11 ms·

An antagonistic device on your network that wants to resolve names doesn't need to use DNS at all. DoH isn't "magic". It's just a simple, standardised protocol

by growse 2y ago

An antagonistic device on your network that wants to resolve names doesn't need to use DNS at all. DoH isn't "magic". It's just a simple, standardised protocol. It's existence makes it no more or less easy for adversarial actors to do name resolution.

chgs 2y ago
The choice of DoH is not set from dhcp or the OS, it’s set by the application developer. And that’s wrong. DNS should be an OS level tool which is consistent to all applications, not an application by application setting. As the device owner I expect dns to be ck distant whether I run Firefox, chromium, zoom, curl, steam, ping, or he dozens of other programs I run.
- HeatrayEnjoyer 2y ago
  Why should it be system wide? That's a broad and imprecise policy vs app by app.
  - ruthmarx 2y ago
    The bigger issue is that it should be an OS level setting. Different apps having a different option isn't the issue, it's any app being able to trivially override a user choice, sometimes without notification.
    - growse 2y ago
      Again, the existence of DoH has zero bearing on whether or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution.
      - TacticalCoder 2y ago
        A huge shitload of the Internet is the Web. The reason I force DNS over UDP to my own DNS resolver is not so that chinese-internet-of-shitty-insecure-device (which I don't own) cannot phone home: I do it so that I'm in control of what the browsers can access over HTTPS (my browsers are all HTTPS-only). > or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution Then meet firewalls. The users accounts running browsers on my setup can access HTTPS over port 443 and query UDP to my local DNS resolver. A webapp (i.e. a software written by someone else) is not bypassing that "networking stack" that easily. Regarding name resolution: except some very rare cases where https shall work directly with IP addresses, a browser using https only will only work for domains that have valid certificates. Which is why blocking hundreds of thousands --or millions-- of domains at the DNS level is so effective. And if there are known fixed https://IP_address https://IP_address addresses with valid certificate that are nefarious, they're trivial to block with a firewall anyway. I'm in control of my LAN, my router, and my machines and webapps written by others either respect HTTPS or get the middle finger from my firewall(s). Not https over port 443? No network for you. Reading all your nitpicking posts you make it sound like firewalls and local DNS intercepting and blocking DNS requests aren't effective. But in practice it is hugely effective.
        jasonjayr 2y ago
        I hope you can appreciate that DoH is meant to protect against a nefarious intermediary between the device/application and the server it's trying to reach. The crux of the problem is that the device/application can't tell if the interference is friend or foe. All the techniques you can legitimately use on your local network, and that network operators have used in the past, can all be used one hop beyond the network you control. And, sadly, in 2024, most OS vendors are "in the game" of making sure they can 100% control the link and execution environment between themselves and their servers, without interference from the network operators along the way, OR the device owner.
      - ruthmarx 2y ago
        Again, the point is it should be an OS level setting and apps should respect it. Just because apps can be hostile to user intentions doesn't mean we should allow or worse advocate for that.
        growse 2y ago
        I don't see anyone advocating for hostility. Merely the observation that wishing it away is naive.
        ruthmarx 2y ago
        Well that's odd, since I don't see anyone 'wishing it away' so much as stating apps should respect OS settings and it's reasonable for that to be an expectation of well behaving programs.
    - Brian_K_White 2y ago
      This is silly and not well thought out. The knowledge of what ip address correlates to some hostname is just data like any other data. There is nothing magically specially different about it, and no way to differentiate it from any other random data that every single process processes. It's a meaninless wish for something that you can't have, that we all agree would be nice, but is silly to expect. An app can simply include it's own hard coded list of ips if it wants, or some totally home grown method for resolving a name to a number from any source. It's just key=value like all the infinite other data that every app processes. normal dns and doh are nothing but standards and conveniences, they don't actually control or dictate anything. You wish apps couldn't do that? So what? Do you also want a pony?
      - ruthmarx 2y ago
        > This is silly and not well thought out. I'd say the same for this unnecessary ad hominem. > The knowledge of what ip address correlates to some hostname is just data like any other data. There is nothing magically specially different about it, and no way to differentiate it from any other random data that every single process processes. This is a basic truth that has no bearing on what I said above. > It's a meaninless wish for something that you can't have, that we all agree would be nice, but is silly to expect. It's how it worked for personal computing almost since it became popular in the 90s. Most apps would use the OS set DNS setting. Apps choosing to ignore that and do their own queries is a much more recent thing. > An app can simply include it's own hard coded list of ips if it wants, or some totally home grown method for resolving a name to a number from any source. Yes. This also has no bearing on my point. > You wish apps couldn't do that? So what? Do you also want a pony? Wishing apps are not hostile to user intentions is not a fantastical or ignorant desire. Just because apps can be hostile to user intentions does not mean we should accept that as normal or advocate for it.
  - A4ET8a8uTh0 2y ago
    Because, as an example, as a person responsible for network at my house, I do not want to check whether my child installed another app and check each app one by one ( and that check has to be done and redone every time something changes or someone touches the app ). I want one global setting that says 'Non possumus'. edit: Unless, naturally, I am no longer an admin and any control I have over my hardware is merely an illusion.
    - Brian_K_White 2y ago
      I hate to break it to you, but there is nothing special about hostnames and ips. They are just a tiny bit of key=value data that can be stored or transmitted infinitely different ways. dns and doh are nothing but convenient standards that no one and no app actually has to use. It doesn't matter how much you might want otherwise. It doesn't matter how important and virtuous the reason you want it is. Even invoking the mighty untouchable power of "my daughter" does not change such a simple fact of life.
      - A4ET8a8uTh0 2y ago
        It seems like we are arguing for the same outcome. I want to be able to control things within my control. Based on what your wrote, it seems you would support that?
        Brian_K_White 2y ago
        The question has no meaning. "control things within your control" is like a truism, grammatically and logically valid yet says nothing. The point was that it's pointless to even think in terms of "apps and devices going around my choke point" because there never was a choke point in the first place. If you want to prevent an app or device on your network from accessing an IP, you must 1: Ensure the app or device has no wifi or cell or any other possible physical connection of it's own that could allow it to reach the internet without going through your router. 2: Block the ip, by ip, in your router, and also any other ip that could serve as a proxy or relay. It is impossible to know what all those IPs are, so what is possible instead is whitelisting instead of blacklisting. You could do that, but was it useful or interesting to even say? Didn't you and everyone else already know all that?

by growse 2y ago

chgs 2y ago

The choice of DoH is not set from dhcp or the OS, it’s set by the application developer. And that’s wrong. DNS should be an OS level tool which is consistent to all applications, not an application by application setting. As the device owner I expect dns to be ck distant whether I run Firefox, chromium, zoom, curl, steam, ping, or he dozens of other programs I run.

HeatrayEnjoyer 2y ago
Why should it be system wide? That's a broad and imprecise policy vs app by app.
- ruthmarx 2y ago
  The bigger issue is that it should be an OS level setting. Different apps having a different option isn't the issue, it's any app being able to trivially override a user choice, sometimes without notification.
  - growse 2y ago
    Again, the existence of DoH has zero bearing on whether or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution.
    - TacticalCoder 2y ago
      A huge shitload of the Internet is the Web. The reason I force DNS over UDP to my own DNS resolver is not so that chinese-internet-of-shitty-insecure-device (which I don't own) cannot phone home: I do it so that I'm in control of what the browsers can access over HTTPS (my browsers are all HTTPS-only). > or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution Then meet firewalls. The users accounts running browsers on my setup can access HTTPS over port 443 and query UDP to my local DNS resolver. A webapp (i.e. a software written by someone else) is not bypassing that "networking stack" that easily. Regarding name resolution: except some very rare cases where https shall work directly with IP addresses, a browser using https only will only work for domains that have valid certificates. Which is why blocking hundreds of thousands --or millions-- of domains at the DNS level is so effective. And if there are known fixed https://IP_address https://IP_address addresses with valid certificate that are nefarious, they're trivial to block with a firewall anyway. I'm in control of my LAN, my router, and my machines and webapps written by others either respect HTTPS or get the middle finger from my firewall(s). Not https over port 443? No network for you. Reading all your nitpicking posts you make it sound like firewalls and local DNS intercepting and blocking DNS requests aren't effective. But in practice it is hugely effective.
      - jasonjayr 2y ago
        I hope you can appreciate that DoH is meant to protect against a nefarious intermediary between the device/application and the server it's trying to reach. The crux of the problem is that the device/application can't tell if the interference is friend or foe. All the techniques you can legitimately use on your local network, and that network operators have used in the past, can all be used one hop beyond the network you control. And, sadly, in 2024, most OS vendors are "in the game" of making sure they can 100% control the link and execution environment between themselves and their servers, without interference from the network operators along the way, OR the device owner.
    - ruthmarx 2y ago
      Again, the point is it should be an OS level setting and apps should respect it. Just because apps can be hostile to user intentions doesn't mean we should allow or worse advocate for that.
      - growse 2y ago
        I don't see anyone advocating for hostility. Merely the observation that wishing it away is naive.
        ruthmarx 2y ago
        Well that's odd, since I don't see anyone 'wishing it away' so much as stating apps should respect OS settings and it's reasonable for that to be an expectation of well behaving programs.
  - Brian_K_White 2y ago
    This is silly and not well thought out. The knowledge of what ip address correlates to some hostname is just data like any other data. There is nothing magically specially different about it, and no way to differentiate it from any other random data that every single process processes. It's a meaninless wish for something that you can't have, that we all agree would be nice, but is silly to expect. An app can simply include it's own hard coded list of ips if it wants, or some totally home grown method for resolving a name to a number from any source. It's just key=value like all the infinite other data that every app processes. normal dns and doh are nothing but standards and conveniences, they don't actually control or dictate anything. You wish apps couldn't do that? So what? Do you also want a pony?
    - ruthmarx 2y ago
      > This is silly and not well thought out. I'd say the same for this unnecessary ad hominem. > The knowledge of what ip address correlates to some hostname is just data like any other data. There is nothing magically specially different about it, and no way to differentiate it from any other random data that every single process processes. This is a basic truth that has no bearing on what I said above. > It's a meaninless wish for something that you can't have, that we all agree would be nice, but is silly to expect. It's how it worked for personal computing almost since it became popular in the 90s. Most apps would use the OS set DNS setting. Apps choosing to ignore that and do their own queries is a much more recent thing. > An app can simply include it's own hard coded list of ips if it wants, or some totally home grown method for resolving a name to a number from any source. Yes. This also has no bearing on my point. > You wish apps couldn't do that? So what? Do you also want a pony? Wishing apps are not hostile to user intentions is not a fantastical or ignorant desire. Just because apps can be hostile to user intentions does not mean we should accept that as normal or advocate for it.
- A4ET8a8uTh0 2y ago
  Because, as an example, as a person responsible for network at my house, I do not want to check whether my child installed another app and check each app one by one ( and that check has to be done and redone every time something changes or someone touches the app ). I want one global setting that says 'Non possumus'. edit: Unless, naturally, I am no longer an admin and any control I have over my hardware is merely an illusion.
  - Brian_K_White 2y ago
    I hate to break it to you, but there is nothing special about hostnames and ips. They are just a tiny bit of key=value data that can be stored or transmitted infinitely different ways. dns and doh are nothing but convenient standards that no one and no app actually has to use. It doesn't matter how much you might want otherwise. It doesn't matter how important and virtuous the reason you want it is. Even invoking the mighty untouchable power of "my daughter" does not change such a simple fact of life.
    - A4ET8a8uTh0 2y ago
      It seems like we are arguing for the same outcome. I want to be able to control things within my control. Based on what your wrote, it seems you would support that?
      - Brian_K_White 2y ago
        The question has no meaning. "control things within your control" is like a truism, grammatically and logically valid yet says nothing. The point was that it's pointless to even think in terms of "apps and devices going around my choke point" because there never was a choke point in the first place. If you want to prevent an app or device on your network from accessing an IP, you must 1: Ensure the app or device has no wifi or cell or any other possible physical connection of it's own that could allow it to reach the internet without going through your router. 2: Block the ip, by ip, in your router, and also any other ip that could serve as a proxy or relay. It is impossible to know what all those IPs are, so what is possible instead is whitelisting instead of blacklisting. You could do that, but was it useful or interesting to even say? Didn't you and everyone else already know all that?