12 ms·

Operating systems can and should implement DoH, not every single individual application (which can then decide to use poorly chosen servers and will have to get

by saurik 6y ago

Operating systems can and should implement DoH, not every single individual application (which can then decide to use poorly chosen servers and will have to get updated in the future for whatever the next spec might be). That the people who make operating systems put so little effort into this stuff that application developers feel they need to take this into their own hands is a travesty :/. (This is particularly annoying given that it is already the case on every operating system that if you want to use DoH and choose your DNS server you can easily do that as long as the software in question lets you by using the system resolver; it makes absolutely no sense to embed and hardcode this functionality into every app.) (For more detailed complaints and arguments on this topic, I wrote a long comment about it a year ago.) https://news.ycombinator.com/item?id=21701808 https://news.ycombinator.com/item?id=21701808

Santosh83 6y ago
Is there no space between "operating system" and "applications"? How about a group of established hackers with expertise get together and create an open source, system-level, DoH service which can be made easy to install on the different mainstream OS (Windows installers/store/chocolatey, MacOS app store, Linux repositories, Google Play)? Is this asking for too much coordination among parties with disparate interests?
- saurik 6y ago
  (I am wondering if the parenthetical I added a minute after I left my original comment wasn't there when you left this reply, but I go into detail on this topic in the linked comment: it already is the case that on every operating system you can do this and in fact people already have... as an example, if you want to use Cloudflare DoH, install their app!)
- octoberfranklin 6y ago
  That already exists, it's called dnscrypt-proxy.
simias 6y ago
I agree with you but I just... gave up. The web ate the net, the browser is the new OS. It's silly, it's lazy, it's inefficient, it's everything I dislike about software engineering but at this point it feels like preaching in the wind. I just try to ignore it, keep writing low level code and if someday I can't find a programming job outside of web technologies anymore I'll just become a shepherd in the mountains or something. I'll make cheese.
- saurik 6y ago
  You made me feel a lot better, actually (I'm serious). <3 Maybe one day I will open the sandwich shop I sometimes threaten to leave software for, and I can buy your cheese. (I know that is a horrible business, but there was a great article I read 15 or so years ago about a developer quitting software to open a hot dog stand, and he seemed so happy about it.)
  - rsj_hn 6y ago
    Both of you have renewed my faith in humanity. It means a lot to run into a kindred spirit.
- basicneo 6y ago
  I'm also a bit disheartened by the direction of the web. Emacs has been a decent haven for me in my search for privacy, interopability, programmability: my user agent.
- dhimes 6y ago
  It'll probably bounce back. We've been here before, when computing was centralized and everybody logged into the mainframe. Then it turned out that to have independent computers gave users a huge advantage and helped control costs. Now, we're back to centralized systems- and I couldn't believe it when I watched the shift: What first caught my attention that this could get serious was gmail. Then g-office (whatever they called it then). Meanwhile a whole host of other services started. I was developing a desktop app because I still wasn't convinced that people wouldn't prefer having their software and data "in hand," as it were. I expect a new advantage will emerge and we'll want our machines and data back.
oefrha 6y ago
macOS 11 and iOS 14 already added support for DoT and DoH. See https://github.com/paulmillr/encrypted-dns https://github.com/paulmillr/encrypted-dns.
- saurik 6y ago
  As did Windows (I saw this as I read over the last six months of changelogs a few days ago)... so why exactly is this a thing Firefox is doing again? :/
  - mmwelt 6y ago
    Right, it looks like it should be coming soon to Win10 2021H1: https://www.bleepingcomputer.com/news/security/microsoft-adds-windows-10-dns-over-https-settings-section/ https://www.bleepingcomputer.com/news/security/microsoft-add...
  - shawnz 6y ago
    It works in Firefox today, whereas Microsoft wasn't even talking about DoH before Mozilla started pushing it.
- gruez 6y ago
  Same for android https://blog.cloudflare.com/enable-private-dns-with-1-1-1-1-on-android-9-pie/ https://blog.cloudflare.com/enable-private-dns-with-1-1-1-1-...
- nitrohorse 6y ago
  Shameless plug: DoH configuration profiles for several more DNS providers can be found here: https://gitlab.com/nitrohorse/ios14-encrypted-dns-mobileconfigs/-/tree/master/mobileconfig https://gitlab.com/nitrohorse/ios14-encrypted-dns-mobileconf...
pimeys 6y ago
Can DoH be used to bypass home DNS servers, such as the pihole?
- CarelessExpert 6y ago
  Because DoH is implemented in the browser and bypasses the OS resolver configuration, it will specifically break things like pihole. The correct solution is a) do this at the OS so users can configure the behaviour, b) add support to pihole or similar for making DoH requests out to somewhere like CloudFlare, c) also add support for receiving DoH requests for those people using a pihole over untrusted networks.
  - pimeys 6y ago
    That's what I've figured out too. A while ago I started blocking port 443 to known DoH servers to prevent any machine from internal network bypassing the pihole. I expect televisions, smart lights and many other IoT devices to start using DoH to be able to track the users with pihole installed...
    - Datenstrom 6y ago
      Is there a comprehensive list to block somewhere? I would like to do the same.
      - LinuxBender 6y ago
        Comprehensive, no. There are growing numbers of git repos of DoH names. [1] [2] [1] - https://github.com/bambenek/block-doh https://github.com/bambenek/block-doh [2] - https://github.com/Sekhan/TheGreatWall https://github.com/Sekhan/TheGreatWall
        deleted 6y ago
        [deleted]
    - shawnz 6y ago
hannob 6y ago
> Operating systems can and should implement DoH I see a comment like this basically every time something about DoH comes up. What I haven't seen: A plan how this should be implemented, a proposal to OS vendors and developers, ideally with patches. This raises a few questions. How should the OS decide which server to use? It obviously can't be DHCP, because that's not a secure thing to begin with. How does this interact with things like captive portals if you have a disconnect between the DNS functionality and the gui application? Do you have good answers for these?
- detaro 6y ago
  The questions also apply to browser implementations, don't they?
  - hannob 6y ago
    Some do, some don't. For example the captive portal issue, browsers can try to connect without DoH to a captive portal test page and provide a special non-DoH login tab. You can't do that on the OS level. You could create some interaction between the browser and the OS, but that's nontrivial and needs a solution.
    - Spivak 6y ago
      Sure you can! iOS, Android, and GNOME/NetworkManager just open up a webview to handle the portal. I’m sure others do too I just can’t say for certain.
      - zinekeller 6y ago
        Windows: Network Connectivity Status Indicator (NCSI) will ping www.msftncsi.com on older versions (8.1 and lower) or www.msftconnecttest.com on newer versions (10), and then prompts to open the web browser. Since IE/Edge will be always there, it works. macOS: same as iOS (a dedicated window pinging www.apple.com). Firefox: Detects detectportal.firefox.com and asks the user if the want to access the captive portal. Android: Detects connectivitycheck.android.com on Android 5 and connectivitycheck.gstatic.com on Android 6+. I don't know if it applies to all phones, but I'm sure (that except for phones on Android One or Nexus/Pixel) Samsung also does this for phones outside of China.
josephcsible 6y ago
> Operating systems can and should implement DoH, not every single individual application I agree that it would be better for DoH to be done in the operating system than in applications, but the reality is that today, operating systems don't do this, and it's better to do DoH in applications than to not do it at all.
- vetinari 6y ago
  DoT or DoH are supported in Android (9+), iOS (14+), Linux (systemd-resolved, stubby, other resolvers), macOS (11+) and coming to Windows in 2021. So what exactly having separate implementation in apps achieves? That is, except for the possibility of mismatched configuration between such applications and the OS, leading to hard to debug problems?
  - josephcsible 6y ago
    DoT is not DoH. Since it uses its own protocol and port, it's easy for networks that want to do censorship or surveillance to block it. Of those platforms that do support DoH, how many of them have it on by default, rather than requiring the user to know it exists and turn it on?
    - vetinari 6y ago
      No DoT is not DoH. They both are blockable; DoH servers must use either well-known IPs, or to be bootstrapped by the plain DNS. First one you can block as well, the second you can filter. > Of those platforms that do support DoH, how many of them have it on by default, rather than requiring the user to know it exists and turn it on? Being off by default is a feature. Those road warriors that do not trust their coffee shops can turn it on if they want it, but elsewhere it causes nothing but trouble.
      - josephcsible 6y ago
        > DoH servers must use either well-known IPs, or to be bootstrapped by the plain DNS. The easy solution is for the well-kmown IP to be in the same pool that a major CDN uses, so it can't be blocked without major collateral damage. As for being off by default, that's absolutely not a feature. Basically nobody who's non-technical will ever turn this on, even though it will improve privacy for no downside for most people. What "trouble" does it cause anyway?
detaro 6y ago
From your linked comment, I would disagree with "web browsers decided that they didn't like end users being able to have this control". They don't like the default that requires users to make an active change to the get "upgraded", without ever being prompted so, not that the user can control it, and believe that in that situation, giving it a push is justified. See e.g. Chrome's policy: it checks if the configured DNS server also has a known DoH option, and if yes uses that.
- danShumway 6y ago
  Right, it's not about taking away user control, because users have the same exact level of control that they had before. Firefox/Chrome still offer all of the same customization options, and you can even turn off DoH entirely. What it is about is that the defaults for pretty much all OSes are bad. Maybe if we lived in a world where DoH was shipping by default enabled in Linux/Mac/Windows and set to something private like Cloudflare, it would make sense not to even provide browser options at all. But as it stands, the current solution (while a little unintuitive and hacky) give you the best of both worlds. If you're a normal user, you get secure defaults. If you're a power user, you can go into Firefox and point at your own DoH provider, or turn off DoH entirely if that's what you want. And if you're an admin deploying Firefox on a network, you can deploy it with a custom profile that sets its internal DoH/DNS settings to whatever you want.
- eikenberry 6y ago
  > See e.g. Chrome's policy: it checks if the configured DNS server also has a known DoH option Do you know of any references that describe how it determines if the DNS service offers a DoH option or not? I can't find anything more than vague descriptions.
  - detaro 6y ago
    They maintain a list. See https://docs.google.com/document/d/128i2YTV2C7T6Gr3I-81zlQ-_Lprnsp24qzy_20Z1Psw/edit https://docs.google.com/document/d/128i2YTV2C7T6Gr3I-81zlQ-_... for information about the inclusion process and criteria and for the list in source code form: https://source.chromium.org/chromium/chromium/src/+/master:net/dns/public/doh_provider_entry.cc https://source.chromium.org/chromium/chromium/src/+/master:n...
Someone1234 6y ago
Why not both? You're essentially arguing that more flexibility is bad without real justification. Per application DNS/routing (split routing) is something most Operating Systems don't support today (or setting it up is incredibly complex). Giving this kind of flexibility might open up a future where a competitor to ICANN-DNS could exist, and users could dogfood it via single browser/window/tab instead of having an all-or-nothing situation as per today. But let's throw out incredible new capabilities that allow user flexibility/choice because it is different to how it was historically done.
zerolog 6y ago
Full Linux system DoH/DoT resolver: https://firejaildns.wordpress.com/ https://firejaildns.wordpress.com/ and a survey of public DoH servers: https://firejaildns.wordpress.com/2020/09/22/a-survey-of-public-dns-over-https-servers/ https://firejaildns.wordpress.com/2020/09/22/a-survey-of-pub...
n0nc3 6y ago
Is it possible to add root CA's for DoH only, so that I can intercept requests at the gateway and terminate the TLS connection there? Can anyone link to the part of the source tree containing their DoH implementation? I would like to test whether it is possible to distinguish Firefox DoH from unbound.
1vuio0pswjnm7 6y ago
To summarise, there is nothing inherently wrong with DoH (serving DNS RRs via HTTPS), but there is something inherently wrong with enabling applications to ignore the user's OS DNS settings by default and perform their own DNS resolution, whether via DoH or otherwise.
- ohazi 6y ago
  We should assume that this ship has already sailed for user-hostile applications and devices, and start working on mitigations. i.e. Smart TVs will do this to get around pi-hole style ad blocking.
  - 1vuio0pswjnm7 6y ago
    Will these user-hostile appllications and devices allow you to set the gateway? As long as you can use an OS of your choice on the gateway you should be able to control routing, including DNS.

by saurik 6y ago

Santosh83 6y ago

Is there no space between "operating system" and "applications"? How about a group of established hackers with expertise get together and create an open source, system-level, DoH service which can be made easy to install on the different mainstream OS (Windows installers/store/chocolatey, MacOS app store, Linux repositories, Google Play)? Is this asking for too much coordination among parties with disparate interests?

saurik 6y ago
(I am wondering if the parenthetical I added a minute after I left my original comment wasn't there when you left this reply, but I go into detail on this topic in the linked comment: it already is the case that on every operating system you can do this and in fact people already have... as an example, if you want to use Cloudflare DoH, install their app!)
octoberfranklin 6y ago
That already exists, it's called dnscrypt-proxy.

simias 6y ago

I agree with you but I just... gave up. The web ate the net, the browser is the new OS. It's silly, it's lazy, it's inefficient, it's everything I dislike about software engineering but at this point it feels like preaching in the wind. I just try to ignore it, keep writing low level code and if someday I can't find a programming job outside of web technologies anymore I'll just become a shepherd in the mountains or something. I'll make cheese.

saurik 6y ago
You made me feel a lot better, actually (I'm serious). <3 Maybe one day I will open the sandwich shop I sometimes threaten to leave software for, and I can buy your cheese. (I know that is a horrible business, but there was a great article I read 15 or so years ago about a developer quitting software to open a hot dog stand, and he seemed so happy about it.)
- rsj_hn 6y ago
  Both of you have renewed my faith in humanity. It means a lot to run into a kindred spirit.
basicneo 6y ago
I'm also a bit disheartened by the direction of the web. Emacs has been a decent haven for me in my search for privacy, interopability, programmability: my user agent.
dhimes 6y ago
It'll probably bounce back. We've been here before, when computing was centralized and everybody logged into the mainframe. Then it turned out that to have independent computers gave users a huge advantage and helped control costs. Now, we're back to centralized systems- and I couldn't believe it when I watched the shift: What first caught my attention that this could get serious was gmail. Then g-office (whatever they called it then). Meanwhile a whole host of other services started. I was developing a desktop app because I still wasn't convinced that people wouldn't prefer having their software and data "in hand," as it were. I expect a new advantage will emerge and we'll want our machines and data back.

oefrha 6y ago

macOS 11 and iOS 14 already added support for DoT and DoH. See https://github.com/paulmillr/encrypted-dns https://github.com/paulmillr/encrypted-dns.

saurik 6y ago
As did Windows (I saw this as I read over the last six months of changelogs a few days ago)... so why exactly is this a thing Firefox is doing again? :/
- mmwelt 6y ago
  Right, it looks like it should be coming soon to Win10 2021H1: https://www.bleepingcomputer.com/news/security/microsoft-adds-windows-10-dns-over-https-settings-section/ https://www.bleepingcomputer.com/news/security/microsoft-add...
- shawnz 6y ago
  It works in Firefox today, whereas Microsoft wasn't even talking about DoH before Mozilla started pushing it.
gruez 6y ago
Same for android https://blog.cloudflare.com/enable-private-dns-with-1-1-1-1-on-android-9-pie/ https://blog.cloudflare.com/enable-private-dns-with-1-1-1-1-...
nitrohorse 6y ago
Shameless plug: DoH configuration profiles for several more DNS providers can be found here: https://gitlab.com/nitrohorse/ios14-encrypted-dns-mobileconfigs/-/tree/master/mobileconfig https://gitlab.com/nitrohorse/ios14-encrypted-dns-mobileconf...

pimeys 6y ago

Can DoH be used to bypass home DNS servers, such as the pihole?

CarelessExpert 6y ago
Because DoH is implemented in the browser and bypasses the OS resolver configuration, it will specifically break things like pihole. The correct solution is a) do this at the OS so users can configure the behaviour, b) add support to pihole or similar for making DoH requests out to somewhere like CloudFlare, c) also add support for receiving DoH requests for those people using a pihole over untrusted networks.
- pimeys 6y ago
  That's what I've figured out too. A while ago I started blocking port 443 to known DoH servers to prevent any machine from internal network bypassing the pihole. I expect televisions, smart lights and many other IoT devices to start using DoH to be able to track the users with pihole installed...
  - Datenstrom 6y ago
    Is there a comprehensive list to block somewhere? I would like to do the same.
    - LinuxBender 6y ago
      Comprehensive, no. There are growing numbers of git repos of DoH names. [1] [2] [1] - https://github.com/bambenek/block-doh https://github.com/bambenek/block-doh [2] - https://github.com/Sekhan/TheGreatWall https://github.com/Sekhan/TheGreatWall
      - deleted 6y ago
        [deleted]
  - shawnz 6y ago

hannob 6y ago

> Operating systems can and should implement DoH I see a comment like this basically every time something about DoH comes up. What I haven't seen: A plan how this should be implemented, a proposal to OS vendors and developers, ideally with patches. This raises a few questions. How should the OS decide which server to use? It obviously can't be DHCP, because that's not a secure thing to begin with. How does this interact with things like captive portals if you have a disconnect between the DNS functionality and the gui application? Do you have good answers for these?

detaro 6y ago
The questions also apply to browser implementations, don't they?
- hannob 6y ago
  Some do, some don't. For example the captive portal issue, browsers can try to connect without DoH to a captive portal test page and provide a special non-DoH login tab. You can't do that on the OS level. You could create some interaction between the browser and the OS, but that's nontrivial and needs a solution.
  - Spivak 6y ago
    Sure you can! iOS, Android, and GNOME/NetworkManager just open up a webview to handle the portal. I’m sure others do too I just can’t say for certain.
    - zinekeller 6y ago
      Windows: Network Connectivity Status Indicator (NCSI) will ping www.msftncsi.com on older versions (8.1 and lower) or www.msftconnecttest.com on newer versions (10), and then prompts to open the web browser. Since IE/Edge will be always there, it works. macOS: same as iOS (a dedicated window pinging www.apple.com). Firefox: Detects detectportal.firefox.com and asks the user if the want to access the captive portal. Android: Detects connectivitycheck.android.com on Android 5 and connectivitycheck.gstatic.com on Android 6+. I don't know if it applies to all phones, but I'm sure (that except for phones on Android One or Nexus/Pixel) Samsung also does this for phones outside of China.

josephcsible 6y ago

> Operating systems can and should implement DoH, not every single individual application I agree that it would be better for DoH to be done in the operating system than in applications, but the reality is that today, operating systems don't do this, and it's better to do DoH in applications than to not do it at all.

vetinari 6y ago
DoT or DoH are supported in Android (9+), iOS (14+), Linux (systemd-resolved, stubby, other resolvers), macOS (11+) and coming to Windows in 2021. So what exactly having separate implementation in apps achieves? That is, except for the possibility of mismatched configuration between such applications and the OS, leading to hard to debug problems?
- josephcsible 6y ago
  DoT is not DoH. Since it uses its own protocol and port, it's easy for networks that want to do censorship or surveillance to block it. Of those platforms that do support DoH, how many of them have it on by default, rather than requiring the user to know it exists and turn it on?
  - vetinari 6y ago
    No DoT is not DoH. They both are blockable; DoH servers must use either well-known IPs, or to be bootstrapped by the plain DNS. First one you can block as well, the second you can filter. > Of those platforms that do support DoH, how many of them have it on by default, rather than requiring the user to know it exists and turn it on? Being off by default is a feature. Those road warriors that do not trust their coffee shops can turn it on if they want it, but elsewhere it causes nothing but trouble.
    - josephcsible 6y ago
      > DoH servers must use either well-known IPs, or to be bootstrapped by the plain DNS. The easy solution is for the well-kmown IP to be in the same pool that a major CDN uses, so it can't be blocked without major collateral damage. As for being off by default, that's absolutely not a feature. Basically nobody who's non-technical will ever turn this on, even though it will improve privacy for no downside for most people. What "trouble" does it cause anyway?

detaro 6y ago

From your linked comment, I would disagree with "web browsers decided that they didn't like end users being able to have this control". They don't like the default that requires users to make an active change to the get "upgraded", without ever being prompted so, not that the user can control it, and believe that in that situation, giving it a push is justified. See e.g. Chrome's policy: it checks if the configured DNS server also has a known DoH option, and if yes uses that.

danShumway 6y ago
Right, it's not about taking away user control, because users have the same exact level of control that they had before. Firefox/Chrome still offer all of the same customization options, and you can even turn off DoH entirely. What it is about is that the defaults for pretty much all OSes are bad. Maybe if we lived in a world where DoH was shipping by default enabled in Linux/Mac/Windows and set to something private like Cloudflare, it would make sense not to even provide browser options at all. But as it stands, the current solution (while a little unintuitive and hacky) give you the best of both worlds. If you're a normal user, you get secure defaults. If you're a power user, you can go into Firefox and point at your own DoH provider, or turn off DoH entirely if that's what you want. And if you're an admin deploying Firefox on a network, you can deploy it with a custom profile that sets its internal DoH/DNS settings to whatever you want.
eikenberry 6y ago
> See e.g. Chrome's policy: it checks if the configured DNS server also has a known DoH option Do you know of any references that describe how it determines if the DNS service offers a DoH option or not? I can't find anything more than vague descriptions.
- detaro 6y ago
  They maintain a list. See https://docs.google.com/document/d/128i2YTV2C7T6Gr3I-81zlQ-_Lprnsp24qzy_20Z1Psw/edit https://docs.google.com/document/d/128i2YTV2C7T6Gr3I-81zlQ-_... for information about the inclusion process and criteria and for the list in source code form: https://source.chromium.org/chromium/chromium/src/+/master:net/dns/public/doh_provider_entry.cc https://source.chromium.org/chromium/chromium/src/+/master:n...

Someone1234 6y ago

Why not both? You're essentially arguing that more flexibility is bad without real justification. Per application DNS/routing (split routing) is something most Operating Systems don't support today (or setting it up is incredibly complex). Giving this kind of flexibility might open up a future where a competitor to ICANN-DNS could exist, and users could dogfood it via single browser/window/tab instead of having an all-or-nothing situation as per today. But let's throw out incredible new capabilities that allow user flexibility/choice because it is different to how it was historically done.

zerolog 6y ago

Full Linux system DoH/DoT resolver: https://firejaildns.wordpress.com/ https://firejaildns.wordpress.com/ and a survey of public DoH servers: https://firejaildns.wordpress.com/2020/09/22/a-survey-of-public-dns-over-https-servers/ https://firejaildns.wordpress.com/2020/09/22/a-survey-of-pub...

n0nc3 6y ago

Is it possible to add root CA's for DoH only, so that I can intercept requests at the gateway and terminate the TLS connection there? Can anyone link to the part of the source tree containing their DoH implementation? I would like to test whether it is possible to distinguish Firefox DoH from unbound.

1vuio0pswjnm7 6y ago

To summarise, there is nothing inherently wrong with DoH (serving DNS RRs via HTTPS), but there is something inherently wrong with enabling applications to ignore the user's OS DNS settings by default and perform their own DNS resolution, whether via DoH or otherwise.

ohazi 6y ago
We should assume that this ship has already sailed for user-hostile applications and devices, and start working on mitigations. i.e. Smart TVs will do this to get around pi-hole style ad blocking.
- 1vuio0pswjnm7 6y ago
  Will these user-hostile appllications and devices allow you to set the gateway? As long as you can use an OS of your choice on the gateway you should be able to control routing, including DNS.