5 ms·

DoH should be supported on the OS network stack, if needed. I can’t understand this move. Firefox should retreat from this default.

swiley 7y ago
The problem with this is that the language runtimes now have to have an http client implementation. DNS isn’t super simple but I would argue it’s much simpler than http. DoH is a very good idea and we need the security it provides but I think using http as the protocol is probably a mistake and will prevent it from being widely adopted.
- asveikau 7y ago
  So perhaps the right solution is to run a plaintext DNS server bound to localhost, and it calls out using whatever encrypted protocol deemed necessary, systemwide.
  - mtsr 7y ago
    Exactly. And Mozilla could easily offer this instead and benefit other applications the user has.
- masklinn 7y ago
  You probably don't need a full-fledged general-purpose HTTP implementation to do DOH. However you'd need a pretty complete TLS implementation in the network stack. Which I guess you also need to provide DNS over TLS.
  - ori_b 7y ago
    Yes. I wish we were discussing dnscurve: https://en.m.wikipedia.org/wiki/DNSCurve https://en.m.wikipedia.org/wiki/DNSCurve
    - techntoke 7y ago
      Yes, this really is the correct way to do this. Mozilla adds a lot of complexity when it isn't necessary. I often feel like they are disingenuous.
    - wbl 7y ago
      Dnscurve didn't secure the stub to recursive link but the recursive to authoritative link. Idea was you wouldn't use recursive. The performance impact plus politics were too much so no adoption. Plus some operational problems with name server names.
- easilyconfused 7y ago
  Why? I assumed everyone asking for it to be OS level would mean that the system resolver does DoH while normal clients continue doing regular DNS. Otherwise what would it even mean to be OS-level if all the client applicatios are doing DoH themselves...?
- ori_b 7y ago
  Yes. A DNS client was trivial to implement for Myrddin. 550 lines of code. HTTP2 would be incredibly big in comparison. https://git.eigenstate.org/ori/mc.git/tree/lib/std/resolve+posixy.myr https://git.eigenstate.org/ori/mc.git/tree/lib/std/resolve+p...
  - ori_b 7y ago
    (note, more than half of the code is in reading the hosts file and parsing resolv.conf, so DNS itself is about 200 lines)
osstack 7y ago
Are Linux/Mac/Windows actually working on adding DoH to their network stack? I never heard anything regarding this. And what would be the relationship to DHCP?
- katzeilla 7y ago
  Not sure about Linux/Mac/Windows, but for OpenBSD, you can simply use unbound in base system to enable DoH (EDIT: No, it's not DoH, it's DoT) for everything in your system. https://man.openbsd.org/unbound.conf https://man.openbsd.org/unbound.conf
  - detaro 7y ago
    I don't think unbound supports DoH yet (the manpage you link doesn't mention it either). But AFAIK it does DoT. EDIT: clearly shouldn't have used unexplained acronyms: DoH = DNS over HTTPS, DoT = DNS over TLS (which typically uses port 853)
    - ori_b 7y ago
      Which is better, since it avoids ridiculously complicated web standards like HTTP2 for simple DNS lookups.
      - bureaucrat 7y ago
        It sounds bad, but the fact that it can’t be blocked is important in terms of censorship. DNS over TLS can be easily blocked by blocking port 853. To block DNS over HTTPS you need to block the entire HTTPS traffic.
        ori_b 7y ago
        If that's the concern, you can run a DNS server on port 443. DOH also doesn't help much with censorship: If you look at traffic patterns, you can detect and block DOH servers pretty easily: look for small queries to a constant endpoint that come just before new connections.
bigbaguette 7y ago
Some argue that it's better than nothing, seeing the lack of progress on this matter at the OS level

swiley 7y ago

The problem with this is that the language runtimes now have to have an http client implementation. DNS isn’t super simple but I would argue it’s much simpler than http. DoH is a very good idea and we need the security it provides but I think using http as the protocol is probably a mistake and will prevent it from being widely adopted.

asveikau 7y ago
So perhaps the right solution is to run a plaintext DNS server bound to localhost, and it calls out using whatever encrypted protocol deemed necessary, systemwide.
- mtsr 7y ago
  Exactly. And Mozilla could easily offer this instead and benefit other applications the user has.
masklinn 7y ago
You probably don't need a full-fledged general-purpose HTTP implementation to do DOH. However you'd need a pretty complete TLS implementation in the network stack. Which I guess you also need to provide DNS over TLS.
- ori_b 7y ago
  Yes. I wish we were discussing dnscurve: https://en.m.wikipedia.org/wiki/DNSCurve https://en.m.wikipedia.org/wiki/DNSCurve
  - techntoke 7y ago
    Yes, this really is the correct way to do this. Mozilla adds a lot of complexity when it isn't necessary. I often feel like they are disingenuous.
  - wbl 7y ago
    Dnscurve didn't secure the stub to recursive link but the recursive to authoritative link. Idea was you wouldn't use recursive. The performance impact plus politics were too much so no adoption. Plus some operational problems with name server names.
easilyconfused 7y ago
Why? I assumed everyone asking for it to be OS level would mean that the system resolver does DoH while normal clients continue doing regular DNS. Otherwise what would it even mean to be OS-level if all the client applicatios are doing DoH themselves...?
ori_b 7y ago
Yes. A DNS client was trivial to implement for Myrddin. 550 lines of code. HTTP2 would be incredibly big in comparison. https://git.eigenstate.org/ori/mc.git/tree/lib/std/resolve+posixy.myr https://git.eigenstate.org/ori/mc.git/tree/lib/std/resolve+p...
- ori_b 7y ago
  (note, more than half of the code is in reading the hosts file and parsing resolv.conf, so DNS itself is about 200 lines)

osstack 7y ago

Are Linux/Mac/Windows actually working on adding DoH to their network stack? I never heard anything regarding this. And what would be the relationship to DHCP?

katzeilla 7y ago
Not sure about Linux/Mac/Windows, but for OpenBSD, you can simply use unbound in base system to enable DoH (EDIT: No, it's not DoH, it's DoT) for everything in your system. https://man.openbsd.org/unbound.conf https://man.openbsd.org/unbound.conf
- detaro 7y ago
  I don't think unbound supports DoH yet (the manpage you link doesn't mention it either). But AFAIK it does DoT. EDIT: clearly shouldn't have used unexplained acronyms: DoH = DNS over HTTPS, DoT = DNS over TLS (which typically uses port 853)
  - ori_b 7y ago
    Which is better, since it avoids ridiculously complicated web standards like HTTP2 for simple DNS lookups.
    - bureaucrat 7y ago
      It sounds bad, but the fact that it can’t be blocked is important in terms of censorship. DNS over TLS can be easily blocked by blocking port 853. To block DNS over HTTPS you need to block the entire HTTPS traffic.
      - ori_b 7y ago
        If that's the concern, you can run a DNS server on port 443. DOH also doesn't help much with censorship: If you look at traffic patterns, you can detect and block DOH servers pretty easily: look for small queries to a constant endpoint that come just before new connections.

bigbaguette 7y ago

Some argue that it's better than nothing, seeing the lack of progress on this matter at the OS level