4 ms·

If there was a coordinated embrace and move to DoT (at least for the "last mile" part between end users and resolvers), network operators wouldn't be able to ge

If there was a coordinated embrace and move to DoT (at least for the "last mile" part between end users and resolvers), network operators wouldn't be able to get away with blocking it (see secure IMAP, secure POP etc. for similar shifts in the past).

sneak 6y ago
The internet is decentralized and "coordinated embrace" is not realistic or practical. See also: IPv6. Pretty much the whole of the internet has been jammed into tcp/443 now, and it can't much be helped. Internet engineering needs to cope with the world as it is, not how we wish it were.
- corford 6y ago
  >The internet is decentralized and "coordinated embrace" is not realistic or practical. I disagree, see the success of: letsencrypt, the wide spread use of 8.8.8.8 and 1.1.1.1; dkim/spf/dmarc; imaps, pop3s, tls ldap. Why should a switch over to DoT be any different? If anything it should be easier. The general need for better security and privacy are much more widely understood and accepted concerns these days.
tptacek 6y ago
The opposite is true: most DoT advocacy comes from operators (and suppliers to those operators) who specifically and overtly intend to filter DNS.
- LogicX 6y ago
  As said DNS operator (founder and CTO of DNSFilter.com) - I concur. We’ve been offering DoT for years, but are about to improve the offering with 0-RTT support. We’re also working on POCs of DoH support, but it’s mostly moot compared to our DoT offerings which cover the whole OS, not just the browser.
  - tptacek 6y ago
    Operating systems are going to do DoH (Microsoft already is), and that's going to be the end of it --- browsers, the most important application, are already bought in. DoT is a footnote.
    - axaxs 6y ago
      While I truly respect your credentials, I disagree 100% with your conclusion and think DoT will win out. Should be fun to visit this thread in a year, just to see.
      - tptacek 6y ago
        If you want to put a couple bucks on this, I'd be happy to put my money where my mouth is. :)
    - corford 6y ago
      >browsers, the most important application, are already bought in That's an interesting way to phrase it. The RFC for DoH is co-authored by Mozilla. They didn't buy in, they created it.
    - notfoss 6y ago
      Android - at least for now - supports DoT. But, who knows, they might switch to DoH in the future. https://developers.google.com/speed/public-dns/docs/using#android https://developers.google.com/speed/public-dns/docs/using#an... PS: I have been using it for a while and it works fine.

sneak 6y ago

The internet is decentralized and "coordinated embrace" is not realistic or practical. See also: IPv6. Pretty much the whole of the internet has been jammed into tcp/443 now, and it can't much be helped. Internet engineering needs to cope with the world as it is, not how we wish it were.

corford 6y ago
>The internet is decentralized and "coordinated embrace" is not realistic or practical. I disagree, see the success of: letsencrypt, the wide spread use of 8.8.8.8 and 1.1.1.1; dkim/spf/dmarc; imaps, pop3s, tls ldap. Why should a switch over to DoT be any different? If anything it should be easier. The general need for better security and privacy are much more widely understood and accepted concerns these days.

tptacek 6y ago

The opposite is true: most DoT advocacy comes from operators (and suppliers to those operators) who specifically and overtly intend to filter DNS.

LogicX 6y ago
As said DNS operator (founder and CTO of DNSFilter.com) - I concur. We’ve been offering DoT for years, but are about to improve the offering with 0-RTT support. We’re also working on POCs of DoH support, but it’s mostly moot compared to our DoT offerings which cover the whole OS, not just the browser.
- tptacek 6y ago
  Operating systems are going to do DoH (Microsoft already is), and that's going to be the end of it --- browsers, the most important application, are already bought in. DoT is a footnote.
  - axaxs 6y ago
    While I truly respect your credentials, I disagree 100% with your conclusion and think DoT will win out. Should be fun to visit this thread in a year, just to see.
    - tptacek 6y ago
      If you want to put a couple bucks on this, I'd be happy to put my money where my mouth is. :)
  - corford 6y ago
    >browsers, the most important application, are already bought in That's an interesting way to phrase it. The RFC for DoH is co-authored by Mozilla. They didn't buy in, they created it.
  - notfoss 6y ago
    Android - at least for now - supports DoT. But, who knows, they might switch to DoH in the future. https://developers.google.com/speed/public-dns/docs/using#android https://developers.google.com/speed/public-dns/docs/using#an... PS: I have been using it for a while and it works fine.