5 ms·
The problem with this is that the language runtimes now have to have an http client implementation. DNS isn’t super simple but I would argue it’s much simpler t
by swiley 7y ago
The problem with this is that the language runtimes now have to have an http client implementation. DNS isn’t super simple but I would argue it’s much simpler than http. DoH is a very good idea and we need the security it provides but I think using http as the protocol is probably a mistake and will prevent it from being widely adopted.
- asveikau 7y agoSo perhaps the right solution is to run a plaintext DNS server bound to localhost, and it calls out using whatever encrypted protocol deemed necessary, systemwide.
- mtsr 7y agoExactly. And Mozilla could easily offer this instead and benefit other applications the user has.
- masklinn 7y agoYou probably don't need a full-fledged general-purpose HTTP implementation to do DOH. However you'd need a pretty complete TLS implementation in the network stack. Which I guess you also need to provide DNS over TLS.
- ori_b 7y agoYes. I wish we were discussing dnscurve: https://en.m.wikipedia.org/wiki/DNSCurve https://en.m.wikipedia.org/wiki/DNSCurve
- techntoke 7y agoYes, this really is the correct way to do this. Mozilla adds a lot of complexity when it isn't necessary. I often feel like they are disingenuous.
- wbl 7y agoDnscurve didn't secure the stub to recursive link but the recursive to authoritative link. Idea was you wouldn't use recursive. The performance impact plus politics were too much so no adoption. Plus some operational problems with name server names.
- easilyconfused 7y agoWhy? I assumed everyone asking for it to be OS level would mean that the system resolver does DoH while normal clients continue doing regular DNS. Otherwise what would it even mean to be OS-level if all the client applicatios are doing DoH themselves...?
- ori_b 7y agoYes. A DNS client was trivial to implement for Myrddin. 550 lines of code. HTTP2 would be incredibly big in comparison. https://git.eigenstate.org/ori/mc.git/tree/lib/std/resolve+posixy.myr https://git.eigenstate.org/ori/mc.git/tree/lib/std/resolve+p...
- ori_b 7y ago(note, more than half of the code is in reading the hosts file and parsing resolv.conf, so DNS itself is about 200 lines)