6 ms·

I remember their other articles where they were bitching about capchas and related "security" while them being by far the most common one I hit... I still mour

by ilyt 4y ago

I remember their other articles where they were bitching about capchas and related "security" while them being by far the most common one I hit... I still mourn the fact industry got conned into DoH and funnelling all DNS traffic on "modern" and "secure" apps thru cloudflare's 1.1.1.1

JamesonNetworks 4y ago
Its unbelievable that they are taking control out of local sys admin hands rather than enabling them with better tooling. It puts packaged software in the same vein as Comcast and Spectrum hardware or Google WiFi that doesn’t expose router and dhcp settings. We are heading to a world where all software for personal use will need to be custom built to rip out all this user and admin hostile nonsense
- josephcsible 4y ago
  > they are taking control out of local sys admin hands How so? Do any programs force the use of DoH and not let you configure which server they use?
  - p_l 4y ago
    Mozilla openly mentioned they might block network-wide methods to disable DoH and majority of people do not know that Mozilla (or Chrome etc.) are going to use their own settings, leading to unexpected behaviours.
    - josephcsible 4y ago
      > they might block network-wide methods How is that taking control away from a local sysadmin? It'd be a great thing if they did that, since then malicious network administrators won't be able to disable DoH on computers that aren't theirs anymore. If you're really trying to control devices that are yours, you'll still be able to turn it off via local Firefox policy.
      - p_l 4y ago
        There's a spectrum of options between "total lockdown of machines" and "nothing is controlled". Also, at least the way the announcement read at the time... it felt like someone forgot that there might be a need by local admin to disable it, in fact.
dan-robertson 4y ago
Why is DoH a con?
- josephcsible 4y ago
  It's not. In general, people who say it is fall into one of three groups: 1. People who want to censor and/or surveil other people's devices and traffic. These people hate DoH because the entire point of it is to protect against them doing so, and by running over port 443, it's really difficult for them to block it. This is the group that people who say DoH would be a good thing if only it used a network-provided DoH server, or that they wish DoT would get used more instead of DoH, usually fall into. 2. People who have a workflow that it breaks. In most cases, there's some setting or workaround for that workflow that still lets you use DoH for most Internet queries, though. 3. People who say it's making the Internet more centralized or bad for privacy. These arguments are valid to say "don't everyone use Cloudflare as your DoH provider" but not to say "don't use DoH even with other providers", since there's no reason DoH servers have to be any more centralized than regular DNS servers.
  - Xelynega 4y ago
    1. CloudFlare already gets this information since they're getting the unencrypted DNS traffic. The actual argument you're making here is that a single company owning all the data is a better situation than anybody being able to see that information. 2. Why should their workflow be broken so that the dns info gathered by CloudFlare is more valuable to CloudFlare. 3. The argument is that doh through privately owned servers is bad, so I don't know why you tried to specify that only CloudFlare is bad. DoH is, by definition, more centralized than DNS servers unless all DNS servers implement some form of doh. In which case you're not using doh and you're just updating dns to support encryption. If every DNS server doesn't implement doh then you're just adding a few centralized points which have access to unencrypted DNS data, making that data more valuable to the private entities holding it.
    - josephcsible 4y ago
      > The actual argument you're making here is that a single company owning all the data is a better situation than anybody being able to see that information. Sure, but "CloudFlare can see my data but my ISP can't" is strictly better from a privacy perspective than "CloudFlare and my ISP can both see my data". > Why should their workflow be broken My point is their workflow doesn't actually have to be broken. > so that the dns info gathered by CloudFlare is more valuable to CloudFlare. Huh? > The argument is that doh through privately owned servers is bad How is it any worse than insecure DNS through privately owned servers, which basically everyone uses today? > DoH is, by definition, more centralized than DNS servers unless all DNS servers implement some form of doh. Is IPv6 also by definition more centralized than IPv4, since not all IPv4 servers implement some form of IPv6? > In which case you're not using doh and you're just updating dns to support encryption. What are you saying is the difference between those two things? And don't forget there's a huge anti-censorship benefit, even if you don't care about privacy at all. > making that data more valuable to the private entities holding it. Wait, are you arguing that reducing the number of entities that can access our data is a bad thing, since then our data will be more valuable to the ones who still can? That seems completely backwards.

by ilyt 4y ago

JamesonNetworks 4y ago

Its unbelievable that they are taking control out of local sys admin hands rather than enabling them with better tooling. It puts packaged software in the same vein as Comcast and Spectrum hardware or Google WiFi that doesn’t expose router and dhcp settings. We are heading to a world where all software for personal use will need to be custom built to rip out all this user and admin hostile nonsense

josephcsible 4y ago
> they are taking control out of local sys admin hands How so? Do any programs force the use of DoH and not let you configure which server they use?
- p_l 4y ago
  Mozilla openly mentioned they might block network-wide methods to disable DoH and majority of people do not know that Mozilla (or Chrome etc.) are going to use their own settings, leading to unexpected behaviours.
  - josephcsible 4y ago
    > they might block network-wide methods How is that taking control away from a local sysadmin? It'd be a great thing if they did that, since then malicious network administrators won't be able to disable DoH on computers that aren't theirs anymore. If you're really trying to control devices that are yours, you'll still be able to turn it off via local Firefox policy.
    - p_l 4y ago
      There's a spectrum of options between "total lockdown of machines" and "nothing is controlled". Also, at least the way the announcement read at the time... it felt like someone forgot that there might be a need by local admin to disable it, in fact.

dan-robertson 4y ago

Why is DoH a con?

josephcsible 4y ago
It's not. In general, people who say it is fall into one of three groups: 1. People who want to censor and/or surveil other people's devices and traffic. These people hate DoH because the entire point of it is to protect against them doing so, and by running over port 443, it's really difficult for them to block it. This is the group that people who say DoH would be a good thing if only it used a network-provided DoH server, or that they wish DoT would get used more instead of DoH, usually fall into. 2. People who have a workflow that it breaks. In most cases, there's some setting or workaround for that workflow that still lets you use DoH for most Internet queries, though. 3. People who say it's making the Internet more centralized or bad for privacy. These arguments are valid to say "don't everyone use Cloudflare as your DoH provider" but not to say "don't use DoH even with other providers", since there's no reason DoH servers have to be any more centralized than regular DNS servers.
- Xelynega 4y ago
  1. CloudFlare already gets this information since they're getting the unencrypted DNS traffic. The actual argument you're making here is that a single company owning all the data is a better situation than anybody being able to see that information. 2. Why should their workflow be broken so that the dns info gathered by CloudFlare is more valuable to CloudFlare. 3. The argument is that doh through privately owned servers is bad, so I don't know why you tried to specify that only CloudFlare is bad. DoH is, by definition, more centralized than DNS servers unless all DNS servers implement some form of doh. In which case you're not using doh and you're just updating dns to support encryption. If every DNS server doesn't implement doh then you're just adding a few centralized points which have access to unencrypted DNS data, making that data more valuable to the private entities holding it.
  - josephcsible 4y ago
    > The actual argument you're making here is that a single company owning all the data is a better situation than anybody being able to see that information. Sure, but "CloudFlare can see my data but my ISP can't" is strictly better from a privacy perspective than "CloudFlare and my ISP can both see my data". > Why should their workflow be broken My point is their workflow doesn't actually have to be broken. > so that the dns info gathered by CloudFlare is more valuable to CloudFlare. Huh? > The argument is that doh through privately owned servers is bad How is it any worse than insecure DNS through privately owned servers, which basically everyone uses today? > DoH is, by definition, more centralized than DNS servers unless all DNS servers implement some form of doh. Is IPv6 also by definition more centralized than IPv4, since not all IPv4 servers implement some form of IPv6? > In which case you're not using doh and you're just updating dns to support encryption. What are you saying is the difference between those two things? And don't forget there's a huge anti-censorship benefit, even if you don't care about privacy at all. > making that data more valuable to the private entities holding it. Wait, are you arguing that reducing the number of entities that can access our data is a bad thing, since then our data will be more valuable to the ones who still can? That seems completely backwards.