Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Measuring open DNS resolver use

blog.apnic.net

Post reply on HN
Print view View original

11–20 of 53 posts

Re: Measuring open DNS resolver use

#11

Post by tptacek »

mike_d wrote: post #9
tptacek wrote: post #6

Earlier quoted context omitted.

It's not. It's an unalloyed good thing. The concern is with configurations that make it hard to use anything but Cloud Flare. There are alternatives.

From a security and privacy standpoint I think DoH is a good thing. I wish it didn't have the overhead of TCP/HTTP (which is why I was a bigger fan of DNSCrypt). Anyone can stand up a resolver that can handle 50k UDP requests a second and operate a public resolver. It starts to get operationally dicey to stand up infrastructure that can do 50k HTTP requests a second. As a result you end up with a small handful of pla…

I don't buy it. At 50k requests per second, you're servicing a lot of users. Cost of customer acquisition dominates cost of serving the marginal 1000 HTTP requests. UDP doesn't make that business any more viable.

Re: Measuring open DNS resolver use

#12

Post by mike_d »

tptacek wrote: post #11
mike_d wrote: post #9

Earlier quoted context omitted.

From a security and privacy standpoint I think DoH is a good thing. I wish it didn't have the overhead of TCP/HTTP (which is why I was a bigger fan of DNSCrypt). Anyone can stand up a resolver that can handle 50k UDP requests a second and operate a public resolver. It starts to get operationally dicey to stand up infrastructure that can do 50k HTTP requests a second. As a result you end up with a small handful of pla…

I don't buy it. At 50k requests per second, you're servicing a lot of users. Cost of customer acquisition dominates cost of serving the marginal 1000 HTTP requests. UDP doesn't make that business any more viable.

Why does it need to be a business? A network of decentralized recursive resolvers operated by a number of different parties is preferable in almost every way to CloudFlare running a single endpoint.

The NTP pool works quite well on this model. It would be a much larger commitment for participants had to manage stateful connections.

Re: Measuring open DNS resolver use

#13

Post by bzbz »

tptacek wrote: post #11
mike_d wrote: post #9

Earlier quoted context omitted.

From a security and privacy standpoint I think DoH is a good thing. I wish it didn't have the overhead of TCP/HTTP (which is why I was a bigger fan of DNSCrypt). Anyone can stand up a resolver that can handle 50k UDP requests a second and operate a public resolver. It starts to get operationally dicey to stand up infrastructure that can do 50k HTTP requests a second. As a result you end up with a small handful of pla…

I don't buy it. At 50k requests per second, you're servicing a lot of users. Cost of customer acquisition dominates cost of serving the marginal 1000 HTTP requests. UDP doesn't make that business any more viable.

I don't think parent commenter is implying it has to be a commercial application. Imagine something released with little-to-no cost, with community-driven support and users that organically find the page. Not all services are commercial.

Re: Measuring open DNS resolver use

#14

Post by robertcope »

cracker_jacks wrote: post #4
PaulHoule wrote: post #3

I think DNS-over-HTTPS is a much bigger cause for concern.

What is the cause for concern? I am trying to understand why DNS-over-HTTPS could be a bad thing from the user end.

It makes it very hard to control your network. I have a DNS setup at home that I want all my equipment using. It blocks ads and other sites I don't want accessed. With DoH, I can't really be sure that browsers, devices, etc aren't using an alternative DNS system.

Re: Measuring open DNS resolver use

#15

Post by pingyong »

regecks wrote: post #7
tptacek wrote: post #6

Earlier quoted context omitted.

It's not. It's an unalloyed good thing. The concern is with configurations that make it hard to use anything but Cloud Flare. There are alternatives.

What do you think about Paul Vixie's views on DoH? On the face of it, it seems like we're going to end up with a bunch of black box devices (from Google, Amazon etc) in our homes that are totally immune to most forms of network policing because between DoH, ESNI, TLS and CDN fronting, you can't see anything .

If the device is a black box, you don't even need key exchanges though? You can just send encrypted data with a pre-configured, unique, randomly generated (for the device) key to a hard-coded IP-address. And even if you don't want to use a hard-coded IP-address, there are about a million ways to have some sort of custom encrypted "address resolution" through IRC or whatever else. In fact you could also just send the data to some Tor node or even base64 encoded through IRC. And a million other ways. It's not like DoH is really going to make a difference here. I mean you can even just send pings with what seems like randomly generated payloads that actually contain encrypted data. Really not sure what DoH is supposed to change about that. All it does is make spying with zero effort very slightly more difficult to detect.

Re: Measuring open DNS resolver use

#16

Post by pingyong »

robertcope wrote: post #14
cracker_jacks wrote: post #4

Earlier quoted context omitted.

What is the cause for concern? I am trying to understand why DNS-over-HTTPS could be a bad thing from the user end.

It makes it very hard to control your network. I have a DNS setup at home that I want all my equipment using. It blocks ads and other sites I don't want accessed. With DoH, I can't really be sure that browsers, devices, etc aren't using an alternative DNS system.

You can't be sure anyway though? The only thing that router controls are standard DNS queries, probably sent through a standard port. If they're using anything different at all, the router won't catch it, even if it's not encrypted.

Re: Measuring open DNS resolver use

#17

Post by kijin »

What this data shows is that concerns about centralization, especially in relation to DoH, are overblown. Only 1.15% of users in this dataset are using Cloudflare DNS, and APNIC is in a region riddled with government censorship and crappy ISPs -- two major incentives for people to try alternative resolvers. Without such incentives, nobody would even bother to change their devices' DNS settings.

I'm in a country with both of these problems, so every machine I set up gets Cloudflare as the primary resolver with Google as the secondary. Fix these problems first, and I won't have to do this anymore. Centralization? I dunno. Taking control of DNS away from my state and ISP would actually count as decentralization in my book.

Re: Measuring open DNS resolver use

#18

Post by tialaramex »

tptacek wrote: post #10
regecks wrote: post #7

Earlier quoted context omitted.

What do you think about Paul Vixie's views on DoH? On the face of it, it seems like we're going to end up with a bunch of black box devices (from Google, Amazon etc) in our homes that are totally immune to most forms of network policing because between DoH, ESNI, TLS and CDN fronting, you can't see anything .

Paul Vixie has been one of the Internet's most dedicated proponents of DNSSEC, a technology that essentially escrows keys with governments. If DNSSEC and DANE had progressed according to Vixie's preferred schedule, Muammar Gaddafi would have owned BIT.LY's CA. Vixie operates a company that relies on passive DNS observation to generate telemetry for corporations. Smart dude. Would not weight his privacy opinions heavi…

DNSSEC doesn't "essentially escrow keys with governments".

It's exactly as true to say that DANE gave Gaddafi ownership of bit.ly's CA as to say that today Boris Johnson owns the CA for slither.io - and as ridiculous. Back when you first started claiming this the Ten Blessed Methods weren't even a thing. You're complaining about the inadequate back door lock on a house that has the front door propped open.

I work for an outfit that buys passive DNS data (among other things) and all our suppliers agree that DoH makes no difference to their roadmaps - because they don't care who asked, only what the query and answer are. Is Vixie doing something vastly different? Maybe so but you've offered no evidence what that could be.

Re: Measuring open DNS resolver use

#19

Post by tialaramex »

pingyong wrote: post #15
regecks wrote: post #7

Earlier quoted context omitted.

What do you think about Paul Vixie's views on DoH? On the face of it, it seems like we're going to end up with a bunch of black box devices (from Google, Amazon etc) in our homes that are totally immune to most forms of network policing because between DoH, ESNI, TLS and CDN fronting, you can't see anything .

If the device is a black box, you don't even need key exchanges though? You can just send encrypted data with a pre-configured, unique, randomly generated (for the device) key to a hard-coded IP-address. And even if you don't want to use a hard-coded IP-address, there are about a million ways to have some sort of custom encrypted "address resolution" through IRC or whatever else. In fact you could also just send the…

It's really common for "security" products to assume bad guys will meekly obey conventions like telling the truth. "Are you a bad guy?" "No". Ok then, test passed.

Plenty of anti-TLS 1.3 stuff for example says that they "need" the plaintext Certificate message which in TLS 1.3 is now encrypted. But that message is literally just some public data - an X.509 certificate, if you're using it to "verify" anything your security is broken because a bad guy can send someone else's cert. They can't send a working CertificateVerify for it, but you don't know that because that message was never plaintext.

Post reply on HN