5 ms·
> It's controversial because it takes away power from countries actively abusing that power. I'd say it's controversial because it breaks a wide arrange of set
by m_eiman 6y ago
> It's controversial because it takes away power from countries actively abusing that power.
I'd say it's controversial because it breaks a wide arrange of setups and features that rely on DNS, giving power from local administrators over to Google, Cloudflare et al.
If the only thing it did was prevent governments from spying, there'd be a lot less fuss about it.
- sneak 6y agoLocal administrators can still configure their own machines to speak any sort of DNS they like to their own servers. Indeed, the default AD setup used by many such admins does precisely this. DoH is a great tool for end users to be able to disregard their pipes and preserve their own individual privacy. An ISP network admin is not the administrator of the private customer machines that are connected downstream.
- m_eiman 6y agoI can no longer configure "my machine" to use DNS a specific way; I have to configure my system plus a number of specific applications to use DNS the way I want. Splitting this configuration into multiple places is bad. In an enterprise/commercial setting, there are valid reasons for filtering employees' use of DNS (legal compliance, e.g.). I can no longer install e.g. PiHole to filter out ad servers globally for all devices on my network. These are some of the issues caused by DoH, I'm sure there are others.
- Avamander 6y ago> Splitting this configuration into multiple places is bad. This is because OSs are ossified. They need to move along or get left behind, they decided to be left behind. I'd also remind you that DNS wasn't very configurable even before, plenty of devices I've seen that ignore DHCP DNS, NTP and domain. Even if they should respect them. DoH is no exception to the general type of behaviour that already exists.
- nitrogen 6y agoThis is because OSs are ossified. They need to move along or get left behind, they decided to be left behind. This type of position has the veneer of forward thinking, but it is precisely backward. The core value of an OS or a network protocol is consistency. Do not break things that work. Do not change what doesn't need changing.
- Avamander 6y ago> Do not break things that work. Do not change what doesn't need changing. Exactly. Things don't work, the only way to fix it is to change it. It has a few negative consequences but they're already here and standing still won't make it better. If OSs start having the features needed, the control will return. But as long as some people are dragging their feet, throwing tantrums, ignoring the large majority for which it's a positive change, it's going to be a tiresome long process.
- yjftsjthsd-h 6y ago> plenty of devices I've seen that ignore DHCP DNS, NTP and domain. Even if they should respect them. DoH is no exception to the general type of behaviour that already exists. Wait, your solution to buggy devices is to treat the bug as acceptable and deploy it more widely?!
- Avamander 6y agoThere's no removing or fixing those devices, there's billions of them out there.
- nextaccountic 6y agoThose issues aren't caused by DoH but by your OS tooling. In enterprise settings you can and should configure this once and replicate images for everyone. And you of course can configure your own software to use your own dns server. DoH just prevents you from hijacking someone else's dns.
- someguydave 6y agoThose same companies like Google intentionally break IP filtering too through fancy proxying. They do this to make it impossible for local admins to pick and choose among their services.
- lazylizard 6y agodoes the browser know to fallback to resolv if its an internal domain or perhaps what its looking for returns nxdomain?
- deleted 6y ago[deleted]