4 ms·

My feeling on this is that it's a pretty imperfect solution but unsurprising that the browser manufacturers are pushing it forward given ISPs dragging their hee

My feeling on this is that it's a pretty imperfect solution but unsurprising that the browser manufacturers are pushing it forward given ISPs dragging their heels on DoT. We saw the same problem with TLS. Until the browser makers started pushing it and Let's encrypt made it simple/free the take up of TLS was patchy at best. This will have negative effects on tools that use DNS for blocking/monitoring, but then those were a hack at best. If you want to understand the traffic flowing over your network, you need to invest in interception and parsing.

datenwolf 7y ago
> ISPs dragging their heels on DoT WTH does DoT adoption by ISPs have to do with that?! One can run their own DNS recursive resolver-cache perfectly fine on their own hosts, or at the network edge, without relying on ISPs. Better yet: Since the Root zone and TLD zone DNS servers change only seldomly, you can prefetch and cache them locally just fine, and upon resolving a DNS skip two recursion steps. Apart from doing DPS, then ISPs will not "see" DNS queries, thus bypassing the privacy concerns of that.
- ignoramous 7y ago
  > WTH does DoT adoption by ISPs have to do with that?! The ISPs need to support DoT server-side, at their end?
  - datenwolf 7y ago
    > The ISPs need to support DoT server-side, at their end? That's not how DNS works. Just put DoT capable cachine-resolvers onto each host, and you're golden. Those to even play nicely with enterprise infrastructure, like a local DNS.
- raesene9 7y ago
  Most end users don't just "run their own recursive resolver-cache" They take whatever DNS server is provided by their ISP I'd guess that 99+% of Internet users have no idea how to run their own DNS server, let alone set up DoT.
  - datenwolf 7y ago
    That's not a good counterargument. Why you ask? Because that's something that OS vendors could easily and trivially deploy with only minimal effort. For example on Linux you could do this with running a localhost instance of unbound, and having a DHCP client hook script updating unbound's configuration for domain specific authorative DNS servers based on the DHCP options for nameserver and domain name. Just put that as out-of-the-box setup into default Linux distributions' installation: Not only does this greatly enhance privacy. It also prevents enterprise information leakage, and every program on the system is going to benefit from it. Not just the browser. DoH is a clusterfuck of stupid. There's not one single redeeming quality about it. Everything positive it promises to do has been already solved in a far better manner by earlier developments. And it comes with the penality of concentration of failure points. In the best case scenario it doesn't impair your privacy. In the worst case scenario, all the DoH resolver operators in the U.S. will get FISA court orders – including a gag order – to install boxes helpfully provided by some three-letter-agency that monitor all incoming and outgoing traffic of their resolvers; getting the DNS queries/responses in the clear would be nice, but they don't really need it, for the resolvers provide some nicely observable traffic hub on where it's super easy to time correlate outgoing DNS resolver queries to incoming DoH requests. And don't even believe that DoH requests would be indistinguishable from "regular" HTTPS traffic! Unless you're running into an DNS record that's been overloaded with everything DNSSEC offers the bandwidth requirements of DNS are fairly balanced in both directions. Plus, the amount of data transferred via DoH is more or less the net size of the final DNS query and request combined. So either you pad DoH for the worst case scenario size, or you have a pretty well readable side channel. No matter from which angle you look at it, DoH makes no fucking sense whatsoever. It's just stupid, if not malicious.
    - tptacek 7y ago
      I like how someone on HN tells you that ordinary users have no idea how to set up their own DNS servers and you respond with how Linux users can set up unbound. Like, well argued! There is also something poetic about how the people that know how and are inclined to set up their own unbound servers on their laptops are getting worse security than everyone else. That sparks joy for me.

datenwolf 7y ago

> ISPs dragging their heels on DoT WTH does DoT adoption by ISPs have to do with that?! One can run their own DNS recursive resolver-cache perfectly fine on their own hosts, or at the network edge, without relying on ISPs. Better yet: Since the Root zone and TLD zone DNS servers change only seldomly, you can prefetch and cache them locally just fine, and upon resolving a DNS skip two recursion steps. Apart from doing DPS, then ISPs will not "see" DNS queries, thus bypassing the privacy concerns of that.

ignoramous 7y ago
> WTH does DoT adoption by ISPs have to do with that?! The ISPs need to support DoT server-side, at their end?
- datenwolf 7y ago
  > The ISPs need to support DoT server-side, at their end? That's not how DNS works. Just put DoT capable cachine-resolvers onto each host, and you're golden. Those to even play nicely with enterprise infrastructure, like a local DNS.
raesene9 7y ago
Most end users don't just "run their own recursive resolver-cache" They take whatever DNS server is provided by their ISP I'd guess that 99+% of Internet users have no idea how to run their own DNS server, let alone set up DoT.
- datenwolf 7y ago
  That's not a good counterargument. Why you ask? Because that's something that OS vendors could easily and trivially deploy with only minimal effort. For example on Linux you could do this with running a localhost instance of unbound, and having a DHCP client hook script updating unbound's configuration for domain specific authorative DNS servers based on the DHCP options for nameserver and domain name. Just put that as out-of-the-box setup into default Linux distributions' installation: Not only does this greatly enhance privacy. It also prevents enterprise information leakage, and every program on the system is going to benefit from it. Not just the browser. DoH is a clusterfuck of stupid. There's not one single redeeming quality about it. Everything positive it promises to do has been already solved in a far better manner by earlier developments. And it comes with the penality of concentration of failure points. In the best case scenario it doesn't impair your privacy. In the worst case scenario, all the DoH resolver operators in the U.S. will get FISA court orders – including a gag order – to install boxes helpfully provided by some three-letter-agency that monitor all incoming and outgoing traffic of their resolvers; getting the DNS queries/responses in the clear would be nice, but they don't really need it, for the resolvers provide some nicely observable traffic hub on where it's super easy to time correlate outgoing DNS resolver queries to incoming DoH requests. And don't even believe that DoH requests would be indistinguishable from "regular" HTTPS traffic! Unless you're running into an DNS record that's been overloaded with everything DNSSEC offers the bandwidth requirements of DNS are fairly balanced in both directions. Plus, the amount of data transferred via DoH is more or less the net size of the final DNS query and request combined. So either you pad DoH for the worst case scenario size, or you have a pretty well readable side channel. No matter from which angle you look at it, DoH makes no fucking sense whatsoever. It's just stupid, if not malicious.
  - tptacek 7y ago
    I like how someone on HN tells you that ordinary users have no idea how to set up their own DNS servers and you respond with how Linux users can set up unbound. Like, well argued! There is also something poetic about how the people that know how and are inclined to set up their own unbound servers on their laptops are getting worse security than everyone else. That sparks joy for me.