3 ms·
>you can run your own DoH resolver server How does this work in your mind?
by juped 7y ago
>you can run your own DoH resolver server
How does this work in your mind?
- tptacek 7y agoI don't understand your question. The first Google SERP will give you a multiplicity of tutorials on setting up a DoH server.
- juped 7y agoAt the point when I would be "run[ning] my own DoH resolver", I'm already at the point of setting up my own resolver. Why wouldn't I just turn on unbound and call it a day?
- tptacek 7y agoThe point of running your own DoH resolver is that you're doing it somewhere off-network, to tunnel DNS out of an ISP network you don't trust to somewhere else you trust more. You can also just not run DoH if you trust your network. I'm saying DoH is a good thing, not that everyone has to use it.
- juped 7y agoAlright, but the reason for the complaint about centralization you're dismissing is that most people are encountering DoH via Firefox's plan to default resolve via DoH to Cloudflare, rather than in the context of being deft Unix hands searching for a way to tunnel their DNS out of an untrustworthy network.
- tptacek 7y agoI do not think a feature that delegates DNS to Cloud Flare is an unalloyed good. I think the protocol is. The distinction is important.
- denton-scratch 7y agoOh. Well, I lean to the view that X-over-HTTP is often a bad model; partly because HTTP has been heavily-commercialized. I can see that there are problems with DNS; there always have been, and it's always been obvious. But for now, I think I prefer running my own resolver. Unbound is really easy to set up.
- tptacek 7y agoI'm not seeing how unbound solves the problem of your network provider spying on and recording all your DNS lookups.
- juped 7y agoUnbound does support DoT.
- tptacek 7y agoSure, but you're not speaking DoT to the authority servers. DoH and DoT aren't magic security dust; they're just a means of tunneling requests from an untrusted network to a more trusted network. If you run your own recursive resolver locally, DoT is mostly theater.
- ectospheno 7y agoYour ISP knows where you go without looking at your DNS. Because after you do the lookup you go there.