ars_technician

>you aren't really affected negatively by them doing it.

Even if you are fine with your ISP committing fraud, you are negatively effected by the complexity (points of failure) and latency this adds to the network.

Did you even read his comment?

"dig @www.facebook.com news.ycombinator.com" does not use the ISP's DNS servers at all. It sends a DNS query to Facebook for Google, which should normally fail. His ISP hijacks the request and provides a response. In this scenario, the advice in your comment is pointless because they will hijack requests whether they are directly to authoritative servers or if they are to recursive servers.

Why do you keep posting this? It's irrelevant because the idea isn't to hide what site you're visiting, it's to prevent the ISP from modifying the DNS responses. Signing DNS responses would be helpful if that was actually enforced anywhere.

DNSCrypt is a perfectly fine solution for this threat model.

>All you've done is add an additional third party that can view and log what you're doing.

You forgot the part where it's protecting against trashy ISPs like the one in this article.