3 ms·

DNS over http will eventually destroy DNS as we know it. Thanks Goog n co! DNS at the moment over 53/UDP is manageable and malleable. DNS over http is not and

DNS over http will eventually destroy DNS as we know it. Thanks Goog n co! DNS at the moment over 53/UDP is manageable and malleable. DNS over http is not and is up to your browser and hence a vendor. Life on the helpdesk will become rather more nasty and worse than it is now and we probably won't get tools to diagnose what is going on inside the browser, and so life for IT will be increasingly crap. I suggest we don't let the FAANGS run the world or the browser.

smbv 5y ago
DoH does not depend on a browser! Try this out with cURL curl --http2 -H 'accept: application/dns-json' "https://1.1.1.1/dns-query?name=cloudflare.com" --next --http2 -H 'accept: application/dns-json' "https://1.1.1.1/dns-query?name=example.com" There are DoH resolvers[0] that you can use that act as a "middleman" between your browser (configured to use a standard DNS server) and DoH (which is more secure and private) [0] https://github.com/DNSCrypt/dnscrypt-proxy https://github.com/DNSCrypt/dnscrypt-proxy
- southerntofu 5y ago
  I personally consider curl to be a CLI web browser.
tptacek 5y ago
This makes no sense at all. No part of DoH service involves a browser.
- egberts1 5y ago
  Correct, but on the other note, browsers do do involve the DoH.
windexh8er 5y ago
> DNS at the moment over 53/UDP is manageable and malleable. As for that malleable part... You always trust the networks you're on? Because my ISP, in the US, will inject JS into an insecure page load when I'm at 80% of my monthly data cap - I can only assume they're sniffing anything and everything in the clear. It's 2022, we shouldn't consider insecure transports viable. Zero trust, cliche or otherwise.
NavinF 5y ago
Is this satire? DNS is not malleable when every middlebox fucks with your queries. The protocol rusted in place a long time ago.
- hansel_der 5y ago
  there are still environments (countries, orgs, isps) were dns fuckery is kept low and the overhead of dot/doh is just wasted energy/time. not to say it is bad to have secure alternatives, but i think the internet will loose a lot of resiliancy and efficiency in the switch.
  - mkj 5y ago
    Exactly. DoH seems a fix to work around US ISP monopolies vs something actually desirable. Normal DNS has plenty of opportunities to work around bad providers and keep going.
zamadatix 5y ago
DNS over port 53 (udp/tcp actually) is no different from the manageability perspective, browsers could just have easily decided to skip the OS resolver with a TCP socket and just because it's HTTPS doesn't mean you cant still do resolution at the system level with it.

smbv 5y ago

DoH does not depend on a browser! Try this out with cURL curl --http2 -H 'accept: application/dns-json' "https://1.1.1.1/dns-query?name=cloudflare.com" --next --http2 -H 'accept: application/dns-json' "https://1.1.1.1/dns-query?name=example.com" There are DoH resolvers[0] that you can use that act as a "middleman" between your browser (configured to use a standard DNS server) and DoH (which is more secure and private) [0] https://github.com/DNSCrypt/dnscrypt-proxy https://github.com/DNSCrypt/dnscrypt-proxy

southerntofu 5y ago
I personally consider curl to be a CLI web browser.

tptacek 5y ago

This makes no sense at all. No part of DoH service involves a browser.

egberts1 5y ago
Correct, but on the other note, browsers do do involve the DoH.

windexh8er 5y ago

> DNS at the moment over 53/UDP is manageable and malleable. As for that malleable part... You always trust the networks you're on? Because my ISP, in the US, will inject JS into an insecure page load when I'm at 80% of my monthly data cap - I can only assume they're sniffing anything and everything in the clear. It's 2022, we shouldn't consider insecure transports viable. Zero trust, cliche or otherwise.

NavinF 5y ago

Is this satire? DNS is not malleable when every middlebox fucks with your queries. The protocol rusted in place a long time ago.

hansel_der 5y ago
there are still environments (countries, orgs, isps) were dns fuckery is kept low and the overhead of dot/doh is just wasted energy/time. not to say it is bad to have secure alternatives, but i think the internet will loose a lot of resiliancy and efficiency in the switch.
- mkj 5y ago
  Exactly. DoH seems a fix to work around US ISP monopolies vs something actually desirable. Normal DNS has plenty of opportunities to work around bad providers and keep going.

zamadatix 5y ago

DNS over port 53 (udp/tcp actually) is no different from the manageability perspective, browsers could just have easily decided to skip the OS resolver with a TCP socket and just because it's HTTPS doesn't mean you cant still do resolution at the system level with it.