5 ms·
I guess that is the end of the naysaying really; if the underlying OS supports DoH then browsers can use the settings of that resolver if present and rely on th
by zaarn 7y ago
I guess that is the end of the naysaying really; if the underlying OS supports DoH then browsers can use the settings of that resolver if present and rely on them instead of having to manually do it.
On another note; I like the principles laid out in the article, they do reflect how I'd want a system to act in the presence of DoH servers.
I bet the steps forward will be to test if the DHCP Server configured is capable of DoH and if it is, then using it only over DoH on that network. A second thing might be if DHCP or RA's learn a new flag that indicate the resolver uses DoH upstream or supports DoH itself.
- numlock86 7y agoDid you mean DNS server instead of DHCP server? What has DHCP to do with any of this?
- vetinari 7y agoDHCP tells the devices on the local network, what DNS server they are supposed to be using.
- numlock86 7y agoI know. Hence the question.
- jlgaddis 7y agoA DHCP option, e.g., "DoH server", could be added to the DHCP spec to tell clients which DoH servers to use (just like happens now with "regular DNS").
- numlock86 7y agoAnd why not just use the DNS server itself for this? Like negotiate with the DNS if it supports DoH? Why does it need to influence other standards like DHCP? It's the same with deal with HTTP and HTTPS basically: The server tells me if HTTPS is supported or not. (Yes, there is HSTS but that's a different story ...)
- jlgaddis 7y agoThe first thing that comes to mind is that DHCP option 6 specifices (one or more) IP addresses, whereas with DoH you probably want to specify (ideally, multiple) hostnames, for various reasons.
- fanf2 7y agoThe DoH server needs to be identified using a URL (a target for POST requests) or template (for GET requests). There isn’t a standard way to get from a server name to a DoH URL and DoH servers differ in their choice of path name.
- jlgaddis 7y agoWe pretty much already have this exact thing with options 66 (hostname) and 67 (filename) for clients booting via TFTP. Most DoH servers, AIUI, use the same well-known path, so we'd simply need two more DHCP options: one for the DoH server's hostname and another for the path. There's no reason something like this couldn't easily be added to the DHCP specification and, at some point, I expect it will... everyone will come together to agree on the details and we'll end up with a new/updated RFC.
- protomyth 7y agoWell, it certainly changes the equation from being a rogue element on a network to something that is just another management setting. I won't be truly happy until I can setup a DoH server of my own. Does anyone know if there is any value to adding DoH to the external servers that are only used by other name servers? Will anyone's name servers do their lookup with DoH? The less the outside world knows about what's on a private network the better. Information leaking be it the processor or to someone's servers is just another problem waiting to happen.
- zamadatix 7y agoWhat's stopping you from setting up a DoH server of your own today? DoH is only focusing to encrypt the first hop for now as it was easiest to hit and where the majority of the problem is.
- protomyth 7y agoBecause no OS would use it. I'm against web browsers (or frankly any other client program) using a DNS other than what the OS is set for.
- psanford 7y agoIts really not that hard. I've got /etc/resolv.conf pointed at 127.0.0.1 and a local stub resolver forwarding to an upstream DOH server. Boom! everything using gethostbyname is now using DOH.
- josteink 7y ago> I guess that is the end of the naysaying really The whole “naysaying” (as you so insultingly put it) was never against encryption. It was always about putting the user, the OS and network-operator in control of their own infrastructure, something the DoH-crowd dismissed entirely as a valid concern. So now that Microsoft has just provided that control, sure we’re happy. But don’t act like the complaints made by the “naysayers” weren’t 100% valid. The DoH-crowd was short-sighted, enclosed in their own echo-chamber and didn’t listen to feedback or criticism. This probably hurt DoH long term more than anything else. Now it’s by default “tainted” technology and people have already created and deployed firewalling solutions to block it. Those solutions are probably going to stay in place.
- zaarn 7y agoWell, I don't see how DoH prevents you from being in control of your infrastructure. You can run your own DoH server and set it as DoH Server in Firefox without much issue and I doubt Windows will be different.