4 ms·
DoH failed to keep the important part of DNS, which was statelessness. Running a stock or DNSCrypt resolver for 10k QPS requires a small to medium sized box th
by dsl 8y ago
DoH failed to keep the important part of DNS, which was statelessness.
Running a stock or DNSCrypt resolver for 10k QPS requires a small to medium sized box that is within the technical realm of most people to operate. Adding stateful connection tracking now creates an operational burden that most IT folks would say "screw it, send it to the cloud."
This centralizes the DNS in to the hands of a half dozen organizations that can operate at that scale, and they also happen to be the ones driving the policy forward.
- tptacek 8y agoI don't honestly know whether, if I had the choice, I'd take DoHT or DNSCurve. But that's not really my point. No matter how much I might like DNSCurve, it's not going to happen at this point: DoH will be the mainstream secure resolver going forward, because it's firewall-friendly and will have mainstream browser support. With DoH widely deployed, the argument for DNSCurve is cut back drastically. It's a very positive thing, to my mind; it's equally fatal, I think, to the arguments (such as they were) for DNSSEC --- which not only centralized DNS but also TLS security, and handed them to world governments. I also think: 1. No matter what the protocol, centralization of "off-net" DNS services inevitable, for reasons having little to do with performance. 2. People with concerns about Google and Cloud Flare (it me!) can easily run their own off-net resolvers, and people will inevitably start privacy-preserving DoH resolvers that are open to the public. 3. Over time, the performance implications of TLS for DNS lookups will become less and less a factor.