24 ms·

That's what browser manufacturers want to do, but that only works in the consumer space or small office space. A company isn't going to happy about a browser t

That's what browser manufacturers want to do, but that only works in the consumer space or small office space. A company isn't going to happy about a browser that by default will self-configure the intranet to be inaccessible. Especially given the way that updates tend to reset settings when the developers think that their preferred configuration is the only right configuration. And sure, they can probably deploy fixed settings that cover their needs, but what happens when you suddenly need multiple profiles with different configurations to handle the different DNS needs at different sites? "It's always DNS," is even a common saying for sysadmins. Now it's going to get more complicated because web browsers will ignore DHCP? Wow, great. Simply put, I still don't buy the idea that the browser needs a DNS client. The OS network stack can, and should, be the provider of that service. This is just, "We know what's best for everybody. It's easier to ignore router vendors, DNS server vendors, ISPs, IEEE standards, and so on if we just do it ourselves in spite of the problems it's sure to cause. That other way is hard, anyways. Damn the consequences, we're going to do it anyways!"

kiriakasis 8y ago
> browser that by default will self-configure the intranet to be inaccessible. Maybe I am not up to date, but Mozzilla has always been explicit that it would not be activated by default (and that one way of activating it would have the system DNS as fallback) > The OS network stack can, and should, be the provider of that service. I understand why it is important not to mess with the underlying network stack, but I would also like not to be redirected to random websites when on a public wifi (even if sometimes blocking data intensive domains like youtube is a good thing). I feel that the original mozzilla blog had a pretty good explanation of the advantages.
zzzcpan 8y ago
Google or Mozilla picking DoH server for you is somehow good for privacy, instead of using one configured by you and outside of their control. Sounds ridiculous, doesn't it? If not a deliberate attempt to make it harder for users to get any privacy by tracking them across changing ISPs and VPNs.
- Spivak 8y ago
  And you think you'll have better privacy sending queries to whatever server DHCP hands out? If you're configuring your own DNS server you're waaaay out of scope for the problems this is trying to address.
  - zzzcpan 8y ago
    > And you think you'll have better privacy sending queries to whatever server DHCP hands out? Yes, because you have to trust one less third party if you use whatever internet connection DHCP provides you. ISPs can see IP addresses you connect to anyway and can figure out what domains and services they belong to. If you don't trust that DHCP, you have to use at least a trustworthy VPN to have some privacy improvement, DoH to a third party will only make it worse.
  - LinuxBender 8y ago
    At work, yes. DoH will leak corporate internal DNS and lead to the public resolvers getting null routed. At home, I block all the public resolvers on my router and intercept DNS, tunnel it through a vpn mesh. For most people at public open WiFi spots, DoH could certainly help.
  - josteink 8y ago
    > And you think you'll have better privacy sending queries to whatever server DHCP hands out? Yes. Because that's my network, my DHCP and something I have 100% control over. There's literally nothing in the universe which better protects my privacy.
    - da_chicken 8y ago
      I think the criticism there is guest WiFi, but you can always configure your system to use a specific DNS server if you wish.
- xg15 8y ago
  To be honest, I find the privacy thing is a red herring here. Yes, your browsing habits can be tracked, but there are already dozens easier ways to do that. What I see as more concerning is that this could hugely shift how the whole system of domains runs. In the worst case, if a single (or a small group of) DoH services turn out to be dominating, they will effectively have full control over all domains - even local ones. If you want to make a domain inaccessible, no need to bother with the registrar, simply stop serving it. Want to add a new top-level domain without handing the IANA billions of dollars? No problem, just start to serve it tomorrow - "technically", it won't be a valid domain, but who cares if all browsers resolve it? Think another domain is rightfully yours? You can file a dispute with the registrar and "proactively" redirect it to your own servers while the dispute is processed.
peterwwillis 8y ago
Eh.... I agree that this is just "Google doing Google", but also, browsers have such intense requirements on DNS that they may want to do things the OS resolver can't. And you can't just tell arbitrary applications "Don't use the host resolver, use this other resolver", they'd literally need different calls, or you would need to overload the calls with LD_PRELOAD to a different library, etc. It would be pretty messy. Until there's a more interoperable, transparent way to replace a DNS client, shipping your own for you own weird edge cases seems fine. And anyway, you can disable it. Here's the old thread by a Chrome dev on why they wanted their own resolver: https://plus.google.com/+WilliamChanPanda/posts/FKot8mghkok https://plus.google.com/+WilliamChanPanda/posts/FKot8mghkok
- josteink 8y ago
  > I agree that this is just "Google doing Google", but also, browsers have such intense requirements on DNS that they may want to do things the OS resolver can't. That sounds like a bullshit argument right there. Name on example, and then help me understand why it should be fixed again and again in every browser instead of once in core DNS.
- da_chicken 8y ago
  > browsers have such intense requirements on DNS that they may want to do things the OS resolver can't. I don't really agree. If the host's DNS client is using a good caching algorithm, then it should have a cache hit rate in the 80s or 90s if your hostnames are remotely sensible. Most people go to the same sites over and over, and those sites typically feature content from the same networks. In that case, over 80% of the DNS traffic isn't actually network traffic. It's just querying the host's cache database. Furthermore, the browser knows every link the user has access to on a page or bookmark. They can be (and probably already are) pre-fetching DNS for those sites. In that case, they need to work with OS vendors to optimize that. OS vendors should clearly wish to do this; nearly every user wants a faster Internet experience, and if Google's dev is right that a DNS query is a significant bottleneck, then they should be interested in improving that aspect of the system. It sounds to me like what they want DNS to do is return not just the IP of the actual address, but all the domain names and IPs of all known resources at that domain name. Of course, if you've got a CDN or other system, that makes DNS suddenly very complicated compared to the current system. No, the more I think about this the more it feels like a way to move the Internet away from open DNS towards some siloed proprietary system where the core databases that control who is on the Internet name system suddenly aren't under IANA control.

kiriakasis 8y ago

> browser that by default will self-configure the intranet to be inaccessible. Maybe I am not up to date, but Mozzilla has always been explicit that it would not be activated by default (and that one way of activating it would have the system DNS as fallback) > The OS network stack can, and should, be the provider of that service. I understand why it is important not to mess with the underlying network stack, but I would also like not to be redirected to random websites when on a public wifi (even if sometimes blocking data intensive domains like youtube is a good thing). I feel that the original mozzilla blog had a pretty good explanation of the advantages.

zzzcpan 8y ago

Google or Mozilla picking DoH server for you is somehow good for privacy, instead of using one configured by you and outside of their control. Sounds ridiculous, doesn't it? If not a deliberate attempt to make it harder for users to get any privacy by tracking them across changing ISPs and VPNs.

Spivak 8y ago
And you think you'll have better privacy sending queries to whatever server DHCP hands out? If you're configuring your own DNS server you're waaaay out of scope for the problems this is trying to address.
- zzzcpan 8y ago
  > And you think you'll have better privacy sending queries to whatever server DHCP hands out? Yes, because you have to trust one less third party if you use whatever internet connection DHCP provides you. ISPs can see IP addresses you connect to anyway and can figure out what domains and services they belong to. If you don't trust that DHCP, you have to use at least a trustworthy VPN to have some privacy improvement, DoH to a third party will only make it worse.
- LinuxBender 8y ago
  At work, yes. DoH will leak corporate internal DNS and lead to the public resolvers getting null routed. At home, I block all the public resolvers on my router and intercept DNS, tunnel it through a vpn mesh. For most people at public open WiFi spots, DoH could certainly help.
- josteink 8y ago
  > And you think you'll have better privacy sending queries to whatever server DHCP hands out? Yes. Because that's my network, my DHCP and something I have 100% control over. There's literally nothing in the universe which better protects my privacy.
  - da_chicken 8y ago
    I think the criticism there is guest WiFi, but you can always configure your system to use a specific DNS server if you wish.
xg15 8y ago
To be honest, I find the privacy thing is a red herring here. Yes, your browsing habits can be tracked, but there are already dozens easier ways to do that. What I see as more concerning is that this could hugely shift how the whole system of domains runs. In the worst case, if a single (or a small group of) DoH services turn out to be dominating, they will effectively have full control over all domains - even local ones. If you want to make a domain inaccessible, no need to bother with the registrar, simply stop serving it. Want to add a new top-level domain without handing the IANA billions of dollars? No problem, just start to serve it tomorrow - "technically", it won't be a valid domain, but who cares if all browsers resolve it? Think another domain is rightfully yours? You can file a dispute with the registrar and "proactively" redirect it to your own servers while the dispute is processed.

peterwwillis 8y ago

Eh.... I agree that this is just "Google doing Google", but also, browsers have such intense requirements on DNS that they may want to do things the OS resolver can't. And you can't just tell arbitrary applications "Don't use the host resolver, use this other resolver", they'd literally need different calls, or you would need to overload the calls with LD_PRELOAD to a different library, etc. It would be pretty messy. Until there's a more interoperable, transparent way to replace a DNS client, shipping your own for you own weird edge cases seems fine. And anyway, you can disable it. Here's the old thread by a Chrome dev on why they wanted their own resolver: https://plus.google.com/+WilliamChanPanda/posts/FKot8mghkok https://plus.google.com/+WilliamChanPanda/posts/FKot8mghkok

josteink 8y ago
> I agree that this is just "Google doing Google", but also, browsers have such intense requirements on DNS that they may want to do things the OS resolver can't. That sounds like a bullshit argument right there. Name on example, and then help me understand why it should be fixed again and again in every browser instead of once in core DNS.
da_chicken 8y ago
> browsers have such intense requirements on DNS that they may want to do things the OS resolver can't. I don't really agree. If the host's DNS client is using a good caching algorithm, then it should have a cache hit rate in the 80s or 90s if your hostnames are remotely sensible. Most people go to the same sites over and over, and those sites typically feature content from the same networks. In that case, over 80% of the DNS traffic isn't actually network traffic. It's just querying the host's cache database. Furthermore, the browser knows every link the user has access to on a page or bookmark. They can be (and probably already are) pre-fetching DNS for those sites. In that case, they need to work with OS vendors to optimize that. OS vendors should clearly wish to do this; nearly every user wants a faster Internet experience, and if Google's dev is right that a DNS query is a significant bottleneck, then they should be interested in improving that aspect of the system. It sounds to me like what they want DNS to do is return not just the IP of the actual address, but all the domain names and IPs of all known resources at that domain name. Of course, if you've got a CDN or other system, that makes DNS suddenly very complicated compared to the current system. No, the more I think about this the more it feels like a way to move the Internet away from open DNS towards some siloed proprietary system where the core databases that control who is on the Internet name system suddenly aren't under IANA control.