4 ms·

From what I understand, one of the main issues with HTTP is that anyone in the middle can just change the content.

Spivak 5y ago
Which is exactly the problem DNSoTLS and DNSoHTTPS solve for DNS but there seems to be a lot more resistance on that front. I guess if a whole generation of ad-blockers has been based on Squid the tune would change I guess.
- raspyberr 5y ago
  Doesn't DoH/DoT centralise a decentralised protocol though? DoH is great but then you just get Cloudflare knowing all the DNS calls.
  - Spivak 5y ago
    No, but also yes. I mean DNS and DoT have the same relationship as HTTP and HTTPS but unlike the HTTPS rollout large projects aren't waiting around for the world to upgrade all their software and are just connecting to public DNS servers that speak DoT/H. DNS the global database is still just as decentralized but DNS thing you connect to do the actual work is now a little less so.
  - gsich 5y ago
    No, as everyone (including your ISP) can setup a DoH/DoT server. What is a problem though is a lack of discoverability. Right now you need to manually configure DoT/DoH. Or you are Mozilla and force the decision.
    - tialaramex 5y ago
      IIRC If you have Chrome in some cases it will auto-detect an upgrade. So e.g. you've told Chrome you want 8.8.8.8 DNS, that can do DoH, so Chrome will use DoH from 8.8.8.8 From Google's point of view even if they auto-upgrade you from your ISP's DNS server to an ISP-controlled DoH server this is a win because the DoH server paperwork (to get that upgrade to happen) requires the ISP to have sane rules for the new shiny DoH server whereas their old DNS server was whatever Corporate said it should be. e.g. DoH has an explicit censorship mechanism. The server can say "Nah, I can't tell you that" rather than pretending the answer for your query is either NXDOMAIN when it isn't, or worse some custom ISP chosen IP that isn't even a sane answer to the question you asked. This means (if DoH servers implement it, which Google requires to get that auto-upgrade behaviour) software using DoH can do much less crazy acrobatics to cope with censorship than with DNS. For example that bogus IP trick obviously can't work with HTTPS. So users get a weird HTTPS error, and it's unclear why they can't look at Clown Porn. Whereas with DoH the browser can say "You are not allowed to look at Clown Porn". Much better. [This is independent of the question of whether censoring Clown Porn is a good idea, sometimes, or always, which is not a technical problem and so out of scope for DoH. People are doing it, and we want to make that cause less technical problems]
      - gsich 5y ago
        Depending on ISP and country this can never be achived. Sometimes there are laws to filter out specific domains. But then again, should the browser be the authority to decide that? I think not.
        tialaramex 5y ago
        What exactly is it that "can never be achived" ? Technically as I explained DoH is content that you can't tell the client about some particular name, it just wants that expressed as an HTTP code (e.g. 403 Forbidden) rather than lying in your DNS answers. But over the longer term this is all irrelevant, the names are just a convention, legislators can write a law about names, but our laws aren't like Mother Nature's, people can just ignore them unless you deliver the will and resources to enforce them. Imagine if your legislature passes a law forbidding you from thinking about cats. Does it work? Do you stop thinking about cats? No? How will they make you? In technical terms the immediate future is Encrypted Client Hello (the names cease to be transported in plain text on the wire so an eavesdropper can't enforce a law about names) and then Oblivious DNS (the popular DNS server you're talking to such as 8.8.8.8 or 1.1.1.1 wouldn't know what question you asked, nor what the answer was, so it can't obey a law about names even if it wanted to).
- squiggleblaz 5y ago
  Once upon a time I used privoxy. It was a local HTTP non-caching proxy that let you process HTML requests and came with adblocking scripts you could enable. There were certain advantages to that model compared to current browser plugins. But I'm happy to pay no privoxy as a cost of HTTPS. There's reasons for that though: e.g. today, web browsers generally act as platforms that allow us to write ad blockers inside them. Will I be able to plug into my own DNSoTLS clients?

Which is exactly the problem DNSoTLS and DNSoHTTPS solve for DNS but there seems to be a lot more resistance on that front. I guess if a whole generation of ad-blockers has been based on Squid the tune would change I guess.

raspyberr 5y ago
Doesn't DoH/DoT centralise a decentralised protocol though? DoH is great but then you just get Cloudflare knowing all the DNS calls.
- Spivak 5y ago
  No, but also yes. I mean DNS and DoT have the same relationship as HTTP and HTTPS but unlike the HTTPS rollout large projects aren't waiting around for the world to upgrade all their software and are just connecting to public DNS servers that speak DoT/H. DNS the global database is still just as decentralized but DNS thing you connect to do the actual work is now a little less so.
- gsich 5y ago
  No, as everyone (including your ISP) can setup a DoH/DoT server. What is a problem though is a lack of discoverability. Right now you need to manually configure DoT/DoH. Or you are Mozilla and force the decision.
  - tialaramex 5y ago
    IIRC If you have Chrome in some cases it will auto-detect an upgrade. So e.g. you've told Chrome you want 8.8.8.8 DNS, that can do DoH, so Chrome will use DoH from 8.8.8.8 From Google's point of view even if they auto-upgrade you from your ISP's DNS server to an ISP-controlled DoH server this is a win because the DoH server paperwork (to get that upgrade to happen) requires the ISP to have sane rules for the new shiny DoH server whereas their old DNS server was whatever Corporate said it should be. e.g. DoH has an explicit censorship mechanism. The server can say "Nah, I can't tell you that" rather than pretending the answer for your query is either NXDOMAIN when it isn't, or worse some custom ISP chosen IP that isn't even a sane answer to the question you asked. This means (if DoH servers implement it, which Google requires to get that auto-upgrade behaviour) software using DoH can do much less crazy acrobatics to cope with censorship than with DNS. For example that bogus IP trick obviously can't work with HTTPS. So users get a weird HTTPS error, and it's unclear why they can't look at Clown Porn. Whereas with DoH the browser can say "You are not allowed to look at Clown Porn". Much better. [This is independent of the question of whether censoring Clown Porn is a good idea, sometimes, or always, which is not a technical problem and so out of scope for DoH. People are doing it, and we want to make that cause less technical problems]
    - gsich 5y ago
      Depending on ISP and country this can never be achived. Sometimes there are laws to filter out specific domains. But then again, should the browser be the authority to decide that? I think not.
      - tialaramex 5y ago
        What exactly is it that "can never be achived" ? Technically as I explained DoH is content that you can't tell the client about some particular name, it just wants that expressed as an HTTP code (e.g. 403 Forbidden) rather than lying in your DNS answers. But over the longer term this is all irrelevant, the names are just a convention, legislators can write a law about names, but our laws aren't like Mother Nature's, people can just ignore them unless you deliver the will and resources to enforce them. Imagine if your legislature passes a law forbidding you from thinking about cats. Does it work? Do you stop thinking about cats? No? How will they make you? In technical terms the immediate future is Encrypted Client Hello (the names cease to be transported in plain text on the wire so an eavesdropper can't enforce a law about names) and then Oblivious DNS (the popular DNS server you're talking to such as 8.8.8.8 or 1.1.1.1 wouldn't know what question you asked, nor what the answer was, so it can't obey a law about names even if it wanted to).
squiggleblaz 5y ago
Once upon a time I used privoxy. It was a local HTTP non-caching proxy that let you process HTML requests and came with adblocking scripts you could enable. There were certain advantages to that model compared to current browser plugins. But I'm happy to pay no privoxy as a cost of HTTPS. There's reasons for that though: e.g. today, web browsers generally act as platforms that allow us to write ad blockers inside them. Will I be able to plug into my own DNSoTLS clients?