5 ms·

Honestly I never got the backlash against DoH. Sounded more like a kneejerk reaction and a meme for something that's an improvement. UDP at this day and age? C

Honestly I never got the backlash against DoH. Sounded more like a kneejerk reaction and a meme for something that's an improvement. UDP at this day and age? Come on

deleted 2y ago
[deleted]
AnthonyMouse 2y ago
The backlash against DoH is that the implementations switch your DNS server without asking to a centralized one which is presumably data mining the queries, default ignoring the one you configured in your operating system or DHCP server. There is also nothing wrong with using UDP for DNS. And the latency can be better, and in this context that matters. The real problem is that the UDP DNS protocol isn't encrypted. But there is no reason it couldn't be, except that then nobody gets a new source of DNS queries to data mine, which is where the money comes from to push DoH.
- JoshTriplett 2y ago
  ISPs regularly data-mine their users' traffic. Meanwhile, some of the major DoH servers specifically don't. (See, for instance, the deals Mozilla has with their default DoH providers.)
  - jjav 2y ago
    > Meanwhile, some of the major DoH servers specifically don't. You can't possible make that assertion, because all it takes is one NSL and they will log and share it all.
  - belorn 2y ago
    The policy that Mozilla ask providers to follow does not prohibit data-mining the traffic. Providers are requested to not store or share personal information, but any data-mining that removes personal identifiable information are allowed. For example, accidentally leaked internal network queries from companies are up to grabs. As is market data like what people are querying, how much, when, from where (geographical for example) and to whom, and so on. The quality of the anonymization of private information are also not guarantied.
  - Drawde 2y ago
    > See, for instance, the deals Mozilla has with their default DoH providers. Like the one they had that just circled back around to the ISPs that regularly data-mine their users' traffic?: https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-strike-privacy-deal-to-encrypt-dns-lookups-in-firefox/ https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-...
  - chgs 2y ago
    My ISP doesn’t but the people who run the increasingly centralised internet have a long track record of mining my data for commercial reasons. I’ll trust my ISP over Google or Cloudflare or Microsoft or DuckDuckGo any day.
    - A4ET8a8uTh0 2y ago
      I think reasonable people these days don't really trust a provider even if they have explicit contract stating something. Personally, I just trust my ISP a little more than google when it comes to data. But I absolutely do not dream for one moment that they do not want to play with analyzing/monetizing/god knows what else with that data.
  - tremon 2y ago
    I'm sorry, but this is an argument straight out of the totalitarian's playbook, and I'm going to call you out on it. Some <bad people> abuse <x>, therefore it is totally justified for us to impose a wholesale replacement of <x> with a solution that we can control centrally. It's for your own safety! Never mind all the people that don't have data-mining ISP's, and to hell with end-user consent. We don't need that, we're working for the good of everyone. My piety trumps all!
    - JoshTriplett 2y ago
      Nothing about the DoH protocol is any more centrally controlled than DNS; that's the point. DoH treats the network as an adversary, and instead ensures the end-user's system can determine what DNS server to talk to and that their traffic can't be spied upon by an intermediary. That part is a feature, just as HTTPS was. (And there were people who complained about the push for universal HTTPS, too.) Separately from that, there's the issue of how to transition over to DoH, in a world in which many ISPs and networks are hostile. That is the point at which browsers are using the small handful of early-adopter DoH servers and assuming on behalf of some users that they want to use those instead of the servers from their ISP or other network. That part is debatable, and involves tradeoffs between protecting users who don't understand DNS or security and supporting users who do. DoH gives users the ability to ensure they're talking to the server they think they are, and not get their queries spied on or hijacked. That is the part I'm advocating here: having a protocol that cuts out MITMs and prevents spying on the network traffic. That doesn't solve the problem of needing a trusted DNS server to talk to; it solves the problem of not being sure you're talking to the server you think you are, and not being sure if some part of the network between you and that server is spying on you. If you have a DNS server you like and trust, whether that's from your ISP or something else entirely, that's great for you! DoH would still be a better protocol to use to talk to that DNS server, rather than the unencrypted DNS protocol.
- 55555 2y ago
  > The backlash against DoH is that the implementations switch your DNS server without asking to a centralized one which is presumably data mining the queries, default ignoring the one you configured in your operating system or DHCP server. With, say, a proxy app on MacOS, I don't see how they could do this without consent?
  - AnthonyMouse 2y ago
    It's not that there is no way to turn it off, it's that you have to take affirmative steps to turn it off, so now people are having their queries sent to a central server by default and you have to go out of your way to stop it. And then most people don't even know that it's happening, much less what to do about it.
- diogocp 2y ago
  > The backlash against DoH is that the implementations switch your DNS server without asking Actually they do ask, by querying use-application-dns.net.
  - AnthonyMouse 2y ago
    The default is not for this to respond in a way that disables changing your DNS server, therefore they're changing the default without asking. Notice that you could do this the other way: Query a value in the existing (local) DNS or DHCP that not only allows you to enable DoH but also specify which server all the local devices should use. Then if the DNS server chosen by the local administrator/user supports DoH, it could respond by saying so and you could use the protocol without changing your DNS server. But that's not how they did it.
deleted 2y ago
[deleted]
watermelon0 2y ago
> UDP at this day and age? Come on I assume this is a joke, since DoH3 (DNS over HTTP/3) uses QUIC which is UDP based.
- deleted 2y ago
  [deleted]
- tsimionescu 2y ago
  If DNS were running a full session-based encrypted protocol over UDP, like QUIC does, then no one would complain. But running anything that isn't streaming over plain UDP is basically a bad idea.
  - zeta0134 2y ago
    I feel like you've conflated "UDP" with "unencrypted." This is false; you can perfectly well encrypt data transmitted over UDP, and you can also perfectly well run connections "in the clear" over TCP, which is the thing you generally use instead of UDP. What you don't get with UDP is guaranteed packet delivery, which generally means the application layer is in charge of acknowledgements and retransmits. It's great for game servers where low latency is highly important.
    - tsimionescu 2y ago
      Let me put it like this: for a modern day protocol that should be deployed widely over the internet, the protocol should be expected to have (1) encryption, and (2) session management. Ideally, dedicated protocols should be used for these, for proper separation of concerns, but doing it at the application layer directly can also be acceptable. Deploying an application protocol that does neither, such as DNS, directly over UDP is a bad idea. If you were to run DNS over DTLS (TLS over UDP), that would be a different beast, and probably ok. And to clarify, encryption is important to prevent tampering and preserve users's privacy. Session management is important to protect agains redirect attacks with spoofed source IP, or session hijacking.
      - 2y ago
kelnos 2y ago
My home router is running a (regular, port 53) DNS server that blocks requests to ads, scams, malware, etc. I have rules set up on the router so any port 53 traffic that tries to go to the public internet gets redirected to my router's DNS server. A device on my network that decides to use DoH without my knowledge or consent gets to bypass all that. I can try to block a list of the DoH providers I know of, but I'm not going to get them all. And it's just regular HTTPS traffic on port 443, with nothing to distinguish it from someone accessing a website.
- growse 2y ago
  An antagonistic device on your network that wants to resolve names doesn't need to use DNS at all. DoH isn't "magic". It's just a simple, standardised protocol. It's existence makes it no more or less easy for adversarial actors to do name resolution.
  - chgs 2y ago
    The choice of DoH is not set from dhcp or the OS, it’s set by the application developer. And that’s wrong. DNS should be an OS level tool which is consistent to all applications, not an application by application setting. As the device owner I expect dns to be ck distant whether I run Firefox, chromium, zoom, curl, steam, ping, or he dozens of other programs I run.
    - HeatrayEnjoyer 2y ago
      Why should it be system wide? That's a broad and imprecise policy vs app by app.
      - ruthmarx 2y ago
        The bigger issue is that it should be an OS level setting. Different apps having a different option isn't the issue, it's any app being able to trivially override a user choice, sometimes without notification.

Honestly I never got the backlash against DoH. Sounded more like a kneejerk reaction and a meme for something that's an improvement. UDP at this day and age? Come on

deleted 2y ago

[deleted]

AnthonyMouse 2y ago

The backlash against DoH is that the implementations switch your DNS server without asking to a centralized one which is presumably data mining the queries, default ignoring the one you configured in your operating system or DHCP server. There is also nothing wrong with using UDP for DNS. And the latency can be better, and in this context that matters. The real problem is that the UDP DNS protocol isn't encrypted. But there is no reason it couldn't be, except that then nobody gets a new source of DNS queries to data mine, which is where the money comes from to push DoH.

JoshTriplett 2y ago
ISPs regularly data-mine their users' traffic. Meanwhile, some of the major DoH servers specifically don't. (See, for instance, the deals Mozilla has with their default DoH providers.)
- jjav 2y ago
  > Meanwhile, some of the major DoH servers specifically don't. You can't possible make that assertion, because all it takes is one NSL and they will log and share it all.
- belorn 2y ago
  The policy that Mozilla ask providers to follow does not prohibit data-mining the traffic. Providers are requested to not store or share personal information, but any data-mining that removes personal identifiable information are allowed. For example, accidentally leaked internal network queries from companies are up to grabs. As is market data like what people are querying, how much, when, from where (geographical for example) and to whom, and so on. The quality of the anonymization of private information are also not guarantied.
- Drawde 2y ago
  > See, for instance, the deals Mozilla has with their default DoH providers. Like the one they had that just circled back around to the ISPs that regularly data-mine their users' traffic?: https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-strike-privacy-deal-to-encrypt-dns-lookups-in-firefox/ https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-...
- chgs 2y ago
  My ISP doesn’t but the people who run the increasingly centralised internet have a long track record of mining my data for commercial reasons. I’ll trust my ISP over Google or Cloudflare or Microsoft or DuckDuckGo any day.
  - A4ET8a8uTh0 2y ago
    I think reasonable people these days don't really trust a provider even if they have explicit contract stating something. Personally, I just trust my ISP a little more than google when it comes to data. But I absolutely do not dream for one moment that they do not want to play with analyzing/monetizing/god knows what else with that data.
- tremon 2y ago
  I'm sorry, but this is an argument straight out of the totalitarian's playbook, and I'm going to call you out on it. Some <bad people> abuse <x>, therefore it is totally justified for us to impose a wholesale replacement of <x> with a solution that we can control centrally. It's for your own safety! Never mind all the people that don't have data-mining ISP's, and to hell with end-user consent. We don't need that, we're working for the good of everyone. My piety trumps all!
  - JoshTriplett 2y ago
    Nothing about the DoH protocol is any more centrally controlled than DNS; that's the point. DoH treats the network as an adversary, and instead ensures the end-user's system can determine what DNS server to talk to and that their traffic can't be spied upon by an intermediary. That part is a feature, just as HTTPS was. (And there were people who complained about the push for universal HTTPS, too.) Separately from that, there's the issue of how to transition over to DoH, in a world in which many ISPs and networks are hostile. That is the point at which browsers are using the small handful of early-adopter DoH servers and assuming on behalf of some users that they want to use those instead of the servers from their ISP or other network. That part is debatable, and involves tradeoffs between protecting users who don't understand DNS or security and supporting users who do. DoH gives users the ability to ensure they're talking to the server they think they are, and not get their queries spied on or hijacked. That is the part I'm advocating here: having a protocol that cuts out MITMs and prevents spying on the network traffic. That doesn't solve the problem of needing a trusted DNS server to talk to; it solves the problem of not being sure you're talking to the server you think you are, and not being sure if some part of the network between you and that server is spying on you. If you have a DNS server you like and trust, whether that's from your ISP or something else entirely, that's great for you! DoH would still be a better protocol to use to talk to that DNS server, rather than the unencrypted DNS protocol.
55555 2y ago
> The backlash against DoH is that the implementations switch your DNS server without asking to a centralized one which is presumably data mining the queries, default ignoring the one you configured in your operating system or DHCP server. With, say, a proxy app on MacOS, I don't see how they could do this without consent?
- AnthonyMouse 2y ago
  It's not that there is no way to turn it off, it's that you have to take affirmative steps to turn it off, so now people are having their queries sent to a central server by default and you have to go out of your way to stop it. And then most people don't even know that it's happening, much less what to do about it.
diogocp 2y ago
> The backlash against DoH is that the implementations switch your DNS server without asking Actually they do ask, by querying use-application-dns.net.
- AnthonyMouse 2y ago
  The default is not for this to respond in a way that disables changing your DNS server, therefore they're changing the default without asking. Notice that you could do this the other way: Query a value in the existing (local) DNS or DHCP that not only allows you to enable DoH but also specify which server all the local devices should use. Then if the DNS server chosen by the local administrator/user supports DoH, it could respond by saying so and you could use the protocol without changing your DNS server. But that's not how they did it.

deleted 2y ago

[deleted]

watermelon0 2y ago

> UDP at this day and age? Come on I assume this is a joke, since DoH3 (DNS over HTTP/3) uses QUIC which is UDP based.

deleted 2y ago
[deleted]
tsimionescu 2y ago
If DNS were running a full session-based encrypted protocol over UDP, like QUIC does, then no one would complain. But running anything that isn't streaming over plain UDP is basically a bad idea.
- zeta0134 2y ago
  I feel like you've conflated "UDP" with "unencrypted." This is false; you can perfectly well encrypt data transmitted over UDP, and you can also perfectly well run connections "in the clear" over TCP, which is the thing you generally use instead of UDP. What you don't get with UDP is guaranteed packet delivery, which generally means the application layer is in charge of acknowledgements and retransmits. It's great for game servers where low latency is highly important.
  - tsimionescu 2y ago
    Let me put it like this: for a modern day protocol that should be deployed widely over the internet, the protocol should be expected to have (1) encryption, and (2) session management. Ideally, dedicated protocols should be used for these, for proper separation of concerns, but doing it at the application layer directly can also be acceptable. Deploying an application protocol that does neither, such as DNS, directly over UDP is a bad idea. If you were to run DNS over DTLS (TLS over UDP), that would be a different beast, and probably ok. And to clarify, encryption is important to prevent tampering and preserve users's privacy. Session management is important to protect agains redirect attacks with spoofed source IP, or session hijacking.
    - 2y ago

kelnos 2y ago

My home router is running a (regular, port 53) DNS server that blocks requests to ads, scams, malware, etc. I have rules set up on the router so any port 53 traffic that tries to go to the public internet gets redirected to my router's DNS server. A device on my network that decides to use DoH without my knowledge or consent gets to bypass all that. I can try to block a list of the DoH providers I know of, but I'm not going to get them all. And it's just regular HTTPS traffic on port 443, with nothing to distinguish it from someone accessing a website.

growse 2y ago
An antagonistic device on your network that wants to resolve names doesn't need to use DNS at all. DoH isn't "magic". It's just a simple, standardised protocol. It's existence makes it no more or less easy for adversarial actors to do name resolution.
- chgs 2y ago
  The choice of DoH is not set from dhcp or the OS, it’s set by the application developer. And that’s wrong. DNS should be an OS level tool which is consistent to all applications, not an application by application setting. As the device owner I expect dns to be ck distant whether I run Firefox, chromium, zoom, curl, steam, ping, or he dozens of other programs I run.
  - HeatrayEnjoyer 2y ago
    Why should it be system wide? That's a broad and imprecise policy vs app by app.
    - ruthmarx 2y ago
      The bigger issue is that it should be an OS level setting. Different apps having a different option isn't the issue, it's any app being able to trivially override a user choice, sometimes without notification.