3 ms·

I prefer to avoid Mozilla as much as Google. I use DoT (which I think is a better alternative than DoH) against uncensoreddns.org and Quad9.

josephcsible 5y ago
Can you elaborate on why you think DoT is better than DoH? Aside from DoT being easier for an adversary to block (which is really bad since blocking it forces a silent fallback to insecure DNS), what material differences are there between them?
- daneel_w 5y ago
  I think it's a better choice because it's less complex and avoids "useful features". Bert Hubert goes through most of the points in this talk: https://www.youtube.com/watch?v=pjin3nv8jAo https://www.youtube.com/watch?v=pjin3nv8jAo > Aside from DoT being easier for an adversary to block HTTPS is also TLS. On the surface of things it's just a matter of two different standardized ports. > ...since blocking it forces a silent fallback to insecure DNS That depends entirely on your setup.
tialaramex 5y ago
Why do you think DoT is better? Notable features DoH gets by being HTTP include: An extra (encrypted) configuration point in the form of a pathname, DNS privacy servers can use this to offer you a distinct feature set e.g. maybe you want them to blackhole ads but not porn, another user wants no porn 'cos they're worried about their kids, and I want full fat. NextDNS offers this I believe. Error messages aren't restricted to what can be expressed in DNS itself. So instead of NXDOMAIN the error can tell me myblanket.example was blocked because it's an advertising source, or that gooogle.example wasn't found but maybe it's a typo and I should try google.example ?
- daneel_w 5y ago
  > Why do you think DoT is better? I prefer DoT over DoH. I'm not getting into a discussion of "technically better". > ...DNS privacy servers can use this to offer you a distinct feature set e.g. maybe you want them to blackhole ads but not porn No, I don't want any that. I want DNS between my resolver and the remote to do only what it's intended for. I don't want that specific leg of the communication to involve any features, bells or whistles.

josephcsible 5y ago

Can you elaborate on why you think DoT is better than DoH? Aside from DoT being easier for an adversary to block (which is really bad since blocking it forces a silent fallback to insecure DNS), what material differences are there between them?

daneel_w 5y ago
I think it's a better choice because it's less complex and avoids "useful features". Bert Hubert goes through most of the points in this talk: https://www.youtube.com/watch?v=pjin3nv8jAo https://www.youtube.com/watch?v=pjin3nv8jAo > Aside from DoT being easier for an adversary to block HTTPS is also TLS. On the surface of things it's just a matter of two different standardized ports. > ...since blocking it forces a silent fallback to insecure DNS That depends entirely on your setup.

tialaramex 5y ago

Why do you think DoT is better? Notable features DoH gets by being HTTP include: An extra (encrypted) configuration point in the form of a pathname, DNS privacy servers can use this to offer you a distinct feature set e.g. maybe you want them to blackhole ads but not porn, another user wants no porn 'cos they're worried about their kids, and I want full fat. NextDNS offers this I believe. Error messages aren't restricted to what can be expressed in DNS itself. So instead of NXDOMAIN the error can tell me myblanket.example was blocked because it's an advertising source, or that gooogle.example wasn't found but maybe it's a typo and I should try google.example ?

daneel_w 5y ago
> Why do you think DoT is better? I prefer DoT over DoH. I'm not getting into a discussion of "technically better". > ...DNS privacy servers can use this to offer you a distinct feature set e.g. maybe you want them to blackhole ads but not porn No, I don't want any that. I want DNS between my resolver and the remote to do only what it's intended for. I don't want that specific leg of the communication to involve any features, bells or whistles.