3 ms·

Don't forget the push for browsers to ignore your DHCP-provided DNS server and instead get their DNS from a server outside your control over an encrypted tunnel

Don't forget the push for browsers to ignore your DHCP-provided DNS server and instead get their DNS from a server outside your control over an encrypted tunnel. It's an obvious attack on stuff like PiHole, with little to no real upside for users.

WhyNotHugo 2y ago
I avoid DHCP-provided DNS and use a local copy of unbound which does DNSSEC validation. A home I control the DHCP, but everywhere else, you can get any sort of custom crap.
1vuio0pswjnm7 2y ago
If this is in reference to DoH then I found an upside. Generally, DoH servers allow HTTP/1.1 pipelining by default. This allows one to fetch DNS data in bulk over a single TCP connection. The DNS specification RFC 1035 suggests that computer users would be able to send multiple queries in a single _packet_: QDCOUNT is any unsigned 16-bit integer. The implementation of servers that can handle QDCOUNT greater than 1 has not happened. But at least with DoH I can send multiple queries over a single TCP connnection. Once retrieved, I load the DNS data into the memmory of the "MITM proxy". This eliminates the need for DNS queries to be immediately proceeding associated HTTP requests for web pages, etc., or within some DNS cache duration period. When I use other sources of DNS data^1, I eliminate the need for remote DNS queries altogether. 1. For example, I extract DNS data from Common Crawl data. Indeed, it does not seem like DoH was implemented to improve life for computer users but, at least for me, it can be useful. It can also be useful for example to computer users who use remote DNS servers where their ISP is hijacking port 53.
1vuio0pswjnm7 2y ago
One point to support this is that any "privacy" offered by DoH is generally defeated by the TLS SNI extension exposing cleartext domain names on the wire. (Exception being use of ECH-enabled browsers^1 to access Cloudflare-hosted websites that support ECH. But even then, there is no privacy from Cloudflare. HN commenters have historically acknowledged Cloudflare is itself a "MITM".) 1. Test: https://defo.ie https://defo.ie

WhyNotHugo 2y ago

I avoid DHCP-provided DNS and use a local copy of unbound which does DNSSEC validation. A home I control the DHCP, but everywhere else, you can get any sort of custom crap.

1vuio0pswjnm7 2y ago

If this is in reference to DoH then I found an upside. Generally, DoH servers allow HTTP/1.1 pipelining by default. This allows one to fetch DNS data in bulk over a single TCP connection. The DNS specification RFC 1035 suggests that computer users would be able to send multiple queries in a single _packet_: QDCOUNT is any unsigned 16-bit integer. The implementation of servers that can handle QDCOUNT greater than 1 has not happened. But at least with DoH I can send multiple queries over a single TCP connnection. Once retrieved, I load the DNS data into the memmory of the "MITM proxy". This eliminates the need for DNS queries to be immediately proceeding associated HTTP requests for web pages, etc., or within some DNS cache duration period. When I use other sources of DNS data^1, I eliminate the need for remote DNS queries altogether. 1. For example, I extract DNS data from Common Crawl data. Indeed, it does not seem like DoH was implemented to improve life for computer users but, at least for me, it can be useful. It can also be useful for example to computer users who use remote DNS servers where their ISP is hijacking port 53.

1vuio0pswjnm7 2y ago

One point to support this is that any "privacy" offered by DoH is generally defeated by the TLS SNI extension exposing cleartext domain names on the wire. (Exception being use of ECH-enabled browsers^1 to access Cloudflare-hosted websites that support ECH. But even then, there is no privacy from Cloudflare. HN commenters have historically acknowledged Cloudflare is itself a "MITM".) 1. Test: https://defo.ie https://defo.ie