11–20 of 155 posts
This sounds great. Does anyone know if any web servers are planning on implementing it?
> If they’re willing to convert all their customers to ESNI at once
Why does it seem like this is over-engineering at it's finest? Not only are CDNs now part of the problem/solution space, but they are now dictating.
It is now that much harder to diagnose issues when they do crop up, instead of checking ping or nslookup. Now, you've got to see if the DNS-over-HTTPS/The DNS record itself/Host/client/any number of other steps is broken.
We've completely removed the ability for a poweruser to diagnose before calling their resident IT professional.
Earlier quoted context omitted.
If the public key was stored in a TXT record and accessed via regular DNS, then someone snooping the connection could see that you made a DNS lookup for that domain, and could make the reasonable assumption that you were about to make a request to said domain.
Could also use DoT - DNS over TLS. Otherwise, this sounds suspiciously a lot like DANE, which cert authorities hate, since there would be no use for them. https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
Is it me or... > If they’re willing to convert all their customers to ESNI at once Why does it seem like this is over-engineering at it's finest? Not only are CDNs now part of the problem/solution space, but they are now dictating. It is now that much harder to diagnose issues when they do crop up, instead of checking ping or nslookup. Now, you've got to see if the DNS-over-HTTPS/The DNS record itself/Host/client/any…
Is it me or... > If they’re willing to convert all their customers to ESNI at once Why does it seem like this is over-engineering at it's finest? Not only are CDNs now part of the problem/solution space, but they are now dictating. It is now that much harder to diagnose issues when they do crop up, instead of checking ping or nslookup. Now, you've got to see if the DNS-over-HTTPS/The DNS record itself/Host/client/any…
I hope they add DNS resolution to the network activity tab.
Is it me or... > If they’re willing to convert all their customers to ESNI at once Why does it seem like this is over-engineering at it's finest? Not only are CDNs now part of the problem/solution space, but they are now dictating. It is now that much harder to diagnose issues when they do crop up, instead of checking ping or nslookup. Now, you've got to see if the DNS-over-HTTPS/The DNS record itself/Host/client/any…
There are benefits (censorship circumvention) to be reaped, but also great peril.
Is it me or... > If they’re willing to convert all their customers to ESNI at once Why does it seem like this is over-engineering at it's finest? Not only are CDNs now part of the problem/solution space, but they are now dictating. It is now that much harder to diagnose issues when they do crop up, instead of checking ping or nslookup. Now, you've got to see if the DNS-over-HTTPS/The DNS record itself/Host/client/any…
I hope they add DNS resolution to the network activity tab.
If a browser starts (purposefully) subverting the hosts file or not adhering to resolv addresses, then we've got a bigger problem.
Think, a fat client resolving an address differently than a browser; then that's all sort of Pandora's Box.
I'm curious why this is tied to DNS-over-HTTPS. It looks like Cloudflare is including a public key in the DNS lookup, which is used to encrypt the SNI information. Couldn't this key be stored in a TXT record for normal DNS lookups as well?
If the public key was stored in a TXT record and accessed via regular DNS, then someone snooping the connection could see that you made a DNS lookup for that domain, and could make the reasonable assumption that you were about to make a request to said domain.
And since DNS queries are commonly cached locally (i.e. dns server == my computer a reasonable percentage of the time) that's not even a rare occurrence.
Is it me or... > If they’re willing to convert all their customers to ESNI at once Why does it seem like this is over-engineering at it's finest? Not only are CDNs now part of the problem/solution space, but they are now dictating. It is now that much harder to diagnose issues when they do crop up, instead of checking ping or nslookup. Now, you've got to see if the DNS-over-HTTPS/The DNS record itself/Host/client/any…
It's not you. It's a combination of startups and incumbent tech behemoths attempting to operate outside of the formalized process for internet standards by using their market power to push for the change they deem appropriate. There are benefits (censorship circumvention) to be reaped, but also great peril.
Earlier quoted context omitted.
It's not you. It's a combination of startups and incumbent tech behemoths attempting to operate outside of the formalized process for internet standards by using their market power to push for the change they deem appropriate. There are benefits (censorship circumvention) to be reaped, but also great peril.
Funny, I think we've had exactly the opposite problem . See, for instance, Heartbleed, which is pure product of IETF standardization of a feature no mainstream commercial entity asked for.