3 ms·
1. The connection to the authoritative servers isn't encrypted, so the whole point of DoH is undermined. 2. There's plenty of networks that don't let arbitrary
by hannob 7y ago
1. The connection to the authoritative servers isn't encrypted, so the whole point of DoH is undermined.
2. There's plenty of networks that don't let arbitrary DNS traffic out, so this doesn't work without another fallbacks. Fallbacks for security features are bad.
I see that there are legit controversies around DoH. But these "Why don't you just do X?" comments aren't helpful. Try to understand the problem they're trying to resolve.
- elcomet 7y agoWell I'm asking because I'm trying to understand the drawbacks of a resolving server. Thanks for the explanation !
- EvanAnderson 7y agoI disagree that the OP's comment isn't helpful. Mozilla could have taken a tack that would have increased decentralization and promoted privacy (DNS-over-TLS exists). Instead, they went the way of a centralized protocol that just trades one set of potentially bad actors (ISPs) for another. re: network policy - If you're paying to use a network with policy that you disagree with vote w/ your wallet. If you're using somebody else's network (i.e. a corporate network I'm paid to administer, for example) it's reasonable to accept that you're bound by the owner's policy-- it's their network.
- mtsr 7y agoI’d love to use DoT, but afaik it’s currently mostly only supported by DNS resolvers (Google, CloudFlare and other privacy-exploiting companies) rather than authoritative DNS servers.