FR: An option to select Domain Name for the on-device block list dl server.

[u17194907425]

Currently the server to initialize and update the on-device blocklists is hardcoded in Constants.kt

        // rethink base url (modified from download to dl on v053l)
        const val DOWNLOAD_BASE_URL = "https://dl.rethinkdns.com"

It makes this server a single point of failure. In case e.g. some censorship prevents from accessing this website the functionality is gone. See #2636.
I know there is an initiative to implement import in #293 but it is quite an old one.

What do you think of making this DOWNLOAD_BASE_URL configurable via UI? I hope this should not be a big of a deal but will allow users to at least make and use mirrors for the 4 important files.

[yoshimo]

Why not have the option to download them directly from the source and mirrors instead of bundling them at rethinks own domain?
If you use etags and if modified since headers+ maybe a users personal github api key you save the bandwidth for your own services and still don't hammer the upstream servers and hit their rate limits.
Enabling the use of ECH for download connections would further future proof this.

[ignoramous]

Why not have the option to download them directly from the source and mirrors instead of bundling them at rethinks own domain?

Rethink preprocesses and compresses blocklists into one giant "Patricia Trie". This, among other things, let's Rethink import 18m+ blocklist entries and not have to worry about high RAM & CPU use.

The code for building, searching this "Trie" is shared with our resolvers (on max.rethinkdns.com), too.

Enabling the use of ECH for download connections would further future proof this.

ECH is enabled by Cloudflare (which fronts dl.rethinkdns.com), but it is another matter if the okhttp version the Kotlin-layer uses utilizes it. I haven't checked.

In our network engine (firestack), which is written in Go, ECH has been implemented for outgoing transports using TLS1.3 (like, DNS over HTTPS or DNS over TLS) since Aug 2024 (over 2y ago). When ECH is used for DNS transports, the Homescreen shows "Ultra secure" label beneath the STOP/START button.

What do you think of making this DOWNLOAD_BASE_URL configurable via UI? I hope this should not be a big of a deal but will allow users to at least make and use mirrors for the 4 important files

Do-able, yeah.

[yoshimo]

I think we need lysine-dev/okhttp#9383 merged first