5 ms·
This is a great history of DNS. I didn’t really notice any inaccuracies. I especially like the way that client subnet was discussed, but of course that’s becaus
by bluejekyll 7y ago
This is a great history of DNS. I didn’t really notice any inaccuracies. I especially like the way that client subnet was discussed, but of course that’s because I agree with the author.
I find it interesting that it avoided DNSSEC, perhaps recognizing it as a skirmish rather than an episode of the greater war. This is probably accurate, DNSSEC has never actively steered DNS in any particular direction, it’s much more passive and therefore doesn’t represent something that needs to be directly fought. Pick your battles, this one is not worth fighting, probably because there’s nothing to gain or lose (from a control perspective) in it succeeding or failing.
Tying everything back together with the discussion of Westfalia is really interesting, because it raises an interesting topic. The ability to control the content that users have access to, and the ease of doing so. DoT and DoH make it much harder to easily intercept DNS packets and manipulate or deny responses to them (edit: to be clear it denies network operators this control, but of course the chosen resolver has even more ability to do so). It denies a method of control that network operators have over the users of that network. This control was never perfect, sophisticated (and not even that sophisticated) actors on the network could always circumvent this control of DNS. It really only prevents the majority of people, non-bad actors in general, from circumventing the network operators controls (when considering only DNS as that control mechanism).
This is probably a good thing for the user, because it will force the network operators and countries, to start treating good actors and bad actors the same, rather than only controlling and monitoring the unsuspecting normal user, while leaving the doors open for the bad actors. In the Westfalia time period, it would be the difference between the citizen relying on traditional imports vs. the smuggler to avoid all tariffs, because the coasts were large and it was somewhat easy to avoid the navy’s of the large states at the time.
- gjvnq 7y agoAbout DNSSEC, Brazil requires it for some domains: .leg.br .jus.br .mp.br .tc.br .def.br .b.br Source: https://registro.br/dominio/categorias/ https://registro.br/dominio/categorias/
- bluejekyll 7y agoMy point that I was trying to make is that DNSSEC being focused on authenticating the existing DNS record data, and not on the control and protocol plane, leaves it out inside of control issues. Sure it enshrines the existing roots and the ultimate authorities for the correctness of DNS, but this is already true, and going against it means a fork of DNS in a sense which doesn’t seem like anyone really wants.
- chrisweekly 7y ago"Westphalia" here refers to the (1648) Peace of Westphalia, from which emerged modern concepts of nationhood and sovereignty.
- bluejekyll 7y agoThanks for the spelling correction. I knew I should have double checked that before going to bed. And yes, I should have been clearer in my time period reference.
- pvg 7y agoIt's a good typo. Sometimes all the Sturm und Drang surrounding DNS feels like a consequence of DNS people having started to un-ironically view their (important, no doubt) work in terms of the Peace of Westphalia instead of the Volkswagen Westfalia camper van.
- zzzcpan 7y agoThe author pushes one sided Cloudflare's line on both client subnets and DoH (given APNIC maybe he should disclose affiliation). There is nothing accurate about it. Client subnet extension doesn't violate any privacy in any threat model you can imagine, Cloudflare just wants all the competing CDNs, which are DNS based, to get more wildly inaccurate results on picking nodes. And DoH is outright anti-privacy tech pretending to be about privacy, since a lot of people have no clue that encryption is orthogonal to privacy.
- jgrahamc 7y ago> Cloudflare just wants all the competing CDNs, which are DNS based, to get more wildly inaccurate results on picking nodes. That's a bunch of crap.
- kodablah 7y agoSo is their sentence after that one.
- bluejekyll 7y agoBy accurate I didn’t mean unbiased, the client subnet discussion clearly shows a bias against the feature. I wouldn’t say it was inaccurate—though, the article definitely comes down strongly against it. I am unaware of the affiliation of the author, so I’m not trying to defend that relationship or the entities mentioned. Factually, it all seems accurate, though it could very easily be argued that it leaves some things out and leans in a particular direction on all of the issues it does cover.
- ryanlol 7y ago>Client subnet extension doesn't violate any privacy in any threat model you can imagine Credit card fraud.
- bluejekyll 7y agoCan you expand on how it’s being used to contribute to credit card fraud? I could speculate, but if you have a source that would be really helpful.
- deleted 7y ago[deleted]
- snarf21 7y agoDumb question: What does encrypted DNS really solve? Is it just that you know the DNS will be resolved by the server you chose and not modified? I understand the approaches of DoT and DoH but people keep talking about privacy and tracking but it just seems like you can just run your own un-DNS server and get the same info by looking up the IP to get the DNS. You can still be monitored and controlled by IP, right?
- marcosdumay 7y agoIt stops your ISP from messing with the DNS results, including from removing the DNSSEC information. It also stops them from reading all your DNS queries, even if you create a local cache you'll still need to query the network at least once on every domain you connect, encrypted DNS hides that one query from your ISP. DoH has the added benefit of hiding even the fact that you are making a query. That means your ISP can not block it and force you to use a non-encrypted algorithm. You can still be monitored by IP, but: - there isn't an exact 1 to 1 relation between IP and domain name - it still stops the ISP from messing with the results
- bluejekyll 7y agoThere are two things it helps solve, but doesn't solve completely. 1) connection security, by which I mean, the DNS packets can not be actively manipulated. DNSSEC in theory helps with this too, but there's no way to distinguish in DNSSEC between a response that doesn't have any DNSSEC data vs. one that was modified to remove the DNSSEC data for nefarious purposes (i.e. allowing the response packet to have other unsigned records to be inserted in the response). DoT and DoH (and DNSCrypt before them) prevent this form of data manipulation. 2) Privacy, which you mention. This one is a little shaky, it protects you from the ISP or others monitoring the network traffic, from seeing the DNS request and response in the raw. If the next connection is TLS (for a website), until SNI is encrypted in TLS 1.3, then the name of the site is potentially disclosed in the raw on that next connection. Even so, the IP itself discloses a significant degree of information about that connection, though as more sites sit behind CDNs, the value of that information goes down. At the end of the day, with DoH and DoT, the privacy and data authenticity responsibilities are being passed off the the chosen resolver, which the article mentions as Google or Cloudflare in many cases. So now you're trusting those entities, for better or worse, with all that information.