I don't have an argument. You're absolutely right in everything you're saying. I'm explicitly not making an argument about code running on general purpose comp

I don't have an argument. You're absolutely right in everything you're saying. I'm explicitly not making an argument about code running on general purpose computers that I (ostensibly) own and control. The WASM/browser comment I made was a flippant jab (though I absolutely think it will happen) and absolutely a separate issue. I'm one of those people who think the web should have stayed more like Gopher and less like Java. I'm a nut-job who browses w/ Javascript disabled by default. I think it's ridiculous that I need to run a VM for third-parties to jam arbitrary code into so I can read articles. Yes-- third-parties could always run arbitrary code on my computer. In the past they had to convince me to install their software. Now visiting their website is, effectively, installing software. I'd be interested to hear how you square the circle of controlling your own computing experience in the face of near-requirement of allowing websites to execute arbitrary code on your computers. re: DoH People are clearly used to using DNS-based filtering tools to control network traffic (the "Pi Hole", Cisco's Umbrella product, creating empty zones in self-hosted recursive resolvers to prevent unwanted domains from resolving, etc). I don't think the people who use these tools understand that DoH creates an easy standards-based way for that control to be removed. I wholeheartedly agree that DNS filtering wasn't absolute control, but it was a degree of control. Yes-- bad actors could always have made up their own name resolution protocols, their own encrypted command-and-control channels, etc. Most of them just used DNS. Having control of DNS to do filtering was something, clearly. The last exchange I had w/ you set my mind straight. The control that DNS filtering provided was a comfortable illusion. It existed because Internet protocols were designed with too much trust to begin with, and because it was easier and more cost effective for developers to use standards-based protocols (at the expense of their traffic being vulnerable to tampering). The world, as it is now, won't work w/ unscrupulous entities exploiting the trust engineered into early protocols. I don't want my ISP "monetizing" my DNS traffic, injecting content into my HTTP sessions, etc. Removing the ability of unscrupulous network operators to use my traffic against me means removing my own ability to influence that traffic to my own benefit.