3 ms·
There are a number of issues: 1) https:/<ip-addr>/ requires PKI a certificate type that is currently not in use. It is not clear how hard it is to have those ty
by phicoh 5y ago
There are a number of issues:
1) https:/<ip-addr>/ requires PKI a certificate type that is currently not in use. It is not clear how hard it is to have those types of certificates at a large scale.
2) https is more costly (in terms of network traffic and latency) than the current UDP-based protocol used for most DNS traffic.
3) There are quite a number of DNS middleboxes. In some sense they are a curse, but they also do useful things. Going to https makes that hard or impossible. Some people will be very unhappy.
4) It is not clear if your proposal will actually be more reliable. The current web has very little caching. DNS very much depends on caching. Once you add a caching layer to those https request, you make get into the same problems as described in the article.
- msravi 5y ago> https is more costly (in terms of network traffic and latency) than the current UDP-based protocol That's what I used to think. But somehow in practice, at least for me, using DoH seems to return responses much faster (DoH response takes about ~1/10th the time). Don't know why... Maybe UDP packets are being dropped in bursty traffic by the ISP?
- phicoh 5y agoIf I remember correctly, there is a study done by Mozilla, that showed that for the long tail, DoH is faster. For the common case it is slower. Nobody really knows why that is the case. Maybe some ISPs don't spend as much time optimizing UDP traffic compared to TCP.