2 ms·
Nothing stops you running a recursive resolver on your local machine. DoH is great too (provided you trust the endpoint), but what I really want is a chain of t
by quotemstr 5y ago
Nothing stops you running a recursive resolver on your local machine. DoH is great too (provided you trust the endpoint), but what I really want is a chain of trust extending from the root to the individual DNS record, and DoH by itself doesn't give me that. But DoH sure is great for further centralizing control over internet name resolution in a few hands!
- tptacek 5y agoNothing stops you from behaving like a DNS server, that's true. But nobody is going to forklift in error-prone new DNS security infrastructure just so a couple hundred Linux nerds (hey, it me) can have a new toy to play with. What's not going to happen is for every phone in the world to run its own recursor, and that's what needs to happen for DNSSEC to work on the last mile. There are lots of problems with DNSSEC, not just this one. But if you want to have a discussion that involves things DNSSEC might help on the Internet, it's best not to start with coffee shop attacks, which are the problem DNSSEC is literally least suited to solve --- in fact, practically designed not to solve. The coffee shop problem --- or, more accurately, the wide-scale equivalent problem of ISPs behaving like malicious coffee shops --- is exactly the problem DoH addresses.