3 ms·

What this data shows is that concerns about centralization, especially in relation to DoH, are overblown. Only 1.15% of users in this dataset are using Cloudfla

by kijin 7y ago

What this data shows is that concerns about centralization, especially in relation to DoH, are overblown. Only 1.15% of users in this dataset are using Cloudflare DNS, and APNIC is in a region riddled with government censorship and crappy ISPs -- two major incentives for people to try alternative resolvers. Without such incentives, nobody would even bother to change their devices' DNS settings. I'm in a country with both of these problems, so every machine I set up gets Cloudflare as the primary resolver with Google as the secondary. Fix these problems first, and I won't have to do this anymore. Centralization? I dunno. Taking control of DNS away from my state and ISP would actually count as decentralization in my book.

troquerre 7y ago
Agree that shifting control from your state and ISP are beneficial, but centralizing DNS to one or two for-profit providers in the process is less than ideal IMO. I'm working on a project that's aiming to make DNS fully decentralized and wrote an explainer article in case you're interested https://www.namebase.io/blog/meet-handshake-decentralizing-dns-to-improve-the-security-of-the-internet/ https://www.namebase.io/blog/meet-handshake-decentralizing-d... If it's not too revealing, can you share what country you're in?
- kijin 7y ago
  Sure, even more decentralization would be good. Nevertheless, I think the usual concerns about Cloudflare are massively overblown and misses a crucial role that they're playing in the fight against censorship and surveillance. Cloudflare is the first well-known provider that decided to support a working protocol for encrypted DNS. DoH might not be the best possible protocol, but it's shipping now and others are not. (DNSCrypt is also shipping, but it has the weird property of speaking something that isn't HTTPS on port 443. That's too easy to censor.) There will be healthy competition if other people would please stop arguing and start shipping, too. I'm in South Korea. The censorship regime here is more prudish than draconian, and I'm not in any danger of prosecution for criticizing it. The way it is implemented is extremely crappy, though. On top of DNS-based censorship, ISPs are doing DPI on TLS handshakes to sniff hostnames in the SNI extension. Lots of techies here are very interested in new technologies showcased by Cloudflare. That includes not only DoH but also their proposal to use keys stored in DNS to close the SNI loophole. Once again, what works in this situation is not a novel, theoretically perfect protocol but one that ships now and blends into the petabytes of HTTPS traffic that Cloudflare handles every day.

by kijin 7y ago

troquerre 7y ago

Agree that shifting control from your state and ISP are beneficial, but centralizing DNS to one or two for-profit providers in the process is less than ideal IMO. I'm working on a project that's aiming to make DNS fully decentralized and wrote an explainer article in case you're interested https://www.namebase.io/blog/meet-handshake-decentralizing-dns-to-improve-the-security-of-the-internet/ https://www.namebase.io/blog/meet-handshake-decentralizing-d... If it's not too revealing, can you share what country you're in?

kijin 7y ago
Sure, even more decentralization would be good. Nevertheless, I think the usual concerns about Cloudflare are massively overblown and misses a crucial role that they're playing in the fight against censorship and surveillance. Cloudflare is the first well-known provider that decided to support a working protocol for encrypted DNS. DoH might not be the best possible protocol, but it's shipping now and others are not. (DNSCrypt is also shipping, but it has the weird property of speaking something that isn't HTTPS on port 443. That's too easy to censor.) There will be healthy competition if other people would please stop arguing and start shipping, too. I'm in South Korea. The censorship regime here is more prudish than draconian, and I'm not in any danger of prosecution for criticizing it. The way it is implemented is extremely crappy, though. On top of DNS-based censorship, ISPs are doing DPI on TLS handshakes to sniff hostnames in the SNI extension. Lots of techies here are very interested in new technologies showcased by Cloudflare. That includes not only DoH but also their proposal to use keys stored in DNS to close the SNI loophole. Once again, what works in this situation is not a novel, theoretically perfect protocol but one that ships now and blends into the petabytes of HTTPS traffic that Cloudflare handles every day.