5 ms·
Where is the DNS headed?
- Ericson2314 6y agos/HTML/HTTP/c in a few places.
- teddyh 6y agoWhat does the “c” flag do?
- iso947 6y agoI think it’s forcing case sensitive. I’ve never seen it though.
- dredmorbius 6y ago"Confirm". It prompts for verification before substituting, in vim: https://www.linux.com/training-tutorials/vim-tips-basics-search-and-replace/ https://www.linux.com/training-tutorials/vim-tips-basics-sea...
- Ericson2314 6y agooh gawd I just type the `c` out of habit now. that wasn't intentional at all.
- dredmorbius 6y agoConfirmed ;-)
- deleted 6y ago[deleted]
- dpenguin 6y agoThere are a lot of arguments about how DoH with TLS 1.3 will give us privacy etc by the proponents of DoH(not this article).. but it’s basically moving the trust from ISPs to CDNs. There are fewer major browsers and fewer major CDNs than ISPs, I suppose.. so not sure if it’s a good move.
- deleted 6y ago[deleted]
- kd913 6y agoPeople can host their own DoH server themselves. If I can setup DoH and a VPN over one weekend with a Raspberry Pi, then others can do it too. I am using DNSCryptProxy on a Pi and it fully supports DoH + eSNI even without cloudflare. Works perfectly with Firefox. The service picks from 65 DoH servers based against the fastest ping time. That was/is a lot better than before when in reality my only choice was my ISP DNS. In fact I just learned for the last few years that my ISP was hijacking all DNS requests anyway.
- Ericson2314 6y agoWhy can't the ISPs run DoH too? I agree that due to social issues the problems are fairly real (ISPs ain't gonna do shit). But on a purely technical level DoH should be fine.
- gsich 6y agoThey can. But the problem lies with Browsers (looking especially at Firefox) just ignoring that. The technical aspects of DoH (or DoT) are fine.
- tialaramex 6y agoMozilla provides a clear policy for how you get your resolver onto their list. US ISPs (the DoH resolver is only enabled by default in the US) could obey that policy and apply to be added to the list. But it seems like none of them have done that. Maybe the policy terms are objectionable? Let's see: "Only aggregate data that does not identify individual users or requests may be retained beyond 24 hours." But how will the poor ISP make extra money selling DNS query information? "When a domain requested by the user is not present, the party operating the resolver should provide an accurate NXDOMAIN response and must not modify the response or provide inaccurate responses that direct the user to alternative content." An ISP that obeys this can't put up advertising banners or sell search engine redirects when you typo a name - they'll have to actually earn money providing Internet service instead.
- troquerre 6y agoThere will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake (https://handshake.org https://handshake.org) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it shows promise with NextDNS.io and Vercel.com supporting it. [1] CDNs are a lesser evil than ISPs but I still wouldn’t want to need to trust them to protect my privacy.
- stiray 6y agoThis is also my concern. ISPs are typically located in same country making them follow the laws of that country. I belive authors of the DoH idea were doing it with good intentions but road to hell is paved with good intentions. What we are doing with DoH is actually breaking decentralised internet infrastructure to centralized (or lets say, less centralized...for now) and this was never a good thing (historywise). For test why is this bad you can try to block google and amazon ASNs and try to surf around the web. You will notice that the internet is quite different (a hint, yandex.ru was the only search engine I have found that still works) For instance selling the information about user accessing some domain would be a big no-no in my country. They are obliged by law to protect customers information except if ordered by court. With DoH all bets are off. Surely it will give some privacy for users where ISPs are sticking their noses into customers data (like in USA), they wont be able to do it anymore but for me, I trust in our ISPs (or laws) while I surely dont trust google or cloudflare. We will just give internet resolving into hands of multinational corporations, what could go wrong, right? (Just quick ideas: for $10 / day we offer redirection from yourdomain.com to sellingcrap.com or we resolve .ourinternaldomain only over DoH and not resolve to external ips to force you to use our DoH,...)
- kitteh 6y agoWhat about your ISPs employees? Do you trust a sysadmin pulling 40-50k a year (or less) to not sell your DNS resolver data? Do you think your ISP has better controls and a security team than some of the big CDNs and cloud providers to detect and prevent this? The reason I bring it up is because I know a number of ISPs whose sysadmins were on the take and selling bulk regular dumps of DNS resolver data under the table to other parties for years.
- Hnrobert42 6y agoIf I understand correctly, the author presents a case for securing DNS by moving away from a shared directory toward application-specific directories. At the end, he takes a sharp turn to worry that such a move will tear apart the openness of the internet. I suppose an analogy is moving from phone numbers, with shared telco-managed directories, to chat apps managing their own directories. You can’t contact me on Instagram with my HN handle because they don’t use shared directories. Ok, but there are more important reasons. Walled-garden directories is a symptom not a cause. For that matter, SNI and path-based load balancers are examples of the application-level address resolution overlay already in practice. Those techniques merely implement, not drive, balkanization. Basically, application-layer DNS doesn’t pass the “but for” test. As in, it is not correct to say “but for application-layer DNS, Facebook/WeChat/Google couldn’t build walled gardens. With it they can.”
- Santosh83 6y agoHow is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying? Surely nothing stops your favourite ISP or any other local startup from providing DoH services right? Presumably the DNS servers will still talk to each other on the backend over plain text, but if a DoH front-end can be provided by ANY DNS service then how can it be accused of centralising the Internet?
- vetinari 6y ago> How is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying? It is not merely encrypting the information. Hand-in-hand comes running the resolvers (which, as you noted everyone can) and having all the DNS-using software use them. Which is much bigger problem, that causes the centralization. Applications are coming today hard-coded for a specific resolver. Configuring it is application-specific and not-automatable, and certainly not automatable in generic manner for all applications. I.e. as a network operator you cannot say that everyone should be using this or that resolver, as you can with the plain old 53/udp DNS and DHCP. Users are not going to reconfigure each and every application every time they change their network. They will leave it at the default value. The net effect is that the centralization will just happen.
- zamadatix 6y agoApplications can choose to ignore the system resolver regardless if it's over UDP or HTTPS. DoH/DoT is showing up in operating system resolvers just not as fast as apps like browsers were willing/able to add it. Standard DHCP options for defining DoH details are still missing though (I think, haven't checked in a while)
- vetinari 6y ago> Applications can choose to ignore the system resolver regardless if it's over UDP or HTTPS. They can, but up until Firefox legitimized this practice, they didn't, maybe except some malware. > DoH/DoT is showing up in operating system resolvers just not as fast as apps like browsers were willing/able to add it. The browsers were so fast, that they skipped the discussion about ramification of this change with the rest of community and just abused their position. One might even wonder, why. Does not make for good relations in future. > Standard DHCP options for defining DoH details are still missing though Yup. Here, browsers are not using their position to finish their push, so maybe the situation is acceptable for them.