4 ms·

I should have said "yet another architecture of control". Call it the opposite of defense-in-depth. Device manufacturers who aren't thorough might allow a clas

I should have said "yet another architecture of control". Call it the opposite of defense-in-depth. Device manufacturers who aren't thorough might allow a class of "attacks" by way of using DNS. Having ubiquitous DoH takes away that "attack" vector. I'm not arguing device manufacturers need DoH to be jerks. Having it available just enables the less sophisticated ones to be jerky more easily. DNS-over-TLS does the same thing, it's just marginally less frustrating because it can be blocked at the network layer, at least. I understand that allowing owners of devices to do what they want on their own networks runs counter to the whole "protect the public from bad network operators" / "protect the public from bad people" narrative. I'm in the minority. It's just damned frustrating. It's sucking all the fun out of computing and networking. It's irrational and self-serving, but dammit it makes me angry.

tptacek 7y ago
This doesn't make any sense. Device vendors don't need encrypted DNS to obfuscate their command-and-control any more than bot developers do. They already have code execution on their platform that has network access. They can use whatever encrypted channel they want. Skype was doing this before DoH had even occurred to anybody. We're supposed to tell home users to keep using plaintext DNS because an incompetent device manufacturer might not be able to come up with a better encrypted C&C than DoH?
- EvanAnderson 7y ago
  I'm not arguing home users, or anybody, should keep using unencrypted DNS. I'm not arguing anything. I'm just depressed as hell that every solution to "protect the average person" involves making me own my devices even less. You're right, I'm wrong. I'm sorry I engaged. Chalk it up to me being old and angry.
  - user72628 7y ago
    You are right. But we will lose. You see, one thing is one or two vendors misusing protocols to remove users control from their devices. Another thing is an official protocol that does the same thing. We find have anywhere to run anymore. As bi dollar corporations and organizations are more and more "protecting" ourselves they need to remove control from ourselves.
  - tptacek 7y ago
    I don't object to you being angry about devices you don't control on your home network. You should be angry about that. It just doesn't have anything to do with DNS.

tptacek 7y ago

This doesn't make any sense. Device vendors don't need encrypted DNS to obfuscate their command-and-control any more than bot developers do. They already have code execution on their platform that has network access. They can use whatever encrypted channel they want. Skype was doing this before DoH had even occurred to anybody. We're supposed to tell home users to keep using plaintext DNS because an incompetent device manufacturer might not be able to come up with a better encrypted C&C than DoH?

EvanAnderson 7y ago
I'm not arguing home users, or anybody, should keep using unencrypted DNS. I'm not arguing anything. I'm just depressed as hell that every solution to "protect the average person" involves making me own my devices even less. You're right, I'm wrong. I'm sorry I engaged. Chalk it up to me being old and angry.
- user72628 7y ago
  You are right. But we will lose. You see, one thing is one or two vendors misusing protocols to remove users control from their devices. Another thing is an official protocol that does the same thing. We find have anywhere to run anymore. As bi dollar corporations and organizations are more and more "protecting" ourselves they need to remove control from ourselves.
- tptacek 7y ago
  I don't object to you being angry about devices you don't control on your home network. You should be angry about that. It just doesn't have anything to do with DNS.