3 ms·

Still no explanation on why dns-over-https rather than the already widespread dnscrypt or the lesser known dnscurve, dns-over-quic, and dns-over-tor.

hannob 8y ago
DoH has already more adoption than all previous approaches combined. (Note: I don't think DNS-over-QUIC is really any different from DoH. QUIC is just another way of transmitting HTTPS, so you can just do DoH over QUIC.)
- AnaniasAnanas 8y ago
  > DoH has already more adoption than all previous approaches combined Are you sure? My experience so far has shown that only dnscrypt is widely supported. Nevertheless, surely they must had some kind of issue with the existing solutions when they started working on it. As for DNS over QUIC, I was under the impression that said solution did not make use of HTTP.
  - judge2020 8y ago
    > As for DNS over QUIC, I was under the impression that said solution did not make use of HTTP. I believe it's possible to do both direct DNS over QUIC and ((DNS over HTTPS) over QUIC).
  - darkhorn 8y ago
    Android 9 has build in DoH support. https://android-developers.googleblog.com/2018/04/dns-over-tls-support-in-android-p.html?m=1 https://android-developers.googleblog.com/2018/04/dns-over-t...
pas 8y ago
DNScrypt is easy to block, therefore it can't further the privacy-for-all cause.
- AnaniasAnanas 8y ago
  This is certainly a valid argument, though two of the other solutions (plus dns over tls) avoid this issue as well.
  - moosingin3space 8y ago
    How does DoT avoid this issue? IIRC, DoT runs over port 853, which is trivial to block.
    - AnaniasAnanas 8y ago
      I am pretty sure that the client can use a bridge to connect.
      - pas 8y ago
        And that's DoH. A DoT-over-HTTPS proxy if you will. And for HTTP/1.1 it should use WebSocket for a persistent connection, but probably it already targeted HTTP/2.
danyork 8y ago
DNSCrypt and other solutions typically involve changes to the DNS resolver in the underlying operating system. That's a lot harder to get changed and deployment can take a long time. DOH can be implemented directly inside of the web browser application, since those browsers are obviously already doing everything over HTTPS. So the browser developers just have to build in a DNS client. From their perspective, I would see that being much simpler. And deployment is as easy as the next browser application update.
- jedisct1 8y ago
  Yandex has been shipping support for DNSCrypt in their web browser since 2016.
  - deleted 8y ago
    [deleted]
stock_toaster 8y ago
Because DoH is really all about serving ads, no matter what.

hannob 8y ago

DoH has already more adoption than all previous approaches combined. (Note: I don't think DNS-over-QUIC is really any different from DoH. QUIC is just another way of transmitting HTTPS, so you can just do DoH over QUIC.)

AnaniasAnanas 8y ago
> DoH has already more adoption than all previous approaches combined Are you sure? My experience so far has shown that only dnscrypt is widely supported. Nevertheless, surely they must had some kind of issue with the existing solutions when they started working on it. As for DNS over QUIC, I was under the impression that said solution did not make use of HTTP.
- judge2020 8y ago
  > As for DNS over QUIC, I was under the impression that said solution did not make use of HTTP. I believe it's possible to do both direct DNS over QUIC and ((DNS over HTTPS) over QUIC).
- darkhorn 8y ago
  Android 9 has build in DoH support. https://android-developers.googleblog.com/2018/04/dns-over-tls-support-in-android-p.html?m=1 https://android-developers.googleblog.com/2018/04/dns-over-t...

pas 8y ago

DNScrypt is easy to block, therefore it can't further the privacy-for-all cause.

AnaniasAnanas 8y ago
This is certainly a valid argument, though two of the other solutions (plus dns over tls) avoid this issue as well.
- moosingin3space 8y ago
  How does DoT avoid this issue? IIRC, DoT runs over port 853, which is trivial to block.
  - AnaniasAnanas 8y ago
    I am pretty sure that the client can use a bridge to connect.
    - pas 8y ago
      And that's DoH. A DoT-over-HTTPS proxy if you will. And for HTTP/1.1 it should use WebSocket for a persistent connection, but probably it already targeted HTTP/2.

danyork 8y ago

DNSCrypt and other solutions typically involve changes to the DNS resolver in the underlying operating system. That's a lot harder to get changed and deployment can take a long time. DOH can be implemented directly inside of the web browser application, since those browsers are obviously already doing everything over HTTPS. So the browser developers just have to build in a DNS client. From their perspective, I would see that being much simpler. And deployment is as easy as the next browser application update.

jedisct1 8y ago
Yandex has been shipping support for DNSCrypt in their web browser since 2016.
- deleted 8y ago
  [deleted]

stock_toaster 8y ago

Because DoH is really all about serving ads, no matter what.