4 ms·

> If you don't like the fact that DoH is centralized in the hands of Cloudflare, all you have to do is offer a competing service. You seem to be presuming that

by pdkl95 7y ago

> If you don't like the fact that DoH is centralized in the hands of Cloudflare, all you have to do is offer a competing service. You seem to be presuming that a single "service" is necessary. "Alternative" centralized services are still a centralized service. The solution to Cloudflare being able to log everything isn't to hand that same power to someone else. I run my own recursive resolver. Only the first request for a domain's NS record goes to a centralized service; every other request goes to the domain specific nameserver. Asking ns.example.com for the A/AAAA record for www.example.com doesn't tell example.com (collectively) much more than they will learn from the HTTPS request that usually follows. Yes, ".com" can log that I asked for the authoritative nameserver for "example.com", but this is usually cached. The centralized nameservice doesn't see most of the DNS traffic. Yes, the communication with each domain's authoritative nameserver is often unencrypted. This is unfortunate, and I strongly support an encrypted replacement protocol for all communication with nameservers. Using DoH sends all of the above to one entity... which then likely sends it unencrypted to the authoritative nameservers. The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS. > for a lot of people in a lot of countries, a choice to use any resolver that isn't controlled by their ISP/government is a step in the right direction Providing this as an option for people in those situations is great. That doesn't mean it will be a benefit for everyone. For many people, DoH is a significant loss of privacy. > So please stop trying to drag down other people who are doing their best to make progress. Please stop using this cheap appeal to emotion that presumes one solution will help everyone. > Show us the code or GTFO. We don't need to when the existing DNS situation was already a better option. Please learn about the diverse way that DNS is actually used in practice. Also, please consider the damage that is done by encouraging apps to bypass OS-control of DNS. This takes a lot of control away from the user, and will piss off a lot of people that use DNS-based adblocking.

mr__y 7y ago
>The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS. not necesarilly. With HTTPS the ISP will see the IP being connected to, not the domain. Since there can be multiple domains behind a single IP address, the ISP cannot know the exact domain. On the other hand since more and more websites use cloudflare revproxy service, quite often all the ISP will see is one of cloudflare IPs being connected to, whereas Cloudflare will know the exact domain (and URI) your browser is requesting. And Cloudflare will get that information regardless of the way you look up DNS record
kijin 7y ago
> You seem to be presuming that a single "service" is necessary. A fully distributed alternative can just as well be considered a "service" if it can be plugged into a browser or OS to replace the default resolver. > The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS. Cloudflare is working hard on closing that loophole. Thanks to their evil monopoly, hundreds of hostnames resolve to the same set of IP addresses. The only clue as to which of them a person is trying to visit is in the SNI header, which requires some serious deep-packet inspection to figure out. Even that is going to be encrypted soon. > That doesn't mean it will be a benefit for everyone. > Please stop using this cheap appeal to emotion that presumes one solution will help everyone. Who is this "everyone" that you keep talking about? Last time I checked, everyone and their cat was using Chrome. Chrome is planning to enable DoH in a future version only if it detects that you are already sending DNS queries to a service that supports DoH. No change of privacy there. The one browser that's planning to go full-time DoH with a partnership with Cloudflare is Firefox, an underdog with only 4% market share. So "everyone" is NOT being forced to adopt the same solution. People who want DoH can switch to Firefox. People who don't want it have several other browsers to choose from. It's a free market. Let companies experiment, and let people vote with their feet. Use something else or build something new if you don't like what's available. That was my whole point. There's so much negativity around the issue, one would have thought that somebody got caught red-handed colluding with the NSA or something :(

by pdkl95 7y ago

mr__y 7y ago

>The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS. not necesarilly. With HTTPS the ISP will see the IP being connected to, not the domain. Since there can be multiple domains behind a single IP address, the ISP cannot know the exact domain. On the other hand since more and more websites use cloudflare revproxy service, quite often all the ISP will see is one of cloudflare IPs being connected to, whereas Cloudflare will know the exact domain (and URI) your browser is requesting. And Cloudflare will get that information regardless of the way you look up DNS record

kijin 7y ago

> You seem to be presuming that a single "service" is necessary. A fully distributed alternative can just as well be considered a "service" if it can be plugged into a browser or OS to replace the default resolver. > The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS. Cloudflare is working hard on closing that loophole. Thanks to their evil monopoly, hundreds of hostnames resolve to the same set of IP addresses. The only clue as to which of them a person is trying to visit is in the SNI header, which requires some serious deep-packet inspection to figure out. Even that is going to be encrypted soon. > That doesn't mean it will be a benefit for everyone. > Please stop using this cheap appeal to emotion that presumes one solution will help everyone. Who is this "everyone" that you keep talking about? Last time I checked, everyone and their cat was using Chrome. Chrome is planning to enable DoH in a future version only if it detects that you are already sending DNS queries to a service that supports DoH. No change of privacy there. The one browser that's planning to go full-time DoH with a partnership with Cloudflare is Firefox, an underdog with only 4% market share. So "everyone" is NOT being forced to adopt the same solution. People who want DoH can switch to Firefox. People who don't want it have several other browsers to choose from. It's a free market. Let companies experiment, and let people vote with their feet. Use something else or build something new if you don't like what's available. That was my whole point. There's so much negativity around the issue, one would have thought that somebody got caught red-handed colluding with the NSA or something :(