7 ms·
To add to this issue from a personal level: for those who use a Pihole or operate other internal services from within their own home network will now have to ch
by pwnna 8y ago
To add to this issue from a personal level: for those who use a Pihole or operate other internal services from within their own home network will now have to change the settings for _every application_ using DoH on that network.
This could become a major hassle if the number of devices and owners become large. There's not even a work around for this because I do not directly manage family members' devices (nor would they want me to).
I really like Firefox for they are the only real option these days. I use it and I encourage all those around me to use it. This change will require me to do a lot more manual work and likely lead to confusion over whether a service is down or not.
- deleted 8y ago[deleted]
- nykolasz 8y agoYep. What happens when Chrome adds DoH support? And Safari? And whatever Gaming app the kids download? Suddenly it will become impossible to manage and maintain. Not even talking about the troubleshooting nightmare. DNS should be a system-level setting, not an App-level setting.
- tlrobinson 8y agoHow far off are we from DoH being supported by common operating systems, DHCP, etc? It would be nice if these apps could detect whether the system is using DoH and only fall back to their own DoH resolver in the case they're using "legacy" DNS.
- coldacid 8y agoHonestly, all these apps shouldn't even bother detecting for DoH or not. If people want to use DoH they can set up their own local resolver and configure their network for it (and for folks on Windows, that could even be packaged third-party).
- tlrobinson 8y agoThe reason browsers are interested in including DoH is to protect users who don't even know this is a problem, and definitely aren't going to set up their own resolver.
- josteink 8y ago> How far off are we from DoH being supported by common operating systems, DHCP, etc? To my knowledge none. Nobody is doing this, because it subverts how DNS is supposed to operate. > It would be nice if these apps could detect whether the system is using DoH and only fall back to their own DoH resolver in the case they're using "legacy" DNS. Yeah. Good luck diagnosing that when something stops working as expected.
- tialaramex 8y ago> To my knowledge none. Nobody is doing this, because it subverts how DNS is supposed to operate. Huh? Of course people do this, it's a standard way to do DNS that improves over older DNS wire protocols by offering better security properties. It's unfortunate that we had to involve HTTP in this, but needs must. For example you can drop in an NSS replacement that uses DoH instead of conventional DNS for all your glibc software, or you can get software from a variety of sources that runs on UDP port 53 of your local machine like a normal DNS relay but uses DoH to someone trustworthy to deliver.
- pwnna 8y agoWhat's the point of using DoH over the local network? We can generally assume the local network is "secure". If I want to use DoH when sending DNS queries to the outside world, I can setup my own forwarder to forward DNS queries via DoH.
- tlrobinson 8y agoThat's not always a safe assumption, e.x. public WiFi.
- josteink 8y ago> DNS should be a system-level setting, not an App-level setting. I would go even further: Any app trying to bypass the system-level network settings (like with DoH) should be considered malicious and possibly malware. This is what spam-bots used to do back in the days. Now let’s add Firefox to the list.
- JohnFen 8y ago> Any app trying to bypass the system-level network settings (like with DoH) should be considered malicious and possibly malware. This is my point of view precisely.
- AnaniasAnanas 8y agoOr trying to help the user "jailbreak" out of a restricted environment.
- pretty_bubbles 8y agoHaving a pihole still doesn't prevent applications from using another resolver - for example dig example.com @8.8.8.8 You'd also need to block all other DNS traffic. And even after that, it's tricky, as applications that are not a browser might be doing this with a hardcoded DoH provider.
- foobarbazetc 8y agoThere’s a way to redirect any port 53 traffic back to your pihole if you have enough control over the gateway, but I don’t know if it’s worth doing. Breaks a bunch of things you’d normally do to debug whatever.
- the8472 8y agoinstead of redirecting you can log it so you can identify suspicious apps
- topranks 8y agoBeen doing this a few years, after seeing lots of apps and devices using 8.8.8.8 despite being given my resolver back via DHCP (so obviously hard-coded into them and they’re ignoring os dns.) No practical drawbacks so far, although I have found many “open resolvers” online from my home, only to realize it’s the redirection messing things up.
- stupidthrottle 8y ago> It would be nice if these apps could detect whether the system is using DoH and only fall back to their own DoH resolver in the case they're using "legacy" DNS. In which case these applications are either broken or malware. The application needs to fix that by using DNS supplied by the OS, as everyone should do.
- zaarn 8y agoThere are plenty of reasons to use a different resolve on app vs OS level, not only for malware or "broken" applications. The DNS setting by the OS, just like the proxy settings, is a first suggestion on how to connect. Chrome will contact 8.8.8.8 in certain circumstances and Firefox has DoH. Both can set proxy settings different from system via various means.