4 ms·
For what it's worth, this does work. For now. The main issue is if it gets sold later, or assigned by RFC. As an example, more than one company I've worked for
by minimaul 5y ago
For what it's worth, this does work. For now.
The main issue is if it gets sold later, or assigned by RFC. As an example, more than one company I've worked for used .dev as a TLD for their dev environments, with local DNS to override it. Once google bought .dev, this meant that:
- we couldn't access anything Google put on .dev
- suddenly, all of our test sites had HTTPS forced, because .dev was HSTS preloaded by Google
The point here is that an unexpected change that you might not be aware is coming can break your setup in ways that are awkward to resolve - eg HSTS preloading means that you can no longer access non HTTPS endpoints unless you do it by IP and that leads to a frustrating afternoon - and it's inevitably always when you don't want it.
Like it or not, ICANN operates the DNS space. There's a proper way to get your own piece of this space, and you can run home or business networks under your own piece and you have a guarantee that no one will break you - because it's yours.
(edited for formatting)
- minimaul 5y agoAnd as an extra point - can you actually guarantee that all your DNS lookups hit your DNS server first? That's harder than it sounds, with more and more apps implementing their own DNS over HTTPS clients - Firefox does it for instance, so does Chrome.
- k4rli 5y agoHow come DNS requests initiated from Chrome/FF still reach my pi-hole and get blocked just fine? I would think this browsers' solution would have prevented that.
- willis936 5y agoIf you run your own router: yes up to a certain point. https://www.myhelpfulguides.com/2018/07/30/redirect-hard-coded-dns-to-pi-hole-using-edgerouter-x/ https://www.myhelpfulguides.com/2018/07/30/redirect-hard-cod... Afaik nobody has a fix for the client hostility that DoH brings to the table.
- Spivak 5y agoI think the fact that I can slurp, block, and/or modify all the unencrypted DNS requests of every device on my network to be the hostile thing. Yes we have all abused unencrypted DNS to take the littlest bit of control back from hostile devices but we’re the minority of a minority who lose out in this situation where everyone else is now shielded from random sketchy Wi-Fi hotspots, and their ISP.
- willis936 5y agoI think not giving the option to configure DNS servers or outright ignoring configured DNS servers to be incredibly hostile. Redirecting unencrypted DNS traffic is a defensive escalation. Putting your arms up as a fist comes at your face is not a hostile action.
- Wowfunhappy 5y agoHonestly, my initial reaction to that is "well, this is a great example why I don't like Firefox's DNS-over-HTTPS thing." Firefox should follow the OS's DNS settings, not make assumptions about how I run my network. But a great counterargument would be "too bad, Firefox and now Google are doing it anyway, you lost and this is the world we live in, so deal with it." And, you'd have a point!