3 ms·

My home router is running a (regular, port 53) DNS server that blocks requests to ads, scams, malware, etc. I have rules set up on the router so any port 53 tr

by kelnos 2y ago

My home router is running a (regular, port 53) DNS server that blocks requests to ads, scams, malware, etc. I have rules set up on the router so any port 53 traffic that tries to go to the public internet gets redirected to my router's DNS server. A device on my network that decides to use DoH without my knowledge or consent gets to bypass all that. I can try to block a list of the DoH providers I know of, but I'm not going to get them all. And it's just regular HTTPS traffic on port 443, with nothing to distinguish it from someone accessing a website.

growse 2y ago
An antagonistic device on your network that wants to resolve names doesn't need to use DNS at all. DoH isn't "magic". It's just a simple, standardised protocol. It's existence makes it no more or less easy for adversarial actors to do name resolution.
- chgs 2y ago
  The choice of DoH is not set from dhcp or the OS, it’s set by the application developer. And that’s wrong. DNS should be an OS level tool which is consistent to all applications, not an application by application setting. As the device owner I expect dns to be ck distant whether I run Firefox, chromium, zoom, curl, steam, ping, or he dozens of other programs I run.
  - HeatrayEnjoyer 2y ago
    Why should it be system wide? That's a broad and imprecise policy vs app by app.
    - ruthmarx 2y ago
      The bigger issue is that it should be an OS level setting. Different apps having a different option isn't the issue, it's any app being able to trivially override a user choice, sometimes without notification.
      - growse 2y ago
        Again, the existence of DoH has zero bearing on whether or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution.
        TacticalCoder 2y ago
        A huge shitload of the Internet is the Web. The reason I force DNS over UDP to my own DNS resolver is not so that chinese-internet-of-shitty-insecure-device (which I don't own) cannot phone home: I do it so that I'm in control of what the browsers can access over HTTPS (my browsers are all HTTPS-only). > or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution Then meet firewalls. The users accounts running browsers on my setup can access HTTPS over port 443 and query UDP to my local DNS resolver. A webapp (i.e. a software written by someone else) is not bypassing that "networking stack" that easily. Regarding name resolution: except some very rare cases where https shall work directly with IP addresses, a browser using https only will only work for domains that have valid certificates. Which is why blocking hundreds of thousands --or millions-- of domains at the DNS level is so effective. And if there are known fixed https://IP_address https://IP_address addresses with valid certificate that are nefarious, they're trivial to block with a firewall anyway. I'm in control of my LAN, my router, and my machines and webapps written by others either respect HTTPS or get the middle finger from my firewall(s). Not https over port 443? No network for you. Reading all your nitpicking posts you make it sound like firewalls and local DNS intercepting and blocking DNS requests aren't effective. But in practice it is hugely effective.
        jasonjayr 2y ago
        I hope you can appreciate that DoH is meant to protect against a nefarious intermediary between the device/application and the server it's trying to reach. The crux of the problem is that the device/application can't tell if the interference is friend or foe. All the techniques you can legitimately use on your local network, and that network operators have used in the past, can all be used one hop beyond the network you control. And, sadly, in 2024, most OS vendors are "in the game" of making sure they can 100% control the link and execution environment between themselves and their servers, without interference from the network operators along the way, OR the device owner.
    - A4ET8a8uTh0 2y ago
      Because, as an example, as a person responsible for network at my house, I do not want to check whether my child installed another app and check each app one by one ( and that check has to be done and redone every time something changes or someone touches the app ). I want one global setting that says 'Non possumus'. edit: Unless, naturally, I am no longer an admin and any control I have over my hardware is merely an illusion.
      - Brian_K_White 2y ago
        I hate to break it to you, but there is nothing special about hostnames and ips. They are just a tiny bit of key=value data that can be stored or transmitted infinitely different ways. dns and doh are nothing but convenient standards that no one and no app actually has to use. It doesn't matter how much you might want otherwise. It doesn't matter how important and virtuous the reason you want it is. Even invoking the mighty untouchable power of "my daughter" does not change such a simple fact of life.
        A4ET8a8uTh0 2y ago
        It seems like we are arguing for the same outcome. I want to be able to control things within my control. Based on what your wrote, it seems you would support that?
        Brian_K_White 2y ago
        The question has no meaning. "control things within your control" is like a truism, grammatically and logically valid yet says nothing. The point was that it's pointless to even think in terms of "apps and devices going around my choke point" because there never was a choke point in the first place. If you want to prevent an app or device on your network from accessing an IP, you must 1: Ensure the app or device has no wifi or cell or any other possible physical connection of it's own that could allow it to reach the internet without going through your router. 2: Block the ip, by ip, in your router, and also any other ip that could serve as a proxy or relay. It is impossible to know what all those IPs are, so what is possible instead is whitelisting instead of blacklisting. You could do that, but was it useful or interesting to even say? Didn't you and everyone else already know all that?

by kelnos 2y ago

growse 2y ago

An antagonistic device on your network that wants to resolve names doesn't need to use DNS at all. DoH isn't "magic". It's just a simple, standardised protocol. It's existence makes it no more or less easy for adversarial actors to do name resolution.

chgs 2y ago
The choice of DoH is not set from dhcp or the OS, it’s set by the application developer. And that’s wrong. DNS should be an OS level tool which is consistent to all applications, not an application by application setting. As the device owner I expect dns to be ck distant whether I run Firefox, chromium, zoom, curl, steam, ping, or he dozens of other programs I run.
- HeatrayEnjoyer 2y ago
  Why should it be system wide? That's a broad and imprecise policy vs app by app.
  - ruthmarx 2y ago
    The bigger issue is that it should be an OS level setting. Different apps having a different option isn't the issue, it's any app being able to trivially override a user choice, sometimes without notification.
    - growse 2y ago
      Again, the existence of DoH has zero bearing on whether or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution.
      - TacticalCoder 2y ago
        A huge shitload of the Internet is the Web. The reason I force DNS over UDP to my own DNS resolver is not so that chinese-internet-of-shitty-insecure-device (which I don't own) cannot phone home: I do it so that I'm in control of what the browsers can access over HTTPS (my browsers are all HTTPS-only). > or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution Then meet firewalls. The users accounts running browsers on my setup can access HTTPS over port 443 and query UDP to my local DNS resolver. A webapp (i.e. a software written by someone else) is not bypassing that "networking stack" that easily. Regarding name resolution: except some very rare cases where https shall work directly with IP addresses, a browser using https only will only work for domains that have valid certificates. Which is why blocking hundreds of thousands --or millions-- of domains at the DNS level is so effective. And if there are known fixed https://IP_address https://IP_address addresses with valid certificate that are nefarious, they're trivial to block with a firewall anyway. I'm in control of my LAN, my router, and my machines and webapps written by others either respect HTTPS or get the middle finger from my firewall(s). Not https over port 443? No network for you. Reading all your nitpicking posts you make it sound like firewalls and local DNS intercepting and blocking DNS requests aren't effective. But in practice it is hugely effective.
        jasonjayr 2y ago
        I hope you can appreciate that DoH is meant to protect against a nefarious intermediary between the device/application and the server it's trying to reach. The crux of the problem is that the device/application can't tell if the interference is friend or foe. All the techniques you can legitimately use on your local network, and that network operators have used in the past, can all be used one hop beyond the network you control. And, sadly, in 2024, most OS vendors are "in the game" of making sure they can 100% control the link and execution environment between themselves and their servers, without interference from the network operators along the way, OR the device owner.
  - A4ET8a8uTh0 2y ago
    Because, as an example, as a person responsible for network at my house, I do not want to check whether my child installed another app and check each app one by one ( and that check has to be done and redone every time something changes or someone touches the app ). I want one global setting that says 'Non possumus'. edit: Unless, naturally, I am no longer an admin and any control I have over my hardware is merely an illusion.
    - Brian_K_White 2y ago
      I hate to break it to you, but there is nothing special about hostnames and ips. They are just a tiny bit of key=value data that can be stored or transmitted infinitely different ways. dns and doh are nothing but convenient standards that no one and no app actually has to use. It doesn't matter how much you might want otherwise. It doesn't matter how important and virtuous the reason you want it is. Even invoking the mighty untouchable power of "my daughter" does not change such a simple fact of life.
      - A4ET8a8uTh0 2y ago
        It seems like we are arguing for the same outcome. I want to be able to control things within my control. Based on what your wrote, it seems you would support that?
        Brian_K_White 2y ago
        The question has no meaning. "control things within your control" is like a truism, grammatically and logically valid yet says nothing. The point was that it's pointless to even think in terms of "apps and devices going around my choke point" because there never was a choke point in the first place. If you want to prevent an app or device on your network from accessing an IP, you must 1: Ensure the app or device has no wifi or cell or any other possible physical connection of it's own that could allow it to reach the internet without going through your router. 2: Block the ip, by ip, in your router, and also any other ip that could serve as a proxy or relay. It is impossible to know what all those IPs are, so what is possible instead is whitelisting instead of blacklisting. You could do that, but was it useful or interesting to even say? Didn't you and everyone else already know all that?