4 ms·

I assume DNS over Whatever will still respect the HOSTS file? I'd be really surprised to find otherwise, but would love to hear if that's the case! If you don't

I assume DNS over Whatever will still respect the HOSTS file? I'd be really surprised to find otherwise, but would love to hear if that's the case! If you don't trust the browser you already have very little defense against ads, no? After all, the browser could always just resolve DNS itself. HOSTS files may also be simplest (I totally disagree btw), but I can't imagine they're anywhere near the most common.

hdjdbtbgwjsn 6y ago
I don't think that hosts files are respected in e.g. FF. Why not test for yourself though?
userbinator 6y ago
After all, the browser could always just resolve DNS itself. That's exactly how DoH is being implemented, and it's why it has caused so much controversy.
- staticassertion 6y ago
  Pretty sure Chrome has been using its own DNS resolver for ages. I don't see the issue either way.
  - cookiengineer 6y ago
    > Pretty sure Chrome has been using its own DNS resolver for ages. That is correct, the IPv6 probes are embedded in the Chromium source, and are removed by the Ungoogled Chromium and/or Inox patchset [1]. [1] https://github.com/Eloston/ungoogled-chromium/tree/master/patches/core/inox-patchset https://github.com/Eloston/ungoogled-chromium/tree/master/pa...
    - silon42 6y ago
      How do they handle "enterprise" proxies that ban direct internet access? I probably should setup that at home.
      - cookiengineer 6y ago
        Chrome itself always requests HTTP first, except for HSTS and their own pinned certificates list which is actually shipped within the source code. That's also a major difference to Ungoogled Chromium, where UC will request "https:// https://..." by default if you just enter the domain. So in the case of Enterprise Proxies that have no locally force-installed cert to sniff on internet traffic will likely end up with HTTP-everywhere being used. But usually employers that encourage such bad practices also install their snakeoil MITM certificates locally.

hdjdbtbgwjsn 6y ago

I don't think that hosts files are respected in e.g. FF. Why not test for yourself though?

userbinator 6y ago

After all, the browser could always just resolve DNS itself. That's exactly how DoH is being implemented, and it's why it has caused so much controversy.

staticassertion 6y ago
Pretty sure Chrome has been using its own DNS resolver for ages. I don't see the issue either way.
- cookiengineer 6y ago
  > Pretty sure Chrome has been using its own DNS resolver for ages. That is correct, the IPv6 probes are embedded in the Chromium source, and are removed by the Ungoogled Chromium and/or Inox patchset [1]. [1] https://github.com/Eloston/ungoogled-chromium/tree/master/patches/core/inox-patchset https://github.com/Eloston/ungoogled-chromium/tree/master/pa...
  - silon42 6y ago
    How do they handle "enterprise" proxies that ban direct internet access? I probably should setup that at home.
    - cookiengineer 6y ago
      Chrome itself always requests HTTP first, except for HSTS and their own pinned certificates list which is actually shipped within the source code. That's also a major difference to Ungoogled Chromium, where UC will request "https:// https://..." by default if you just enter the domain. So in the case of Enterprise Proxies that have no locally force-installed cert to sniff on internet traffic will likely end up with HTTP-everywhere being used. But usually employers that encourage such bad practices also install their snakeoil MITM certificates locally.