2 ms·
I'm disappointed by this situation where we have to shove encryption in at the application layer one application at a time because we couldn't get our act toget
by js2 8y ago
I'm disappointed by this situation where we have to shove encryption in at the application layer one application at a time because we couldn't get our act together with ipsec. I understand how it's come to be, but from an engineering perspective, it's absurd to move dns into https.
Oh well, this is the nature of evolution, like the recurrent laryngeal nerve in a giraff.
- mbrumlow 8y agoI am not sure you need to do it at the application layer. All you need is a local caching resolver that your apps query over local host using standard methods. Then the local service can do all the fancy you want. Today, I have this setup for work. I don't like them spying on me while at work. So I have setup a local resolver that forwards some request to the companies resolver, and others over a secure line to a set of public resolver. I did not need to change any software.
- js2 8y agoMy use of "application" is ambiguous. I was referring to the fact that DoH moves DNS from on top of udp/tcp to on top of https, itself on top of tcp, primarily to benefit from the 's' in https. I actually also run a DoH proxy on my home router and point dnsmasq (also on the router) at it, so all my home network DNS goes out over https.