3 ms·
Why should legit users need to check whether a packet is to a dns server or not? And blocking https packets with mere confidence is impossible.
by bureaucrat 7y ago
Why should legit users need to check whether a packet is to a dns server or not?
And blocking https packets with mere confidence is impossible.
- ori_b 7y agoWell, it's hard to get a DNS response when you aren't talking to a DNS server... So, yeah, I can serve up DOH on my own server with a custom endpoint, custom client configuration, and generate cover traffic. But that's not exactly easy. And http doesn't help: I can do that without http, something like https://github.com/yrutschle/sslh https://github.com/yrutschle/sslh, or using SNI (which, as of TLS 1.3, is encrypted). And merely saying something is impossible doesn't make it so. It doesn't even make it hard.