4 ms·

As a user, what is the increased administration burden for http? Are you referring to the whole CA system being an untrustworthy racket?

by ori_b 6y ago

shawnz 6y ago
As a user, what is the increased admin burden for using DoH, assuming you don't want to implement network level content blocking? Basically none. What is the burden for using HTTPS assuming you DO want to be able to inspect and block HTTPS resources at a network level? Very extensive compared to plain HTTP.
- ori_b 6y ago
  Make the libc resolver do DoH, and drop it from firefox,half the problems go away. The other half of the problems are around defaulting to allowing cloudflare to inspect your traffic, instead of comcast. And the lack of integrity and encryption for the rest of the DNS infrastructure. And the expansion of the complex and difficult to secure x509 certificate regime which we should be moving away from. (Something like gossamer seems to be a big step in the right direction) I want encrypted dns, just not a half-assed hack of an implementation that is going to be impossible to fix once deployed.
  - shawnz 6y ago
    I agree with you there, OS vendors should be implementing DoH. Thankfully they are finally getting around to it after pressure from browsers. Regarding the rest of the DNS infrastructure, I agree there is more work to be done. But I see DoH/DoT/etc as a necessary step and not a "half-assed implementation" that needs to be "fixed".
- pbhjpbhj 6y ago
  >assuming you don't want to implement network level content blocking? // Who doesn't want that? I have a pihole (and use OpenDNS). Bypassed it all yesterday, as an experiment, to look at an anime site my eldest started using and immediately was hit with a pretty impressive and convincing phishing attempt (mimicking my ISP). Pretty much all of us on HN seem to use some form of 'DNS' based filtering (pihole, or even just hosts file). UK ISPs offer DNS based filtering as a default (and have to filter some pages by law, and are encouraged to filter others [through threat of law]) ... but a lot of people want that, many many families, schools, businesses. Certainly I don't want it to be easier for advertising and malware to bypass my chosen DNS-style filtering.
  - shawnz 6y ago
    I don't want it and I don't recommend it to my peers. I also don't think DNS-based content blocking is really as popular as the PiHole community would say. I use client-side content blocking like uBO instead, which I imagine is overwhelmingly the more common solution, and it is also more powerful and effective (and easier to use). UK ISPs having mandatory DNS blocking is a great example of why DoH is important. The user should decide what they want, not the network operator. Perhaps widespread use of encryption technologies means I can't do content blocking on proprietary appliances like the Chromecast for example. I think that's a necessary evil and I just won't buy such an appliance if it's that big of a problem. Only legislation can really fix that kind of problem anyway, it doesn't really matter whether Firefox implements DoH or not.

As a user, what is the increased administration burden for http? Are you referring to the whole CA system being an untrustworthy racket?

by ori_b 6y ago

As a user, what is the increased administration burden for http? Are you referring to the whole CA system being an untrustworthy racket?

shawnz 6y ago

As a user, what is the increased admin burden for using DoH, assuming you don't want to implement network level content blocking? Basically none. What is the burden for using HTTPS assuming you DO want to be able to inspect and block HTTPS resources at a network level? Very extensive compared to plain HTTP.

ori_b 6y ago
Make the libc resolver do DoH, and drop it from firefox,half the problems go away. The other half of the problems are around defaulting to allowing cloudflare to inspect your traffic, instead of comcast. And the lack of integrity and encryption for the rest of the DNS infrastructure. And the expansion of the complex and difficult to secure x509 certificate regime which we should be moving away from. (Something like gossamer seems to be a big step in the right direction) I want encrypted dns, just not a half-assed hack of an implementation that is going to be impossible to fix once deployed.
- shawnz 6y ago
  I agree with you there, OS vendors should be implementing DoH. Thankfully they are finally getting around to it after pressure from browsers. Regarding the rest of the DNS infrastructure, I agree there is more work to be done. But I see DoH/DoT/etc as a necessary step and not a "half-assed implementation" that needs to be "fixed".
pbhjpbhj 6y ago
>assuming you don't want to implement network level content blocking? // Who doesn't want that? I have a pihole (and use OpenDNS). Bypassed it all yesterday, as an experiment, to look at an anime site my eldest started using and immediately was hit with a pretty impressive and convincing phishing attempt (mimicking my ISP). Pretty much all of us on HN seem to use some form of 'DNS' based filtering (pihole, or even just hosts file). UK ISPs offer DNS based filtering as a default (and have to filter some pages by law, and are encouraged to filter others [through threat of law]) ... but a lot of people want that, many many families, schools, businesses. Certainly I don't want it to be easier for advertising and malware to bypass my chosen DNS-style filtering.
- shawnz 6y ago
  I don't want it and I don't recommend it to my peers. I also don't think DNS-based content blocking is really as popular as the PiHole community would say. I use client-side content blocking like uBO instead, which I imagine is overwhelmingly the more common solution, and it is also more powerful and effective (and easier to use). UK ISPs having mandatory DNS blocking is a great example of why DoH is important. The user should decide what they want, not the network operator. Perhaps widespread use of encryption technologies means I can't do content blocking on proprietary appliances like the Chromecast for example. I think that's a necessary evil and I just won't buy such an appliance if it's that big of a problem. Only legislation can really fix that kind of problem anyway, it doesn't really matter whether Firefox implements DoH or not.