4 ms·
Thanks for all your comments. Below I put quick replies to some of them: 1/ I hope to update the project to use QUIC soon, so it will use encrypted UDP to fetc
by pjf 10y ago
Thanks for all your comments. Below I put quick replies to some of them:
1/ I hope to update the project to use QUIC soon, so it will use encrypted UDP to fetch DNS data from Google Public DNS. It is somehow similar to the DNS over DTLS idea, developed under IETF dprive WG.
2/ dingo does not need to resolve dns.google.com. Providing the server IP address is enough (IPv4 or IPv6, make sure it is close to your location). dingo verifies the server certificate to make sure we talk to Google. It can even "spoof" the TLS SNI string to avoid HTTPS firewalls, too (by default it asks for www.google.com, which is pretty benign).
3/ Last but not least, it's just my first non-trivial Golang project - thanks for all your suggestions! :)
- textmode 10y ago"It can even \"spoof\" the TLS SNI string to avoid HTTPS firewalls..." Are you confirming SNI is being used for censorship?
- clinta 10y agoPlenty of content blockers support blocking domains based on SNI. Here's just a couple of examples from a quick google search. https://wiki.untangle.com/index.php/Web_Filter#HTTPS_Options https://wiki.untangle.com/index.php/Web_Filter#HTTPS_Options http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content/en-us/proxies/https/https_domain_names_c.html http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content...
- NetStrikeForce 10y agoIf someone is doing DPI their best bet to know where are you connecting to is to look at the host in SNI, but if you're in a corporate environment with an explicit proxy, your computer would be sending a "CONNECT hostname.tld" in plain text anyway :)
- nickodell 10y agoIt seems like this includes up to 500 bytes of padding in a request. Is there a reason for that?
- pjf 10y agoYes, the random padding (which is optional) is to counter-measure possible side-channel privacy attacks that could infer the domain name from the packet sizes. The Google documentation explains that (look for "random_padding") at https://developers.google.com/speed/public-dns/docs/dns-over-https https://developers.google.com/speed/public-dns/docs/dns-over...