web­site, cre­at­ing a net­work of town­squares. Like a Webring 1

If you like the idea and have re­quests, changes, or ideas for what Town Square could be­come, send me an email. I’d gen­uinely love to hear from you.

Or the Indie Webring, as I have in the bot­tom of my page. ↩

Or the Indie Webring, as I have in the bot­tom of my page. ↩

Check it at the bot­tom of this page. ↩

Check it at the bot­tom of this page. ↩

Error 403 Forbidden

Forbidden

Error 54113

Details: cache-lga21930-LGA 1782654560 579453468

Varnish cache server

Are you a ro­bot?

Please con­firm you are a hu­man by com­plet­ing the captcha chal­lenge be­low.

Reference num­ber: a12d28847ee5b7a0

IP Address: 167.99.127.20

Ford has ad­mit­ted to re­hir­ing hun­dreds of hu­man work­ers af­ter its ag­gres­sive AI adop­tion strat­egy back­fired.

The US au­tomaker hired over 350 vet­eran en­gi­neers, re­ferred to in­ter­nally as “gray beards”, over the past three years in or­der to ad­dress mis­takes made by au­to­mated sys­tems.

The staff will lead qual­ity re­views af­ter the au­toma­tion is­sues cost the com­pany bil­lions of dol­lars, Bloomberg re­ported, while some work­ers will also help im­prove and train the AI sys­tems.

“We had been re­ly­ing more and more on au­to­mated qual­ity sys­tems and not get­ting the de­sired re­sults,” said Kumar Galhotra, Ford’s chief op­er­at­ing of­fi­cer.

“We brought back tech­ni­cal spe­cial­ists and they hunt for fail­ure points be­fore a part ever reaches the plant floor.”

Ford had been in­creas­ingly re­ly­ing on AI-driven in­spec­tion sys­tems to stream­line pro­duc­tion and ad­dress qual­ity con­trol is­sues, how­ever the firm ac­knowl­edged that AI lacked the nu­anced judge­ment when it came to com­plex prob­lems.

After re­hir­ing ex­pe­ri­enced en­gi­neers, Ford ex­pe­ri­enced a marked im­prove­ment in its qual­ity stan­dards.

According to the lat­est J.D. Power Initial Quality Survey, an an­nual au­to­mo­tive bench­mark that mea­sures the qual­ity of new ve­hi­cles, Ford ranked top among main­stream brands — the first time it has achieved that mile­stone in 16 years.

Ford con­tin­ues to have qual­ity is­sues with its older ve­hi­cles, and re­mains the most re­called au­tomaker in the US, though ex­ec­u­tives blamed this on past is­sues in­volv­ing au­toma­tion, rather than the re­hir­ing of hu­mans.

The com­pany said it would not aban­don its use of AI, but plans to now use it in con­junc­tion with hu­man over­sight and ex­pe­ri­ence.

“Artificial in­tel­li­gence is a fan­tas­tic tool, but it’s only as good as the in­for­ma­tion you use to train it,” said Charles Poon, Ford’s vice pres­i­dent of ve­hi­cle hard­ware en­gi­neer­ing.

“Over prior years, we did­n’t pay as much at­ten­tion as we should have to the ex­pe­ri­ence of our most knowl­edge­able en­gi­neers that have been with us through many prod­uct cy­cles.

“Mistakenly, we thought that by just in­tro­duc­ing ar­ti­fi­cial in­tel­li­gence and in­gest­ing the de­sign re­quire­ments that we had, that that would pro­duce a high-qual­ity prod­uct.”

DNS Resolver Guide

Independent ref­er­ence

Pick what mat­ters to you, such as pri­vacy, mal­ware block­ing, parental con­trols, speed, IPv6, or a spe­cific ju­ris­dic­tion, and the finder nar­rows 29 global pub­lic re­solvers to the ones that fit. A full com­par­i­son table and re­search-backed de­ci­sion notes fol­low.

29public re­solvers

15jurisdictions

DoH / DoT / DoQencrypted trans­ports

12studies cited

Find a re­solver for your re­quire­ments

Check what mat­ters to you. Transport, DNSSEC, IPv6, ju­ris­dic­tion and op­er­a­tor type are hard fil­ters. The pri­or­i­ties are scored and ranked.

My pri­or­i­ties

Maximum pri­vacy and no log­ging­Min­i­mal or no query log­ging, pri­vacy-first op­er­a­tor Block mal­ware and phish­ingSe­cu­rity block­list on by de­fault or via a sim­ple vari­ant Block ads and track­er­sNet­work-wide ad and tracker fil­ter­ing Parental con­trols and adult-con­tent block­ing­Fam­ily or adult-con­tent fil­ter avail­able No fil­ter­ing (unaltered DNS)Returns an­swers ex­actly as pub­lished Fully cus­tomiz­able fil­ter­ing­Choose your own block­lists or rules via an ac­count Top-tier speed (global any­cast)Large low-la­tency any­cast net­work Non-commercial op­er­a­torNon­profit, reg­istry, com­mu­nity or pub­lic-in­ter­est, not a for-profit com­pany

Must sup­port en­crypted DNS

DNS-over-HTTPS (DoH) DNS-over-TLS (DoT) DNS-over-QUIC (DoQ) DNSCrypt

Other re­quire­ments

Must val­i­date DNSSEC Must of­fer IPv6Provides IPv6 re­solver ad­dresses Operator ju­ris­dic­tion

Operator type

EDNS Client Subnet (ECS)

Test DNS speed from your lo­ca­tion

This mea­sures DNS-over-HTTPS round-trip time from your browser to each DoH-capable re­solver, so you can see which is fastest where you ac­tu­ally are. Plain-DNS-only re­solvers can­not be tested this way. Results are a rel­a­tive guide and in­clude TLS and HTTP over­head, so run it a cou­ple of times. Your browser queries each re­solver di­rectly, which re­veals your IP ad­dress to them; noth­ing is sent any­where else.

Benchmarks the DoH-capable re­solvers, takes a few sec­onds.

Technique in­spired by the open-source DNS Speed Test by Silviu Stroe (GPL-3.0); this is an in­de­pen­dent im­ple­men­ta­tion. It runs only when this page is served over HTTPS. For re­solvers not testable here, that ded­i­cated tool bench­marks a wider DoH set.

All 29 global pub­lic re­solvers

Click a col­umn header to sort. Search by name, op­er­a­tor, ju­ris­dic­tion, or fea­ture. Filter-variant ad­dresses (malware, fam­ily, un­fil­tered) are listed in the Filtering cell.

How to de­cide: what the re­search says

Findings from peer-re­viewed DNS mea­sure­ment stud­ies that should shape the trade-offs above.

Speed: plain DNS has the low­est la­tency, but en­crypted keeps up

Encrypted trans­ports (DoH and DoT) add la­tency per query, yet whole-page load times are of­ten close to plain DNS, and DoH’s over­head is small in prac­tice. On lossy or high-la­tency links, plain Do53 still wins. Performance also varies by provider and re­gion, so the fastest re­solver de­pends on where you are.

Hounsel et al., WWW 2020; Böttger et al., IMC 2019; Chhabra et al., IMC 2021.

Encrypted DNS re­sists tam­per­ing, not just snoop­ing

The largest end-to-end study of en­crypted DNS found queries are far less likely to be in­ter­cepted or al­tered in tran­sit than plain DNS, with only mi­nor over­head. Operator qual­ity varies, though: about 25% of DoT providers in that study served in­valid TLS cer­tifi­cates, so favour well-run providers.

Lu et al., IMC 2019.

Encryption hides queries from the net­work, not from the re­solver

Whichever provider you choose still sees every do­main you look up. If that wor­ries you, pre­fer no-log­ging op­er­a­tors, or an obliv­i­ous de­sign (ODoH) where a proxy sep­a­rates your iden­tity from your queries so no sin­gle party sees both. Cloudflare and Apple have de­ployed ODoH.

Schmitt, Edmundson & Feamster, PoPETS 2019; Singanamalla et al., 2021.

DNSSEC val­i­da­tion is what stops forged an­swers

Only a val­i­dat­ing re­solver pro­tects you from spoofed records. Google, Cloudflare and Quad9 all val­i­date, and they han­dled the first root-key (KSK) rollover with­out break­ing users. If in­tegrity mat­ters, treat DNSSEC val­i­da­tion as a must.

Müller et al., IMC 2019.

ECS trades speed for pri­vacy

EDNS Client Subnet sends part of your IP to CDNs for bet­ter geo-rout­ing. Google and OpenDNS send it for sharper CDN map­ping; Cloudflare and stan­dard Quad9 leave it off for pri­vacy. Pick based on which you value more.

“A Look at the ECS Behavior of DNS Resolvers”, IMC 2019.

Jurisdiction and cen­tral­iza­tion mat­ter too

The op­er­a­tor’s le­gal home gov­erns what can be com­pelled or logged, and a hand­ful of providers now carry a large share of the world’s re­cur­sive traf­fic. The U.S. NSA has also warned that ex­ter­nal re­solvers by­pass in­ter­nal DNS fil­ter­ing and in­spec­tion, so weigh con­trol against con­ve­nience.

Moura et al., IMC 2020; NSA guid­ance, 2021.

DNS-over-QUIC is now the fastest en­crypted trans­port

A 2022 mea­sure­ment of DoQ found it al­ready beats both DoT and DoH on re­sponse time, though about 40% of hand­shakes were slowed by QUIC’s ad­dress-val­i­da­tion limit. Where your client and re­solver both sup­port it (Quad9, AdGuard, NextDNS, Control D, Mullvad, UncensoredDNS, and the Chinese ma­jors here), DoQ is the en­crypted op­tion to pre­fer.

Kosek et al., PAM 2022.

DNSCrypt: the old­est en­crypted op­tion, and the hard­est to mea­sure

DNSCrypt pre­dates DoH, DoT, and DoQ (version 2 dates to 2013). It en­crypts from the first packet us­ing a re­solver’s pre-shared pub­lic key, so there is no plain­text host­name lookup and no de­pen­dency on cer­tifi­cate au­thor­i­ties, and its Anonymized DNS mode (2019) also hides client IPs. Among the re­solvers here it is of­fered by Quad9, OpenDNS, AdGuard, NextDNS, Control D, and Yandex. Reliable us­age num­bers are scarce, though: pop­u­la­tion-scale mea­sure­ments such as APNIC Labs track DoH and DoT but not DNSCrypt, so there is no trust­wor­thy pub­lic fig­ure for how many peo­ple use it.

DNSCrypt Project; APNIC Labs en­crypted-DNS mea­sure­ment.

Encryption does not hide which sites you visit

Even over DoH, traf­fic analy­sis can iden­tify the do­mains you visit with high ac­cu­racy, and the stan­dard EDNS padding does not fully pre­vent it. If that threat model ap­plies to you, pair en­crypted DNS with Tor or an obliv­i­ous de­sign rather than re­ly­ing on padding.

Siby et al., NDSS 2020.

Public re­solvers do not be­have the same way

A 2023 study of Extended DNS Errors across ma­jor re­solvers found they dis­agreed on di­ag­nos­tic er­ror re­port­ing in 94% of test cases, with Cloudflare the most pre­cise. Implementation qual­ity and stan­dards com­pli­ance dif­fer be­tween providers, which af­fects trou­bleshoot­ing and re­li­a­bil­ity.

Nosyk, Korczyński & Duda, IMC 2023.

References

A. Hounsel et al., “Comparing the Effects of DNS, DoT, and DoH on Web Performance”, WWW 2020 (arXiv:1907.08089).

T. Böttger et al., “An Empirical Study of the Cost of DNS-over-HTTPS”, ACM IMC 2019.

R. Chhabra, P. Murley, D. Kumar, M. Bailey, G. Wang, “Measuring DNS-over-HTTPS Performance Around the World”, ACM IMC 2021.

C. Lu et al., “An End-to-End, Large-Scale Measurement of DNS-over-Encryption: How Far Have We Come?”, ACM IMC 2019.

M. Kosek et al., “One to Rule Them All? A First Look at DNS over QUIC”, PAM 2022 (arXiv:2202.02987).

S. Siby et al., “Encrypted DNS => Privacy? A Traffic Analysis Perspective”, NDSS 2020 (arXiv:1906.09682).

P. Schmitt, A. Edmundson, N. Feamster, “Oblivious DNS: Practical Privacy for DNS Queries”, PoPETS 2019 (arXiv:1806.00276).

S. Singanamalla et al., “Oblivious DNS over HTTPS (ODoH)”, arXiv:2011.10121.

M. Müller et al., “Roll, Roll, Roll your Root: Analysis of the First Ever DNSSEC Root KSK Rollover”, ACM IMC 2019.

“A Look at the ECS Behavior of DNS Resolvers”, ACM IMC 2019.

G. Moura, S. Castro, W. Hardaker, M. Wullink, C. Hesselman, “Clouding up the Internet: how cen­tral­ized is DNS traf­fic be­com­ing?”, ACM IMC 2020.

Y. Nosyk, M. Korczyński, A. Duda, “Extended DNS Errors: Unlocking the Full Potential of DNS Troubleshooting”, ACM IMC 2023.

Smaller, com­mu­nity-run, and re­gional re­solvers

Niche, hobby, com­mu­nity, or coun­try-spe­cific ser­vices that are not in the com­par­i­son above. Worth know­ing about, but check their cur­rent sta­tus and poli­cies be­fore re­ly­ing on them. The European en­tries are cat­a­logued by European Alternatives. Resolvers based in heav­ily cen­sored or sanc­tioned re­gions may en­force lo­cal con­tent rules or, con­versely, ex­ist mainly to by­pass geo-blocks, so treat those with ex­tra care.

DNS4all (194.0.5.3): European re­solver fo­cused on neu­tral­ity and per­for­mance; un­fil­tered.

BlahDNS: open-source hobby ad-block­ing pro­ject with DoH, DoT, and DoQ, run on small re­gional servers.

LibreDNS: com­mu­nity re­solver by LibreOps with ad-block­ing and a no-log­ging pol­icy; DoH and DoT.

Dismail.de: pri­vacy-fo­cused German com­mu­nity re­solver with no log­ging; DoH and DoT.

Foundation for Applied Privacy (Austria): non-profit, no-log­ging; DoH and DoT.

Freifunk München (FFMUC) (Germany): com­mu­nity non-profit, open source; plain­text plus DoH and DoT.

Restena (Luxembourg): the Restena Foundation na­tional re­search net­work; DoH and DoT.

Digitale Gesellschaft (Switzerland): non-profit with DNSSEC, DoH and DoT (German-language site).

dns­forge (Germany): com­mu­nity re­solver that fil­ters ads, track­ing, and mal­ware; open source.

Digitalcourage and Artikel10 (Germany): pri­vacy-fo­cused non-profit re­solvers with DoH and DoT (German-language sites).

FDN (France): long-run­ning as­so­cia­tive ISP with a no-log­ging, no-cen­sor­ship open re­solver.

IIJ Public DNS (Japan): pub­lic DoH and DoT re­solver from Internet Initiative Japan, a ma­jor op­er­a­tor.

CNNIC sDNS (China): the Chinese reg­istry’s pub­lic re­solver (the well-known 1.2.4.8); sub­ject to lo­cal reg­u­la­tions.

Comss.one DNS (Russia): ad-block­ing re­solver pop­u­lar in the Russian-speaking com­mu­nity.

Shecan, Electro, Begzar, and 403.online (Iran): widely used in­side Iran mainly to reach de­vel­oper and cloud ser­vices that block Iranian IP ad­dresses; spe­cial-pur­pose, with lim­ited pub­lished pol­icy.

Legacy or dis­con­tin­ued ser­vices to avoid: Oracle Dyn, Level3 (4.2.2.x), Freenom World, dns0.eu (use DNS4EU or NextDNS in­stead), and Norton ConnectSafe ap­pear in older lists but are legacy, un­of­fi­cial, or dis­con­tin­ued.