4 ms·
Can you expand on this a little more? I do not understand the reasoning here
by rank0 5y ago
Can you expand on this a little more? I do not understand the reasoning here
- Kalium 5y agoThe tools to administer a home network, such as DNS blocking and DNS sinkholes, are the same tools nations use to administer their populaces. If the default in Firefox is to enable blocking and sinkholes for the home administrator's benefit, it will similarly be to the benefit of oppressive administrations. Home administrators who control their endpoints can turn DoH off with relative ease. By comparison, most governments cannot.
- swiley 5y agoIt would be nice if it would check the resolver config files (like the hosts file) with it enabled though. That was a really easy way to block harmful stuff or name things without requiring DNS. Having to choose between encryption and easy configuration is pretty poor UX.
- Kalium 5y agoNaively, that seems like something that could be a very useful configuration option to set! Though I can also see why you might default to having it off if you don't trust the host resolver very much in the country-administering-people case.
- swiley 5y agoYou have to trust the local OS config. No amount of clever application programming will ever let you get around that.
- ZeroCool2u 5y agoDoH makes widespread censorship and surveillance via intercepting plaintext DNS queries much more difficult. Of course, this is just one weapon in the arms race. It doesn't completely protect you, but every bit helps.
- JoshTriplett 5y agoThe vast majority of people don't run their own DNS server, or have any control over the DNS server they use. Most people use their ISP's or organization's DNS server, and have no control over it; instead, it's something used against them. In many cases, that DNS server may do some combination of tracking, redirection to ads, or other things that make it undesirable to use. DoH eliminates one of the last major unencrypted protocols on the Internet, and instead uses an encrypted protocol to talk exclusively to the intended server without the possibility of interception. If you want to talk to your ISP's DNS server, you're free to do so. But that should be your choice, not your ISP's.