4 ms·
This assumes that your software is doing what you asked it to do, not what some bigco or malware wanted it to do.
by Skunkleton 6y ago
This assumes that your software is doing what you asked it to do, not what some bigco or malware wanted it to do.
- silon42 6y agofirewall anything that doesn't go through your DNS server... at least thay way the malware will be obviously detectable.
- Spivak 6y agoBut DoH is just any other HTTP request. This is the downside of networks blocking everything except 80/443 outbound and browsers not supporting SRV records.
- goatinaboat 6y agoIf I remember correctly Chrome already ignores your DNS and does it’s own over HTTPS.
- Xylakant 6y agoI think you're misremembering. This is the most official documentation of the rollout plan for DoH that I can quickly ddg: https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https - in a gist: If the systems resolver is known to support DoH, the DNS query will get upgraded to DoH. That means chrome will still be using the configured systems resolver, but the connection will be encrypted. I think you're remembering what firefox is rolling out: Firefox will by default, if DoH is enabled for your country by default use a specific provider that subjects to additional privacy controls. However, firefox respects network level settings (for example a specific canary domain that should resolve) and will disable DoH, even if the default is enabled - unless again, the user has overwritten that in a setting. That means that the network owner is still in full control of the network-wide default and PiHole supports this approach. So a stock firefox in a network that uses pi-hole will not use DoH.
- goatinaboat 6y agoThanks for clarifying that!