3 ms·

What about software that could query another endpoint without my knowledge? Even early Google Chrome shat on OS DNS settings and was querying 8.8.8.8 but that

• tptacek 4y ago
  What about it? If you can't trust it, you can't trust it. You either control it, don't control it and don't care, or don't control and it's a moot point. Nothing you deploy even needs to use "real DNS" to look things up; it could just set up a TLS channel with an IPv4 rendezvous. The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better about what your Chromecast or Amazon Stick or whatever does on your network doesn't make a whole lot of sense. I don't mean to put a bunch of stuff on you that you didn't say, but this is a very common pushback to DoH, and it makes no sense.
  • hericium 4y ago
    > The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better You're imagining things.
    • tptacek 4y ago
      That ISPs are blocking DoT so they can continue monetizing DNS metrics? No, that's happening.