4 ms·

Again, the existence of DoH has zero bearing on whether or not software written by someone else chooses to use the OS networking stack or even respect your desi

by growse 2y ago

Again, the existence of DoH has zero bearing on whether or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution.

TacticalCoder 2y ago
A huge shitload of the Internet is the Web. The reason I force DNS over UDP to my own DNS resolver is not so that chinese-internet-of-shitty-insecure-device (which I don't own) cannot phone home: I do it so that I'm in control of what the browsers can access over HTTPS (my browsers are all HTTPS-only). > or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution Then meet firewalls. The users accounts running browsers on my setup can access HTTPS over port 443 and query UDP to my local DNS resolver. A webapp (i.e. a software written by someone else) is not bypassing that "networking stack" that easily. Regarding name resolution: except some very rare cases where https shall work directly with IP addresses, a browser using https only will only work for domains that have valid certificates. Which is why blocking hundreds of thousands --or millions-- of domains at the DNS level is so effective. And if there are known fixed https://IP_address https://IP_address addresses with valid certificate that are nefarious, they're trivial to block with a firewall anyway. I'm in control of my LAN, my router, and my machines and webapps written by others either respect HTTPS or get the middle finger from my firewall(s). Not https over port 443? No network for you. Reading all your nitpicking posts you make it sound like firewalls and local DNS intercepting and blocking DNS requests aren't effective. But in practice it is hugely effective.
- jasonjayr 2y ago
  I hope you can appreciate that DoH is meant to protect against a nefarious intermediary between the device/application and the server it's trying to reach. The crux of the problem is that the device/application can't tell if the interference is friend or foe. All the techniques you can legitimately use on your local network, and that network operators have used in the past, can all be used one hop beyond the network you control. And, sadly, in 2024, most OS vendors are "in the game" of making sure they can 100% control the link and execution environment between themselves and their servers, without interference from the network operators along the way, OR the device owner.
ruthmarx 2y ago
Again, the point is it should be an OS level setting and apps should respect it. Just because apps can be hostile to user intentions doesn't mean we should allow or worse advocate for that.
- growse 2y ago
  I don't see anyone advocating for hostility. Merely the observation that wishing it away is naive.
  - ruthmarx 2y ago
    Well that's odd, since I don't see anyone 'wishing it away' so much as stating apps should respect OS settings and it's reasonable for that to be an expectation of well behaving programs.

by growse 2y ago

Again, the existence of DoH has zero bearing on whether or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution.

TacticalCoder 2y ago

A huge shitload of the Internet is the Web. The reason I force DNS over UDP to my own DNS resolver is not so that chinese-internet-of-shitty-insecure-device (which I don't own) cannot phone home: I do it so that I'm in control of what the browsers can access over HTTPS (my browsers are all HTTPS-only). > or not software written by someone else chooses to use the OS networking stack or even respect your desires when it comes to name resolution Then meet firewalls. The users accounts running browsers on my setup can access HTTPS over port 443 and query UDP to my local DNS resolver. A webapp (i.e. a software written by someone else) is not bypassing that "networking stack" that easily. Regarding name resolution: except some very rare cases where https shall work directly with IP addresses, a browser using https only will only work for domains that have valid certificates. Which is why blocking hundreds of thousands --or millions-- of domains at the DNS level is so effective. And if there are known fixed https://IP_address https://IP_address addresses with valid certificate that are nefarious, they're trivial to block with a firewall anyway. I'm in control of my LAN, my router, and my machines and webapps written by others either respect HTTPS or get the middle finger from my firewall(s). Not https over port 443? No network for you. Reading all your nitpicking posts you make it sound like firewalls and local DNS intercepting and blocking DNS requests aren't effective. But in practice it is hugely effective.

jasonjayr 2y ago
I hope you can appreciate that DoH is meant to protect against a nefarious intermediary between the device/application and the server it's trying to reach. The crux of the problem is that the device/application can't tell if the interference is friend or foe. All the techniques you can legitimately use on your local network, and that network operators have used in the past, can all be used one hop beyond the network you control. And, sadly, in 2024, most OS vendors are "in the game" of making sure they can 100% control the link and execution environment between themselves and their servers, without interference from the network operators along the way, OR the device owner.

ruthmarx 2y ago

Again, the point is it should be an OS level setting and apps should respect it. Just because apps can be hostile to user intentions doesn't mean we should allow or worse advocate for that.

growse 2y ago
I don't see anyone advocating for hostility. Merely the observation that wishing it away is naive.
- ruthmarx 2y ago
  Well that's odd, since I don't see anyone 'wishing it away' so much as stating apps should respect OS settings and it's reasonable for that to be an expectation of well behaving programs.