3 ms·

DoH is such a weird thing. I am against individual applications making their own DNS queries. This is a responsibility of the OS. I love the idea that I can q

DoH is such a weird thing. I am against individual applications making their own DNS queries. This is a responsibility of the OS. I love the idea that I can query DNS without being spied upon. However, at home, for the protection of my family and me I want all devices to go through a certain DNS server. So where does this leave us? We're delegating the statement of 'I'm being secure' to the DNS server itself. Shoutout to my Google Mini which ignores DNS servers in the DHCP response.

johnklos 3y ago
This is exactly what Cloudflare wants - they want us to blindly "trust" them with our DNS lookups, even though they've prioritized paying scammers over doing the right thing for years.
donmcronald 3y ago
> Shoutout to my Google Mini which ignores DNS servers in the DHCP response. Put Roku on that list. They also break in a spectacular fashion if you redirect the queries to a DNS server that returns NXDOMAIN. Its like they query in an infinite loop with no rate limits. They absolutely hammer the DNS server.
- AviationAtom 3y ago
  I made it a point to NAT redirect all outbound requests to UDP 53 in our enterprise back to our enterprise DNS server. It would sometimes piss off our engineers, when they realized 8.8.8.8 was somehow resolving our internal DNS names, but if they came to us and nicely explained their use-case then we excluded them from the NAT rule.
  - groestl 3y ago
    Great when you debug something for ages, just to find out your company's DNS setup is broken. Because it can't be DNS, right? /s
    - AviationAtom 3y ago
      Compliance sucks, but it's required. I didn't make up the rules, just implemented and enforced them.
      - groestl 3y ago
        Sorry, my snarkiness was not meant personal, I know you're not to blame :)
  - watersb 3y ago
    I had add port 53 NAT redirect to my home network. Kindle Fire tablet has hard-coded Google's 8.8.8.8 DNS server, bypassing the Pi-Hole ad blocker.
  - remram 3y ago
    That's very unkind. It probably took them a good long while to figure out that you did that, in the middle of troubleshooting something else. Why not just block that traffic? People like you are the reason DoH is being rolled out. I hate the concept, but I would immediately enable it if I caught my IT unapologetically getting in the way of my work like you do.
    - AviationAtom 3y ago
      They seemed to like it less when we blocked it, as their stuff completely failed to work.
      - BrandoElFollito 3y ago
        Yes, but at least they immediately knew why.
jon-wood 3y ago
As a one-time developer of consumer IoT hardware I’m divided on this. In principle everything should respect the DNS servers provided by your local DHCP server. In practice some of those DNS servers are hilariously bad, because they’re operated by ISPs, who will happily highjack every single DNS query to inject a message about how you’re approaching your bandwidth quota, or just outright ignore TTLs that were dropped to allow clean switchover between providers. We ended up hardcoding known good DNS servers because otherwise we’d get complaints from customers when things stopped working, and no amount of saying it’s not our fault would avoid being branded as useless crap.
- powersnail 3y ago
  > In principle everything should respect the DNS servers provided by your local DHCP server. In practice some of those DNS servers are hilariously bad, because they’re operated by ISPs It's not just ISP operated DNS. There are many other scenarios where multiple parties share one DHCP server, where the DHCP admin's choice of DNS might not be what every other participant desires. For instance, using a public wifi, roommates sharing a router, visiting someone's house, etc.
Spivak 3y ago
> I am against individual applications making their own DNS queries But every other network request they will ever make is fine if they do it themselves? Like at some point we have to be like DNS being a service provided by the system to apps was mostly a historical accident or an idea for a network model that never really panned out. I would have loved to see the alternate universe where your typical unprivileged app has no direct access to sockets and routes all requests through a system service that handles all the application-layer protocols and encryption.
- eadmund 3y ago
  > Like at some point we have to be like DNS being a service provided by the system to apps was mostly a historical accident or an idea for a network model that never really panned out. I think that I prefer the network model where I the system owner have control over what the programs executing on my behalf are doing on my system and my network. I really don’t want to be presented the choice of binary blob A, binary blob B or living without Internet access. > I would have loved to see the alternate universe where your typical unprivileged app has no direct access to sockets and routes all requests through a system service that handles all the application-layer protocols and encryption. Ditto.
xg15 3y ago
Yeah, I think the question is what exactly the thread model is and what gets protected. DoH as protection of my own traffic against snooping ISPs is very much welcome. DoH as protection of locked down apps and devices against their owners - not so much.

johnklos 3y ago

This is exactly what Cloudflare wants - they want us to blindly "trust" them with our DNS lookups, even though they've prioritized paying scammers over doing the right thing for years.

donmcronald 3y ago

> Shoutout to my Google Mini which ignores DNS servers in the DHCP response. Put Roku on that list. They also break in a spectacular fashion if you redirect the queries to a DNS server that returns NXDOMAIN. Its like they query in an infinite loop with no rate limits. They absolutely hammer the DNS server.

AviationAtom 3y ago
I made it a point to NAT redirect all outbound requests to UDP 53 in our enterprise back to our enterprise DNS server. It would sometimes piss off our engineers, when they realized 8.8.8.8 was somehow resolving our internal DNS names, but if they came to us and nicely explained their use-case then we excluded them from the NAT rule.
- groestl 3y ago
  Great when you debug something for ages, just to find out your company's DNS setup is broken. Because it can't be DNS, right? /s
  - AviationAtom 3y ago
    Compliance sucks, but it's required. I didn't make up the rules, just implemented and enforced them.
    - groestl 3y ago
      Sorry, my snarkiness was not meant personal, I know you're not to blame :)
- watersb 3y ago
  I had add port 53 NAT redirect to my home network. Kindle Fire tablet has hard-coded Google's 8.8.8.8 DNS server, bypassing the Pi-Hole ad blocker.
- remram 3y ago
  That's very unkind. It probably took them a good long while to figure out that you did that, in the middle of troubleshooting something else. Why not just block that traffic? People like you are the reason DoH is being rolled out. I hate the concept, but I would immediately enable it if I caught my IT unapologetically getting in the way of my work like you do.
  - AviationAtom 3y ago
    They seemed to like it less when we blocked it, as their stuff completely failed to work.
    - BrandoElFollito 3y ago
      Yes, but at least they immediately knew why.

jon-wood 3y ago

As a one-time developer of consumer IoT hardware I’m divided on this. In principle everything should respect the DNS servers provided by your local DHCP server. In practice some of those DNS servers are hilariously bad, because they’re operated by ISPs, who will happily highjack every single DNS query to inject a message about how you’re approaching your bandwidth quota, or just outright ignore TTLs that were dropped to allow clean switchover between providers. We ended up hardcoding known good DNS servers because otherwise we’d get complaints from customers when things stopped working, and no amount of saying it’s not our fault would avoid being branded as useless crap.

powersnail 3y ago
> In principle everything should respect the DNS servers provided by your local DHCP server. In practice some of those DNS servers are hilariously bad, because they’re operated by ISPs It's not just ISP operated DNS. There are many other scenarios where multiple parties share one DHCP server, where the DHCP admin's choice of DNS might not be what every other participant desires. For instance, using a public wifi, roommates sharing a router, visiting someone's house, etc.

Spivak 3y ago

> I am against individual applications making their own DNS queries But every other network request they will ever make is fine if they do it themselves? Like at some point we have to be like DNS being a service provided by the system to apps was mostly a historical accident or an idea for a network model that never really panned out. I would have loved to see the alternate universe where your typical unprivileged app has no direct access to sockets and routes all requests through a system service that handles all the application-layer protocols and encryption.

eadmund 3y ago
> Like at some point we have to be like DNS being a service provided by the system to apps was mostly a historical accident or an idea for a network model that never really panned out. I think that I prefer the network model where I the system owner have control over what the programs executing on my behalf are doing on my system and my network. I really don’t want to be presented the choice of binary blob A, binary blob B or living without Internet access. > I would have loved to see the alternate universe where your typical unprivileged app has no direct access to sockets and routes all requests through a system service that handles all the application-layer protocols and encryption. Ditto.

xg15 3y ago

Yeah, I think the question is what exactly the thread model is and what gets protected. DoH as protection of my own traffic against snooping ISPs is very much welcome. DoH as protection of locked down apps and devices against their owners - not so much.