4 ms·

I've said this before and I'll say it again. If you don't like the fact that DoH is centralized in the hands of Cloudflare, all you have to do is offer a compet

by kijin 7y ago

I've said this before and I'll say it again. If you don't like the fact that DoH is centralized in the hands of Cloudflare, all you have to do is offer a competing service. Especially if you're a DNS company in the first place. It's your domain of expertise. Build something. Ship it. Once there are a number of alternatives, Mozilla et al. will have no reason to insist on using a single provider. Right now, for a lot of people in a lot of countries, a choice to use any resolver that isn't controlled by their ISP/government is a step in the right direction. So please stop trying to drag down other people who are doing their best to make progress. If you don't like the direction that they're headed, build an alternative, write an RFC, or do whatever you can to show us how you think it should be done instead. Show us the code or GTFO.

trisiak 7y ago
The main point of the article is not that CF is evil and is now getting all your DNS data; it is that CloudFlare gets that data AND none of those that had access to it already are going to lose it after you migrate to DoH.
- briffle 7y ago
  That is not true. Several middlemen are now going to not be able to see your data. Most people that used public resolvers were sending plain text UDP queries over their ISP. This could be redirected, hijacked, etc. If you had a connection that wanted you to use their filtering software, they could/would block outgoing port 53. That is not possible with DoH, they can no longer see what domain you are querying. They may be able to block 1.1.1.1, but as more places get DoH, it will be harder to block using other DNS providers.
Spivak 7y ago
That’s not really the issue. The hard problem isn’t making a bunch of DoH competitors but getting OS level support so that browsers can drop their own logic. An app running on the system needs to be able ask the OS for an encrypted DNS lookup or where it should perform such a lookup and get be able to decide what to do when it can’t. The UI needs to be there to accept DoT or DoH networks from DHCP on trusted network profiles but the a user-chosen default on untrusted networks.
- kijin 7y ago
  It is well known that OS vendors move slowly. How long will it take for all major OSes to standardize on an encrypted DNS protocol? I'm pretty sure it won't happen before 2030. Should application vendors simply do nothing until then, even when they can do something now? Should programmers always wait for the perfect solution to come along and only then ship the definitive version? What happened to building what we can now and incrementally improving over time? There isn't even a consensus on how best to implement encrypted DNS. How do we decide which proposal to standardize on if we're so reluctant to test them in the wild? Without successes and failures to learn from, there is even less chance that OS vendors will deviate from the status quo.
  - Spivak 7y ago
    Absolutely not! I'm firmly in the camp that browsers should do this until OS support arrives. However, the "centralization problem" isn't solved by more competitors existing because widely deployed applications will still have to choose a single option for all but a tiny segment of users that will change it. If the default comes from the OS vendor then we're in a slightly better place since the default for macOS and iOS will be Apple's servers, Windows will be MS, Android will be Amazon or Google. Competition in this space comes from the people who decide what DNS service to use, not the people standing up the service.
    - kijin 7y ago
      I dunno, I would much rather retain the ability to download a new browser that promises improved privacy (i.e. by integrating with their own DNS service that includes pi-hole) than be limited to one of four well-known American OS vendors. Alternatively, I see no reason why someone can't write a small application that runs a resolver on localhost, adjusts your hosts file accordingly, and forwards queries to any third party or distributed network of your choice. Wait a sec, I already have dnsmasq and/or systemd-resolved doing this on some of my machines. It can be done right now with no need to wait for the OS vendor to change things.
      - 7y ago
briffle 7y ago
Nextdns.io was featured on here a few weeks ago. They offer DNS over HTTPS (and they also list DNS over TLS)
pdkl95 7y ago
> If you don't like the fact that DoH is centralized in the hands of Cloudflare, all you have to do is offer a competing service. You seem to be presuming that a single "service" is necessary. "Alternative" centralized services are still a centralized service. The solution to Cloudflare being able to log everything isn't to hand that same power to someone else. I run my own recursive resolver. Only the first request for a domain's NS record goes to a centralized service; every other request goes to the domain specific nameserver. Asking ns.example.com for the A/AAAA record for www.example.com doesn't tell example.com (collectively) much more than they will learn from the HTTPS request that usually follows. Yes, ".com" can log that I asked for the authoritative nameserver for "example.com", but this is usually cached. The centralized nameservice doesn't see most of the DNS traffic. Yes, the communication with each domain's authoritative nameserver is often unencrypted. This is unfortunate, and I strongly support an encrypted replacement protocol for all communication with nameservers. Using DoH sends all of the above to one entity... which then likely sends it unencrypted to the authoritative nameservers. The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS. > for a lot of people in a lot of countries, a choice to use any resolver that isn't controlled by their ISP/government is a step in the right direction Providing this as an option for people in those situations is great. That doesn't mean it will be a benefit for everyone. For many people, DoH is a significant loss of privacy. > So please stop trying to drag down other people who are doing their best to make progress. Please stop using this cheap appeal to emotion that presumes one solution will help everyone. > Show us the code or GTFO. We don't need to when the existing DNS situation was already a better option. Please learn about the diverse way that DNS is actually used in practice. Also, please consider the damage that is done by encouraging apps to bypass OS-control of DNS. This takes a lot of control away from the user, and will piss off a lot of people that use DNS-based adblocking.
- mr__y 7y ago
  >The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS. not necesarilly. With HTTPS the ISP will see the IP being connected to, not the domain. Since there can be multiple domains behind a single IP address, the ISP cannot know the exact domain. On the other hand since more and more websites use cloudflare revproxy service, quite often all the ISP will see is one of cloudflare IPs being connected to, whereas Cloudflare will know the exact domain (and URI) your browser is requesting. And Cloudflare will get that information regardless of the way you look up DNS record
deftnerd 7y ago
I would like to see Firefox make the choice of which DoH provider to use as easy as they make changing addressbar search engines. Its easy to change from Google to DuckDuckGo on that preference page. A similar user accessible option to change providers (or disable DoH functionality entirely) would go a long way to soothing the community.

by kijin 7y ago

trisiak 7y ago

The main point of the article is not that CF is evil and is now getting all your DNS data; it is that CloudFlare gets that data AND none of those that had access to it already are going to lose it after you migrate to DoH.

briffle 7y ago
That is not true. Several middlemen are now going to not be able to see your data. Most people that used public resolvers were sending plain text UDP queries over their ISP. This could be redirected, hijacked, etc. If you had a connection that wanted you to use their filtering software, they could/would block outgoing port 53. That is not possible with DoH, they can no longer see what domain you are querying. They may be able to block 1.1.1.1, but as more places get DoH, it will be harder to block using other DNS providers.

Spivak 7y ago

That’s not really the issue. The hard problem isn’t making a bunch of DoH competitors but getting OS level support so that browsers can drop their own logic. An app running on the system needs to be able ask the OS for an encrypted DNS lookup or where it should perform such a lookup and get be able to decide what to do when it can’t. The UI needs to be there to accept DoT or DoH networks from DHCP on trusted network profiles but the a user-chosen default on untrusted networks.

kijin 7y ago
It is well known that OS vendors move slowly. How long will it take for all major OSes to standardize on an encrypted DNS protocol? I'm pretty sure it won't happen before 2030. Should application vendors simply do nothing until then, even when they can do something now? Should programmers always wait for the perfect solution to come along and only then ship the definitive version? What happened to building what we can now and incrementally improving over time? There isn't even a consensus on how best to implement encrypted DNS. How do we decide which proposal to standardize on if we're so reluctant to test them in the wild? Without successes and failures to learn from, there is even less chance that OS vendors will deviate from the status quo.
- Spivak 7y ago
  Absolutely not! I'm firmly in the camp that browsers should do this until OS support arrives. However, the "centralization problem" isn't solved by more competitors existing because widely deployed applications will still have to choose a single option for all but a tiny segment of users that will change it. If the default comes from the OS vendor then we're in a slightly better place since the default for macOS and iOS will be Apple's servers, Windows will be MS, Android will be Amazon or Google. Competition in this space comes from the people who decide what DNS service to use, not the people standing up the service.
  - kijin 7y ago
    I dunno, I would much rather retain the ability to download a new browser that promises improved privacy (i.e. by integrating with their own DNS service that includes pi-hole) than be limited to one of four well-known American OS vendors. Alternatively, I see no reason why someone can't write a small application that runs a resolver on localhost, adjusts your hosts file accordingly, and forwards queries to any third party or distributed network of your choice. Wait a sec, I already have dnsmasq and/or systemd-resolved doing this on some of my machines. It can be done right now with no need to wait for the OS vendor to change things.
    - 7y ago

briffle 7y ago

Nextdns.io was featured on here a few weeks ago. They offer DNS over HTTPS (and they also list DNS over TLS)

pdkl95 7y ago

> If you don't like the fact that DoH is centralized in the hands of Cloudflare, all you have to do is offer a competing service. You seem to be presuming that a single "service" is necessary. "Alternative" centralized services are still a centralized service. The solution to Cloudflare being able to log everything isn't to hand that same power to someone else. I run my own recursive resolver. Only the first request for a domain's NS record goes to a centralized service; every other request goes to the domain specific nameserver. Asking ns.example.com for the A/AAAA record for www.example.com doesn't tell example.com (collectively) much more than they will learn from the HTTPS request that usually follows. Yes, ".com" can log that I asked for the authoritative nameserver for "example.com", but this is usually cached. The centralized nameservice doesn't see most of the DNS traffic. Yes, the communication with each domain's authoritative nameserver is often unencrypted. This is unfortunate, and I strongly support an encrypted replacement protocol for all communication with nameservers. Using DoH sends all of the above to one entity... which then likely sends it unencrypted to the authoritative nameservers. The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS. > for a lot of people in a lot of countries, a choice to use any resolver that isn't controlled by their ISP/government is a step in the right direction Providing this as an option for people in those situations is great. That doesn't mean it will be a benefit for everyone. For many people, DoH is a significant loss of privacy. > So please stop trying to drag down other people who are doing their best to make progress. Please stop using this cheap appeal to emotion that presumes one solution will help everyone. > Show us the code or GTFO. We don't need to when the existing DNS situation was already a better option. Please learn about the diverse way that DNS is actually used in practice. Also, please consider the damage that is done by encouraging apps to bypass OS-control of DNS. This takes a lot of control away from the user, and will piss off a lot of people that use DNS-based adblocking.

mr__y 7y ago
>The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS. not necesarilly. With HTTPS the ISP will see the IP being connected to, not the domain. Since there can be multiple domains behind a single IP address, the ISP cannot know the exact domain. On the other hand since more and more websites use cloudflare revproxy service, quite often all the ISP will see is one of cloudflare IPs being connected to, whereas Cloudflare will know the exact domain (and URI) your browser is requesting. And Cloudflare will get that information regardless of the way you look up DNS record

deftnerd 7y ago

I would like to see Firefox make the choice of which DoH provider to use as easy as they make changing addressbar search engines. Its easy to change from Google to DuckDuckGo on that preference page. A similar user accessible option to change providers (or disable DoH functionality entirely) would go a long way to soothing the community.