5 ms·

> but what happens when applications and Trojans start doing DoH lookups, skipping our system's configured DNS? Exfiltration has always been a problem. But it'

> but what happens when applications and Trojans start doing DoH lookups, skipping our system's configured DNS? Exfiltration has always been a problem. But it's not a good reason to make MITM possible. Network control should not give control over endpoints any degree more than is necessary to deliver packets from point A to B. We can't trust them with more. > [...] Now Edge doesn't let you. That's blatantly false for normal endpoints though. Be it an AV or parental controls, an endpoint administration will have that ability to intercept. If an endpoint doesn't let you do thay then to be honest, you've already lost the battle. Even simple HTTPS is not really filterable. > Just like this article above does a good job explaining the lack of security in the cloud, we really could use a good article explaining how completely inane the idea of DoH is. What is actually inane is the amount of implicit trust and control given to networks right now. Your network might be a nice wonderland, but many aren't.

johnklos 3y ago
People own their networks when they're not out in public. Again, solving for a problem with public networks by forcing shortcomings on to all networks is shortsighted and ill conceived. "But it's not a good reason to make MITM possible" is disingenuous. Avoiding DoH doesn't make MITM possible, just as adding DoH doesn't save us from MITM. It does, though, save apps / Trojans from MITM, particularly when we're the ones who want to be in the middle :P "That's blatantly false for normal endpoints though. Be it an AV or parental controls, an endpoint administration will have that ability to intercept." Go ahead and tell me how to remove Edge, or how to have Windows open links in other browsers, without involving third party software that forces this, then tell me how "endpoint administration" is something we can expect of people who can't set their own DNS (or who have evil ISPs and can't set up any of a number of other ways to circumvent said evil ISPs). You didn't address the real meat of the issue: Why is avoiding one issue - ISPs tracking DNS - worth all the bad things that come with it? The only explanation that makes sense to me is that it's worth it to companies that want to control as much as they can, like Cloudflare. "What is actually inane is the amount of implicit trust and control given to networks right now." So instead of teaching people how and encouraging them to make their networks better, you'd rather divest some of that trust to companies like Cloudflare, and to every application / Trojan writer? Right - because the amount of data collection in software isn't a problem at all. We just need to trust them, and they'll do right by us. You've made my point for me that you, and other apologists for DoH, haven't really thought things through, have you?
- josephcsible 3y ago
  > People own their networks when they're not out in public. Again, solving for a problem with public networks by forcing shortcomings on to all networks is shortsighted and ill conceived. It's not just being out in public. Even when you're home, you're still at the mercy of your ISP. > Go ahead and tell me how to remove Edge, or how to have Windows open links in other browsers What does preventing use of Edge have to do with DoH? > You didn't address the real meat of the issue: Why is avoiding one issue - ISPs tracking DNS - worth all the bad things that come with it? You've yet to convincingly point out a single bad thing that actually comes from DoH. > So instead of teaching people how and encouraging them to make their networks better, you'd rather divest some of that trust to companies like Cloudflare, and to every application / Trojan writer? You can't make public Wi-Fi or your ISP's network better no matter how knowledgeable you are.
  - johnklos 3y ago
    "Even when you're home, you're still at the mercy of your ISP." No, I'm not. If you think I am, then you don't understand networking. "What does preventing use of Edge have to do with DoH?" If you can't have basic control of programs on your own computer, tell me how you're going to control programs' use of DoH. "You've yet to convincingly point out a single bad thing that actually comes from DoH." I've named many: we lose the ability to block ads, adware, Trojan CaC, spyware, et cetera. We lose the privacy of our own DNS lookups. Your suggestion seems disingenuous. "You can't make public Wi-Fi or your ISP's network better no matter how knowledgeable you are." No - YOU can't or don't want to, because you don't understand networking. People who want to can, though, and this is what I'd encourage, instead of enshittifying the Internet by believing companies like Cloudflare when they tell us our ISPs suck and we should just trust them instead.
    - josephcsible 3y ago
      > "Even when you're home, you're still at the mercy of your ISP." No, I'm not. If you think I am, then you don't understand networking. If your ISP dropped all packets on port 53 that contained a response for example.com, how would you circumvent that and learn its IP otherwise? > "What does preventing use of Edge have to do with DoH?" If you can't have basic control of programs on your own computer, tell me how you're going to control programs' use of DoH. Name a single program (other than unambiguous malware that nobody would ever be okay with being installed at all) that always uses DoH regardless of any configuration by a local administrator. > "You've yet to convincingly point out a single bad thing that actually comes from DoH." I've named many: we lose the ability to block ads, adware, Trojan CaC, spyware, et cetera. We lose the privacy of our own DNS lookups. Your suggestion seems disingenuous. There are DoH resolvers that do ad and malware blocking. Moving DNS from cleartext to an encrypted protocol is certainly not losing privacy. > "You can't make public Wi-Fi or your ISP's network better no matter how knowledgeable you are." No - YOU can't or don't want to, because you don't understand networking. People who want to can, though, and this is what I'd encourage, instead of enshittifying the Internet by believing companies like Cloudflare when they tell us our ISPs suck and we should just trust them instead. How are you proposing that people make other people's networks better? And are you saying that Americans' ISPs don't suck?

johnklos 3y ago

People own their networks when they're not out in public. Again, solving for a problem with public networks by forcing shortcomings on to all networks is shortsighted and ill conceived. "But it's not a good reason to make MITM possible" is disingenuous. Avoiding DoH doesn't make MITM possible, just as adding DoH doesn't save us from MITM. It does, though, save apps / Trojans from MITM, particularly when we're the ones who want to be in the middle :P "That's blatantly false for normal endpoints though. Be it an AV or parental controls, an endpoint administration will have that ability to intercept." Go ahead and tell me how to remove Edge, or how to have Windows open links in other browsers, without involving third party software that forces this, then tell me how "endpoint administration" is something we can expect of people who can't set their own DNS (or who have evil ISPs and can't set up any of a number of other ways to circumvent said evil ISPs). You didn't address the real meat of the issue: Why is avoiding one issue - ISPs tracking DNS - worth all the bad things that come with it? The only explanation that makes sense to me is that it's worth it to companies that want to control as much as they can, like Cloudflare. "What is actually inane is the amount of implicit trust and control given to networks right now." So instead of teaching people how and encouraging them to make their networks better, you'd rather divest some of that trust to companies like Cloudflare, and to every application / Trojan writer? Right - because the amount of data collection in software isn't a problem at all. We just need to trust them, and they'll do right by us. You've made my point for me that you, and other apologists for DoH, haven't really thought things through, have you?

josephcsible 3y ago
> People own their networks when they're not out in public. Again, solving for a problem with public networks by forcing shortcomings on to all networks is shortsighted and ill conceived. It's not just being out in public. Even when you're home, you're still at the mercy of your ISP. > Go ahead and tell me how to remove Edge, or how to have Windows open links in other browsers What does preventing use of Edge have to do with DoH? > You didn't address the real meat of the issue: Why is avoiding one issue - ISPs tracking DNS - worth all the bad things that come with it? You've yet to convincingly point out a single bad thing that actually comes from DoH. > So instead of teaching people how and encouraging them to make their networks better, you'd rather divest some of that trust to companies like Cloudflare, and to every application / Trojan writer? You can't make public Wi-Fi or your ISP's network better no matter how knowledgeable you are.
- johnklos 3y ago
  "Even when you're home, you're still at the mercy of your ISP." No, I'm not. If you think I am, then you don't understand networking. "What does preventing use of Edge have to do with DoH?" If you can't have basic control of programs on your own computer, tell me how you're going to control programs' use of DoH. "You've yet to convincingly point out a single bad thing that actually comes from DoH." I've named many: we lose the ability to block ads, adware, Trojan CaC, spyware, et cetera. We lose the privacy of our own DNS lookups. Your suggestion seems disingenuous. "You can't make public Wi-Fi or your ISP's network better no matter how knowledgeable you are." No - YOU can't or don't want to, because you don't understand networking. People who want to can, though, and this is what I'd encourage, instead of enshittifying the Internet by believing companies like Cloudflare when they tell us our ISPs suck and we should just trust them instead.
  - josephcsible 3y ago
    > "Even when you're home, you're still at the mercy of your ISP." No, I'm not. If you think I am, then you don't understand networking. If your ISP dropped all packets on port 53 that contained a response for example.com, how would you circumvent that and learn its IP otherwise? > "What does preventing use of Edge have to do with DoH?" If you can't have basic control of programs on your own computer, tell me how you're going to control programs' use of DoH. Name a single program (other than unambiguous malware that nobody would ever be okay with being installed at all) that always uses DoH regardless of any configuration by a local administrator. > "You've yet to convincingly point out a single bad thing that actually comes from DoH." I've named many: we lose the ability to block ads, adware, Trojan CaC, spyware, et cetera. We lose the privacy of our own DNS lookups. Your suggestion seems disingenuous. There are DoH resolvers that do ad and malware blocking. Moving DNS from cleartext to an encrypted protocol is certainly not losing privacy. > "You can't make public Wi-Fi or your ISP's network better no matter how knowledgeable you are." No - YOU can't or don't want to, because you don't understand networking. People who want to can, though, and this is what I'd encourage, instead of enshittifying the Internet by believing companies like Cloudflare when they tell us our ISPs suck and we should just trust them instead. How are you proposing that people make other people's networks better? And are you saying that Americans' ISPs don't suck?