3 ms·
Alright, but the reason for the complaint about centralization you're dismissing is that most people are encountering DoH via Firefox's plan to default resolve
by juped 7y ago
Alright, but the reason for the complaint about centralization you're dismissing is that most people are encountering DoH via Firefox's plan to default resolve via DoH to Cloudflare, rather than in the context of being deft Unix hands searching for a way to tunnel their DNS out of an untrustworthy network.
- tptacek 7y agoI do not think a feature that delegates DNS to Cloud Flare is an unalloyed good. I think the protocol is. The distinction is important.
- denton-scratch 7y agoOh. Well, I lean to the view that X-over-HTTP is often a bad model; partly because HTTP has been heavily-commercialized. I can see that there are problems with DNS; there always have been, and it's always been obvious. But for now, I think I prefer running my own resolver. Unbound is really easy to set up.
- tptacek 7y agoI'm not seeing how unbound solves the problem of your network provider spying on and recording all your DNS lookups.
- juped 7y agoUnbound does support DoT.
- tptacek 7y agoSure, but you're not speaking DoT to the authority servers. DoH and DoT aren't magic security dust; they're just a means of tunneling requests from an untrusted network to a more trusted network. If you run your own recursive resolver locally, DoT is mostly theater.