5 ms·

Is there a particular reason a DNS resolver should be implemented in a web browser? Wouldn't it be better if it was a system-wide configuration?

by gkya 8y ago

joelthelion 8y ago
It's been 30 years and DNS is still a major security and confidentiality flaw in all widely used OSes. I welcome my browser doing something about it. If in the future OSes and ISPs provide better alternatives, this feature can always be turned off.
- gsich 8y ago
  It is default off.
  - Operyl 8y ago
    For now. In the future it won’t be from what I understand.
- gkya 8y ago
  I do want to use this on all my devices, not that I'm criticising the DoH concept per se. Only that it seems to me that the browser is not the correct place for the DNS resolver; thus I wonder why it's not the OS but the browser that gets the new features.
  - effie 8y ago
    One reason could be that large number of users of web have no real power to set up their operating system to use their preferred DNS server (e.g. non-technical employees in many big corps). The present-day OSes are designed to favor the administrator and to restrict the users.
    - jlgaddis 8y ago
      > (e.g. non-technical employees in many big corps) IMO, employees should be using whatever their organization has configured for them -- not whatever they wish. A "regular user" changing the DNS servers on his work PC (joined to an Active Directory domain) to 8.8.8.8, for example, WILL run into problems at some point. They say they have workarounds for this but I think it's safe to say that bugs will likely be found. In the meantime, things will be broken for those users. Moving this setting into the web browser (where it likely CAN be changed by a user) is not the proper solution.
- xorcist 8y ago
  > I welcome my browser doing something about it. Can we please go easy on the newspeak? Centralizing resolving to a handful of actors will not improve privacy for the most part of end users.
  - kannanvijayan 8y ago
    Resolving is already centralized: your ISP has 100% control over what you resolve, and you can't do anything about it. This is doing the opposite - by securely implementing resolution in a user agent, in a tamper-proof way, under the control of the user.
    - xorcist 8y ago
      Every user is free to run their own resolver or use any of their ISPs or third parties, which is pretty close to the definition of something decentralized.
      - dreae 8y ago
        Except, as others have pointed out, there are documented cases of ISPs hijacking DNS traffic, even for people who have configured their client to use resolvers other than their ISP, which is possible because of DNS's lack of authentication or encryption. Besides, I don't see how adding an option for DoH to Firefox is centralizing anything, you're free to set the DoH URL to whatever you like, and you're free to run your own DoH resolver, just like you're free to run your own vanilla DNS resolver.
        jlgaddis 8y ago
        > Besides, I don't see how adding an option for DoH to Firefox is centralizing anything ... AUIU, this is currently disabled by default but will be enabled by default in the future. When that switch is flipped, that's when the "centralizing" begins. If this were to be disabled by default and forever remain that way, I would be perfectly fine with it.

Is there a particular reason a DNS resolver should be implemented in a web browser? Wouldn't it be better if it was a system-wide configuration?

by gkya 8y ago

Is there a particular reason a DNS resolver should be implemented in a web browser? Wouldn't it be better if it was a system-wide configuration?

joelthelion 8y ago

It's been 30 years and DNS is still a major security and confidentiality flaw in all widely used OSes. I welcome my browser doing something about it. If in the future OSes and ISPs provide better alternatives, this feature can always be turned off.

gsich 8y ago
It is default off.
- Operyl 8y ago
  For now. In the future it won’t be from what I understand.
gkya 8y ago
I do want to use this on all my devices, not that I'm criticising the DoH concept per se. Only that it seems to me that the browser is not the correct place for the DNS resolver; thus I wonder why it's not the OS but the browser that gets the new features.
- effie 8y ago
  One reason could be that large number of users of web have no real power to set up their operating system to use their preferred DNS server (e.g. non-technical employees in many big corps). The present-day OSes are designed to favor the administrator and to restrict the users.
  - jlgaddis 8y ago
    > (e.g. non-technical employees in many big corps) IMO, employees should be using whatever their organization has configured for them -- not whatever they wish. A "regular user" changing the DNS servers on his work PC (joined to an Active Directory domain) to 8.8.8.8, for example, WILL run into problems at some point. They say they have workarounds for this but I think it's safe to say that bugs will likely be found. In the meantime, things will be broken for those users. Moving this setting into the web browser (where it likely CAN be changed by a user) is not the proper solution.
xorcist 8y ago
> I welcome my browser doing something about it. Can we please go easy on the newspeak? Centralizing resolving to a handful of actors will not improve privacy for the most part of end users.
- kannanvijayan 8y ago
  Resolving is already centralized: your ISP has 100% control over what you resolve, and you can't do anything about it. This is doing the opposite - by securely implementing resolution in a user agent, in a tamper-proof way, under the control of the user.
  - xorcist 8y ago
    Every user is free to run their own resolver or use any of their ISPs or third parties, which is pretty close to the definition of something decentralized.
    - dreae 8y ago
      Except, as others have pointed out, there are documented cases of ISPs hijacking DNS traffic, even for people who have configured their client to use resolvers other than their ISP, which is possible because of DNS's lack of authentication or encryption. Besides, I don't see how adding an option for DoH to Firefox is centralizing anything, you're free to set the DoH URL to whatever you like, and you're free to run your own DoH resolver, just like you're free to run your own vanilla DNS resolver.
      - jlgaddis 8y ago
        > Besides, I don't see how adding an option for DoH to Firefox is centralizing anything ... AUIU, this is currently disabled by default but will be enabled by default in the future. When that switch is flipped, that's when the "centralizing" begins. If this were to be disabled by default and forever remain that way, I would be perfectly fine with it.