5 ms·

The internet supposedly exists because it provided a more reliable way to order nuclear missile launches. DNS over HTTPS is controversial because the current i

by swiley 6y ago

The internet supposedly exists because it provided a more reliable way to order nuclear missile launches. DNS over HTTPS is controversial because the current implementations take power from the end users (by moving the resolver out of libc who’s configuration and often implementation is controlled by end users and into certain applications where the user is lucky if the app allows them to adjust the parameters, especially if the interface is stable and intuitive. They really have to because cramming http and tls into libc is a bit crazy.) Furthermore it concentrates power and data into the hands of a couple of organizations where previously using their resolvers was optional. At this point I’m not entirely sure I trust Google any more than most foreign governments or even my own.

vertex-four 6y ago
Web browser DNS resolution hasn't gone through libc in a long time.
- swiley 6y ago
  Really? Because I remember it respecting the libc resolver configuration are least shortly before the change, now it just ignores it.
  - vertex-four 6y ago
    Most DNS resolution libraries will read the libc resolver configuration (/ets/nsswitch.conf) and attempt to parse it into something they understand, and potentially fall back to it (for example, if you're doing non-DNS resolution like mDNS). If you'd like to standardise a way to require DNS-over-HTTPS in supporting software, and convince operating system distributors to generally ship it, I'm fairly sure Firefox would be up for using that rather than its current mechanism, similar to how it uses system proxy settings. As it is there is no such standard.
    - someguydave 6y ago
      Still, it is reasonable to export a standard control interface to the user for site filtering and control.
      - vertex-four 6y ago
        There isn't one today, aside from running your own DNS server, and you can run your own DNS-over-HTTPS server. My understanding is that Firefox still respects /etc/hosts in DNS-over-HTTPS mode, too. I'm unaware of any such tooling that installs a glibc resolver stub. RFC8890 explicitly refers to "the interests of that child's parents or guardians" when the child is using a web browser, although individual system configuration is not within the remit of the IETF. RFC 8484 makes no reference to how DNS-over-HTTPS should be configured, and in the face of widespread DNS hijacking, enforcing DNS-over-HTTPS in browsers may have been the correct solution - but that doesn't mean we can't do better by defining a standard (perhaps under the remit of the Free Desktop XDG group), encouraging operating system vendors to ship secure DNS configured by default, and then convincing Firefox et al to use that standard.
        someguydave 6y ago
        Sure, because big tech pretends to care about privacy and freedom of speech but only insofar as it results in them cutting out every layer of control between their servers and the end users they would like to own. So everything will be tunneled over opaque HTTPS proxies and there will be no facility for people to filter anything - even end users. Apple, for instance, pretends to care about user privacy and control but refuses to offer a configurable IP firewall in iOS or end-user control over name resolution for filtering.
        someguydave 6y ago
        >you can run your own DNS-over-HTTPS server. Yes, but is there a facility to force the browser to use your server or will Google re-write Chomium to "bypass" "rogue" DoH servers which filter content Google doesn't wish them to filter?
    - 6y ago
nix23 6y ago
>The internet supposedly exists because it provided a more reliable way to order nuclear missile launches. Not sure about that: https://en.wikipedia.org/wiki/ARPANET#Debate_on_design_goals https://en.wikipedia.org/wiki/ARPANET#Debate_on_design_goals
- KineticLensman 6y ago
  Agree, the internet was NOT created as a missile command and control system. Baran's seminal work on packet-switching was a RAND C2 study whose concepts were rejected by the extant defence contractors as impractical. When DARPA later wanted to interconnect it's collection of computers to create ARPANET for researchers, Baran's theoretical ideas were dusted off and the rest is history.
- dredmorbius 6y ago
  Reliable Digital Communications Systems Using Unreliable Network Repeater Nodes (1960) https://www.rand.org/pubs/papers/P1995.html https://www.rand.org/pubs/papers/P1995.html
  - nix23 6y ago
    >It was from the RAND study that the false rumor started, claiming that the ARPANET was somehow related to building a network resistant to nuclear war. This was never true of the ARPANET, but was an aspect of the earlier RAND study of secure communication. The later work on internetworking did emphasize robustness and survivability, including the capability to withstand losses of large portions of the underlying networks
    - dredmorbius 6y ago
      I was simply pointing to original source docs from one of the co-inventors of packet-based switching, on which the Internet is based. There's a larger series of Baran's works at RAND: https://www.rand.org/about/history/baran.html https://www.rand.org/about/history/baran.html Nukes were definitely part of the Zeitgeist: In 1962, a nuclear confrontation seemed imminent. The United States and the Union of Soviet Socialist Republics (USSR) were embroiled in the Cuban missile crisis. Both were in the process of building hair-trigger nuclear ballistic missile systems. Each country pondered post-nuclear attack scenarios. U.S. authorities considered ways to communicate in the aftermath of a nuclear attack. How could any sort of “command and control network” survive? Paul Baran, a researcher at RAND, offered a solution: design a more robust communications network using “redundancy” and “digital” technology.
jillesvangurp 6y ago
Nonsense. End users have the power to configure their browsers just like they have the power to configure their DNS settings, their operating system and all the rest. Of course very few people do. Mostly that power requires something most users don't have: which is knowledge to know they need to do this and how to do this. The people actually capable of doing this lose no power whatsoever. You seem to not trust Google. Nobody is saying you should or must. Other DNS servers are available. Set up your own one if you must. You have that power. If you are smart enough to actually know how to set up DNS now, you should be able to figure out how to configure that to use https. It's not rocket science. If not, maybe it's a good thing that your browser stops blasting your DNS queries unencrypted over a public network to absolutely anybody that can be bothered to listen in. This would include all the 3 letter acronym security agencies that you can name (domestic and foreign ones), big ad driven companies, your local police, and everybody else with or without the cooperation from your friendly neighborhood operators or arm twisting of the incompetent politicians representing which ever government is governing wherever you live. The best you can hope for to protect you from that is a combination of incompetence and indifference.
- AlexandrB 6y ago
  > Nonsense. End users have the power to configure their browsers just like they have the power to configure their DNS settings, their operating system and all the rest. This power is illusory. If Google decides Chrome will no longer allow changing DNS providers, game over for 60% of internet users. Consider how it's no longer possible to block ads the way you want to in Chrome with manifest 3.
  - xg15 6y ago
    True - but I think this is not the fault of DoH or IETF. On a technical level, the power stems from Google's ability to auto-update Chrome with whatever logic they see fit. On a social level, maybe Chrome's market share and the acceptance of users of that power. Even without DoH, Google could just as easily have decided to hardwire DNS for Chrome to 8.8.8.8 or to switch Chrome to their own home-grown proprietary name resolution protocol. They don't need a public standard for that.

by swiley 6y ago

vertex-four 6y ago

Web browser DNS resolution hasn't gone through libc in a long time.

swiley 6y ago
Really? Because I remember it respecting the libc resolver configuration are least shortly before the change, now it just ignores it.
- vertex-four 6y ago
  Most DNS resolution libraries will read the libc resolver configuration (/ets/nsswitch.conf) and attempt to parse it into something they understand, and potentially fall back to it (for example, if you're doing non-DNS resolution like mDNS). If you'd like to standardise a way to require DNS-over-HTTPS in supporting software, and convince operating system distributors to generally ship it, I'm fairly sure Firefox would be up for using that rather than its current mechanism, similar to how it uses system proxy settings. As it is there is no such standard.
  - someguydave 6y ago
    Still, it is reasonable to export a standard control interface to the user for site filtering and control.
    - vertex-four 6y ago
      There isn't one today, aside from running your own DNS server, and you can run your own DNS-over-HTTPS server. My understanding is that Firefox still respects /etc/hosts in DNS-over-HTTPS mode, too. I'm unaware of any such tooling that installs a glibc resolver stub. RFC8890 explicitly refers to "the interests of that child's parents or guardians" when the child is using a web browser, although individual system configuration is not within the remit of the IETF. RFC 8484 makes no reference to how DNS-over-HTTPS should be configured, and in the face of widespread DNS hijacking, enforcing DNS-over-HTTPS in browsers may have been the correct solution - but that doesn't mean we can't do better by defining a standard (perhaps under the remit of the Free Desktop XDG group), encouraging operating system vendors to ship secure DNS configured by default, and then convincing Firefox et al to use that standard.
      - someguydave 6y ago
        Sure, because big tech pretends to care about privacy and freedom of speech but only insofar as it results in them cutting out every layer of control between their servers and the end users they would like to own. So everything will be tunneled over opaque HTTPS proxies and there will be no facility for people to filter anything - even end users. Apple, for instance, pretends to care about user privacy and control but refuses to offer a configurable IP firewall in iOS or end-user control over name resolution for filtering.
      - someguydave 6y ago
        >you can run your own DNS-over-HTTPS server. Yes, but is there a facility to force the browser to use your server or will Google re-write Chomium to "bypass" "rogue" DoH servers which filter content Google doesn't wish them to filter?
  - 6y ago

nix23 6y ago

>The internet supposedly exists because it provided a more reliable way to order nuclear missile launches. Not sure about that: https://en.wikipedia.org/wiki/ARPANET#Debate_on_design_goals https://en.wikipedia.org/wiki/ARPANET#Debate_on_design_goals

KineticLensman 6y ago
Agree, the internet was NOT created as a missile command and control system. Baran's seminal work on packet-switching was a RAND C2 study whose concepts were rejected by the extant defence contractors as impractical. When DARPA later wanted to interconnect it's collection of computers to create ARPANET for researchers, Baran's theoretical ideas were dusted off and the rest is history.
dredmorbius 6y ago
Reliable Digital Communications Systems Using Unreliable Network Repeater Nodes (1960) https://www.rand.org/pubs/papers/P1995.html https://www.rand.org/pubs/papers/P1995.html
- nix23 6y ago
  >It was from the RAND study that the false rumor started, claiming that the ARPANET was somehow related to building a network resistant to nuclear war. This was never true of the ARPANET, but was an aspect of the earlier RAND study of secure communication. The later work on internetworking did emphasize robustness and survivability, including the capability to withstand losses of large portions of the underlying networks
  - dredmorbius 6y ago
    I was simply pointing to original source docs from one of the co-inventors of packet-based switching, on which the Internet is based. There's a larger series of Baran's works at RAND: https://www.rand.org/about/history/baran.html https://www.rand.org/about/history/baran.html Nukes were definitely part of the Zeitgeist: In 1962, a nuclear confrontation seemed imminent. The United States and the Union of Soviet Socialist Republics (USSR) were embroiled in the Cuban missile crisis. Both were in the process of building hair-trigger nuclear ballistic missile systems. Each country pondered post-nuclear attack scenarios. U.S. authorities considered ways to communicate in the aftermath of a nuclear attack. How could any sort of “command and control network” survive? Paul Baran, a researcher at RAND, offered a solution: design a more robust communications network using “redundancy” and “digital” technology.

jillesvangurp 6y ago

Nonsense. End users have the power to configure their browsers just like they have the power to configure their DNS settings, their operating system and all the rest. Of course very few people do. Mostly that power requires something most users don't have: which is knowledge to know they need to do this and how to do this. The people actually capable of doing this lose no power whatsoever. You seem to not trust Google. Nobody is saying you should or must. Other DNS servers are available. Set up your own one if you must. You have that power. If you are smart enough to actually know how to set up DNS now, you should be able to figure out how to configure that to use https. It's not rocket science. If not, maybe it's a good thing that your browser stops blasting your DNS queries unencrypted over a public network to absolutely anybody that can be bothered to listen in. This would include all the 3 letter acronym security agencies that you can name (domestic and foreign ones), big ad driven companies, your local police, and everybody else with or without the cooperation from your friendly neighborhood operators or arm twisting of the incompetent politicians representing which ever government is governing wherever you live. The best you can hope for to protect you from that is a combination of incompetence and indifference.

AlexandrB 6y ago
> Nonsense. End users have the power to configure their browsers just like they have the power to configure their DNS settings, their operating system and all the rest. This power is illusory. If Google decides Chrome will no longer allow changing DNS providers, game over for 60% of internet users. Consider how it's no longer possible to block ads the way you want to in Chrome with manifest 3.
- xg15 6y ago
  True - but I think this is not the fault of DoH or IETF. On a technical level, the power stems from Google's ability to auto-update Chrome with whatever logic they see fit. On a social level, maybe Chrome's market share and the acceptance of users of that power. Even without DoH, Google could just as easily have decided to hardwire DNS for Chrome to 8.8.8.8 or to switch Chrome to their own home-grown proprietary name resolution protocol. They don't need a public standard for that.