5 ms·

> Bear in mind QUIC was primarily designed to improve advertisement penetration by making it harder for good actors to interdict and remove bad domains. Are th

> Bear in mind QUIC was primarily designed to improve advertisement penetration by making it harder for good actors to interdict and remove bad domains. Are there any prove points for this claim besides this shout-out? QUIC is more like a modern TCP. What you do with such a protocol is unrelated to the protocol as such. You can open secure connections and stream data with it. That's all. Everything else is on the application side. > Something like dns-over-http/3 is, allegedly, referred to internally at Google as the anti-Pi-hole This claim sounds like anti QUIC FUD. Nothing can stop you from using a Pi-hole like device as your primary DNS resolver! (OK, I admit Google could try to hard-code their DNS servers in Chrome. But I'm very unsure they would make it through the following shit storm in one piece.)

firstlink 3y ago
> Google could try to hard-code their DNS servers in Chrome More relevantly, there's no reason they couldn't do the same before HTTP/3. Even with DNS traffic hijacking, they could just as well do DNS-over-TLS. Infiltrating advertising-related DNS is completely orthogonal to HTTP/3; agreed that the gp comment is FUD.
askvictor 3y ago
Not OP, but Google do hard-code their DNS servers in other products (e.g. Chromecast), so they'll bypass your pi-hole. It is possible to intercept DNS traffic to 8.8.8.8 and redirect it to your own router, however. With DNS-over-HTTPS this is impossible short of installing custom SSL root certs on the device, which is close to impossible. But that's got nothing to do with QUIC or HTTP/3, but is effectively just enforcing signed DNS requests.
- hinkley 3y ago
  Some (most?) browsers support a non-transparent forward proxy. But you really have to trust it, because you're giving it man-in-the-middle control over all of your browser sessions. It dates back to a more draconic era of firewall management, but has also worked its way into DHCP (https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Proto...).
  - askvictor 3y ago
    But doesn't snooping/modifying that traffic still require breaking TLS, which is only possible if you can install a root certificate on your device?
- pabs3 3y ago
  It might be a good idea to not let software/hardware you don't trust onto your own networks.
stonogo 3y ago
Google is an advertising company. Why on earth would anything they do NOT be in order to improve advertisement delivery? I don't understand the water-carrying in this thread, but filter bypass has been the primary criticism of this technology since it was invented.

firstlink 3y ago

> Google could try to hard-code their DNS servers in Chrome More relevantly, there's no reason they couldn't do the same before HTTP/3. Even with DNS traffic hijacking, they could just as well do DNS-over-TLS. Infiltrating advertising-related DNS is completely orthogonal to HTTP/3; agreed that the gp comment is FUD.

askvictor 3y ago

Not OP, but Google do hard-code their DNS servers in other products (e.g. Chromecast), so they'll bypass your pi-hole. It is possible to intercept DNS traffic to 8.8.8.8 and redirect it to your own router, however. With DNS-over-HTTPS this is impossible short of installing custom SSL root certs on the device, which is close to impossible. But that's got nothing to do with QUIC or HTTP/3, but is effectively just enforcing signed DNS requests.

hinkley 3y ago
Some (most?) browsers support a non-transparent forward proxy. But you really have to trust it, because you're giving it man-in-the-middle control over all of your browser sessions. It dates back to a more draconic era of firewall management, but has also worked its way into DHCP (https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Proto...).
- askvictor 3y ago
  But doesn't snooping/modifying that traffic still require breaking TLS, which is only possible if you can install a root certificate on your device?
pabs3 3y ago
It might be a good idea to not let software/hardware you don't trust onto your own networks.

stonogo 3y ago

Google is an advertising company. Why on earth would anything they do NOT be in order to improve advertisement delivery? I don't understand the water-carrying in this thread, but filter bypass has been the primary criticism of this technology since it was invented.