111–120 of 195 posts
Earlier quoted context omitted.
efficiency = performance / resources Efficient has connotations of economy, of optimal use of resources but with a hint of parsimony - another way to get efficiency is to reduce the denominator. Performant emphasises the numerator much more.
*increase the denominator. nitpick aside, agreed
Earlier quoted context omitted.
Easier to prevent censoring. DNSSEC doesn't hide the fact that you're making a DNS call, correct? With HTTPS, censors/MITMs can only see the domain you go to. The censor/MITM won't know whether I went to google.com to search or perform DNS query. Plenty of countries have blocked DNS providers they don't like, now that's harder w/out also blocking the site as a whole.
Easier to prevent censoring from the ISP, but you're now just reliant on another company's systems. If you just want a solution for having a remote server execute DNS queries for you, you can just use any of the existing VPN protocols purely for DNS resolution, or even make a better performing version. All that overhead HTTP adds is wasted for this.
Anyone has good pointers on DNS over DTLS (draft RFC 8094) vs DNS over TLS (RFC 7858) vs DNS over HTTPS (this draft) ? And if you could throw in DNSSEC in the mix, that would be helpful.
With pleasure - (CTO of DNSFilter, this is my world) DNS over DTLS (RFC 8094) speaks only to UDP This could be compared with DNSCrypt's implementation DNS over TLS (RFC 7858) is TCP focused DNS over HTTPs is focused on... you guessed it, HTTPs So all the same thing, all trying to add security and privacy, just over different transport mechanisms. While we're at it -- you did not mention DNS over QUIC: https://tools.i…
I didn't even know about dns-over-QUIC, but considering QUIC is still a draft itself… (I've been excited about it for quite a while though).
Regarding middleboxes, I forgot about those, and it's very sad that they keep hindering progress this way.
Earlier quoted context omitted.
Performant to me implies performing better against the relevant metrics. So faster, maybe, but perhaps smaller and more energy efficient too. If the context of the metrics is already understood then it seems quite a cromulent word.
What's cromulent mean? I looked it up at dictionary.com and couldn't find anything. Or are you making up more words to point out the irony? :)
I am just wondering why would you want DNS over https instead of something like dnscrypt which would be dns over ssl ( I think opendns does this already) ?
I am just wondering why would you want DNS over https instead of something like dnscrypt which would be dns over ssl ( I think opendns does this already) ?
My guess is meddling corporate firewalls that spy on SSL/TLS traffic (using custom certs installed on the machines) and block unrecognized traffic.
“...for privacy...” and “Google runs one...” Strikes me as funny. Interesting concept apart from this detail though. Are there any servers that aren’t owned by advertisers and the like?
Here is a somewhat decent list: https://www.lifewire.com/free-and-public-dns-servers-2626062
You can also just run your own too. I run one from a VPS.
I really hope this doesn't catch on widely. It should be a tool for use where censorship issues can't be solved politically. Otherwise, why even have protocols at all? Just say the only protocol is HTTP. IP, etc. are just an HTTP implementation detail.
I would love this to catch on wildly! DNS through TLS means it's all end-to-end encrypted, DNS reflection attacks are harder, etc. The "why even have protocols" doesn't make sense. Protocol can be layered just fine (HTTP itself is a good example). DNS as it exists now is another random special snowflake that vendors need corresponding snowflake implementations for.
I didn't say I'm against DNS being encrypted, even with TLS. I just hate that instead of doing the right thing (e.g. political battle with the government, opening a port on a firewall) people choose the laziest way: just tunnel it over HTTP.
>Protocol can be layered just fine (HTTP itself is a good example)
They can, but why do it? Just figure out a way to make your server be yet-another-"REST"-service and pat yourself on the back for cleverness.
>DNS as it exists now is another random special snowflake that vendors need corresponding snowflake implementations for.
As is: SMTP, POP, IMAP, SSH, AMQP, FIX, SWIFT, LDAP, ODBC and a host of other protocols. Why do you use negative language like "random special snowflake that vendors need corresponding snowflake implementations for"? These are seperate protocols, which serve seperate specific needs. This is how IP was designed to work.
> for privacy, performance and security. I understand the privacy and security aspects. But I am wondering - how can DNS over HTTPS be more performant in the case of curl commands? A browser could probably persist the connection to the resolver and issue several requests together, but with a single curl command surely there's the overhead of initiating the first DNS resolve, the HTTPS connection, the second DNS resol…
> Side note - I just learned that performant is not a recognized word ( https://english.stackexchange.com/questions/38945/what-is-wr... ) I don't personally use the word since there are many alternatives, but its use is now definitely widespread and consistently understood. There's really no argument against the fact that it has entered the English lexicon.