4 ms·
I mean, DNS is a protocol from the dinosaur days of the internet, where cryptography just wasn't a concern for anything. It's also foundational. Moving to a tru
by Kalium 6y ago
I mean, DNS is a protocol from the dinosaur days of the internet, where cryptography just wasn't a concern for anything. It's also foundational. Moving to a truly encrypted, private, not-transparently-backward-compatible protocol was never likely to see better adoption than DNSSEC.
IMO, telling all this to someone who has no historical context and innocently asks "Why not just fix DNS?" is lighting a candle with a flamethrower. Plus all the strong emotions that get conjured by DNSSEC and its history (at some point someone will chip in asking about DNSCurve...).
The important points for the casual observer are that people have considered updating DNS and that DNS is unfixable for political and economic reasons. Which is why the best answer we have today is to tunnel it over HTTPS.
- tptacek 6y agoDoH is essentially the IETF's version of DNSCurve. DNSCurve (and then DNSCrypt) were at base the idea that we should secure DNS bottom-up, starting from the resolvers, rather than what the IETF had been doing, which was the top-down start-at-the-roots concept of DNSSEC. Neither DNSCurve nor DNSCrypt had any real push in the IETF that I can find; Dempsky wrote an I-D for DNSCurve back in 2010 that has like 2 mailing list posts about it, and I can't find anything for DNSCrypt despite it actually having users. Meanwhile, the idea that we can't do anything but tunnel DNS through HTTPS because of inertia or politics is obviously false, because there are competing proposals, one of them with serious IETF energy, that don't do that. They're just not popular among users.