4 ms·
I've hated DoH from the beginning, and not just because shoehorning everything into http is a silly idea, but as I suspected, we now live in a reality where you
by encom 6y ago
I've hated DoH from the beginning, and not just because shoehorning everything into http is a silly idea, but as I suspected, we now live in a reality where you have to keep an adblock-esque list of DoH servers. Now you have yet another internet arms race.
- shawnz 6y agoDNS based blocking was already trivially bypassable before DoH was ever conceived so I don't see how DoH or its use by browsers is at fault for that problem.
- encom 6y agoAs mentioned in TFA, configuring a firewall to redirect DNS traffic from broken or malicious software is also trivial. Or are you talking about hardcoding IP addresses?
- shawnz 6y agoThere are plenty of other alternatives. The simplest (but least flexible) would be hardcoding an IP of the final server. Somewhat more sophisticated would be hardcoding an IP to a server with a REST endpoint that returns the real final IP. (Basically just like what DoH does, but without calling it DoH). Even more sophisticated would be hiding the final IP on some kind of public web service like Twitter or Github.
- SAI_Peregrinus 6y agoNote that malware of various sorts has done all of this for years. It used to be reasonably common to get command/control server info via IRC, basically DNS over IRC. DNS blocking has never been an effective network management strategy, and it never will be.
- folmar 6y agoYou can/should block connections to IPs which were not returned by DNS recently.