5 ms·

Ok, so this is why browsers pushed so hard for DNS-over-HTTPS! It makes it inevitably the single-point-of-censorship. And it also aligns very well between Mozi

Ok, so this is why browsers pushed so hard for DNS-over-HTTPS! It makes it inevitably the single-point-of-censorship. And it also aligns very well between Mozilla’s views on other societal issues and Macron’s views on oppositions.

detourdog 3y ago
Yes, the double whammy is working against self-signed certificates which I see as great for small groups.
mschuster91 3y ago
> Ok, so this is why browsers pushed so hard for DNS-over-HTTPS! It makes it inevitably the single-point-of-censorship. DoH actually makes it harder for the government to censor domains as the browsers don't use the ISP-provided DNS infrastructure any more, which is why the French governments wants to force browser vendors to do it instead.
- gsich 3y ago
  It does not. As the "big" DNS providers can also be forced to comply. Example, although it's the usual copyright mafia stuff: https://www.quad9.net/news/blog/an-update-to-the-quad9-and-sony-music-german-court-injunction-august-2022/ https://www.quad9.net/news/blog/an-update-to-the-quad9-and-s...
- deleted 3y ago
  [deleted]
- pepa65 3y ago
  Isn't that exactly the point that PC was making? That it HAD to happen in the browser now??
  - mschuster91 3y ago
    Browsers didn't push for DoH because they wanted to be the target for censorship demands, they pushed because DNS manipulation by everyone from governments and ISPs to a ton of middlebox vendors got out of hand - DNS ossified particularly because of the latter - and on top of that because DNS was cleartext and leaked metadata to everyone able to install a sniffer along the path.
zapdrive 3y ago
Can you elaborate how dns over https is a single point of censorship?
- contravariant 3y ago
  Presumably because it moves the DNS resolution from the OS to the browser? Though if you didn't it would just make the OS the single point of censorship so I'm not sure what difference it makes.
zarzavat 3y ago
You have that backwards. Plain DNS is a single point of censorship because your ISP/government can see the cleartext and read/modify it. DoH allows you to use an alternative source of DNS that your govt can’t read or modify.

detourdog 3y ago

Yes, the double whammy is working against self-signed certificates which I see as great for small groups.

mschuster91 3y ago

> Ok, so this is why browsers pushed so hard for DNS-over-HTTPS! It makes it inevitably the single-point-of-censorship. DoH actually makes it harder for the government to censor domains as the browsers don't use the ISP-provided DNS infrastructure any more, which is why the French governments wants to force browser vendors to do it instead.

gsich 3y ago
It does not. As the "big" DNS providers can also be forced to comply. Example, although it's the usual copyright mafia stuff: https://www.quad9.net/news/blog/an-update-to-the-quad9-and-sony-music-german-court-injunction-august-2022/ https://www.quad9.net/news/blog/an-update-to-the-quad9-and-s...
deleted 3y ago
[deleted]
pepa65 3y ago
Isn't that exactly the point that PC was making? That it HAD to happen in the browser now??
- mschuster91 3y ago
  Browsers didn't push for DoH because they wanted to be the target for censorship demands, they pushed because DNS manipulation by everyone from governments and ISPs to a ton of middlebox vendors got out of hand - DNS ossified particularly because of the latter - and on top of that because DNS was cleartext and leaked metadata to everyone able to install a sniffer along the path.

zapdrive 3y ago

Can you elaborate how dns over https is a single point of censorship?

contravariant 3y ago
Presumably because it moves the DNS resolution from the OS to the browser? Though if you didn't it would just make the OS the single point of censorship so I'm not sure what difference it makes.

zarzavat 3y ago

You have that backwards. Plain DNS is a single point of censorship because your ISP/government can see the cleartext and read/modify it. DoH allows you to use an alternative source of DNS that your govt can’t read or modify.