Earlier quoted context omitted.
Does the connection get reused?
Yes.
Not for long.
A cartoon intro to DNS over HTTPS
111–120 of 137 posts
Re: A cartoon intro to DNS over HTTPS
#112Earlier quoted context omitted.
Cloudflare itself never made sense to me. What possible incentive do they have to stop their primary purpose (DDoS protection) - They have value in promoting the behavior. Whats worse, is everyone and their dog is using them. What happens when they push a bad config to their core routers, or foobar their anycast?
It probably doesn't make sense because you misunderstand their primary purpose. It's not DDoS protection. Cloudflare has a pretty wide-spanning platform of products and services, but if you had to pick one out as their "primary", it would be their CDN product. The DDoS protection is just more visible because of the nature of the product (a good CDN will never make you aware it even exists), and because mitigating DDo…
> what you're saying is similar to "doctors don't make any sense to me. what possible incentive do they have for keeping people healthy
People do say this, all the time!
Re: A cartoon intro to DNS over HTTPS
#113Earlier quoted context omitted.
> "it makes more money" is hardly a thing that motivates corporations all the time Really? The primary purpose of any corporation is earning as much money as possible.
Okay, let's do it by having an analog. You are given advice on how to safely cross a four-way intersection by two companies. One is an insurance company specialised in people being run over by semi trucks at four way intersections. The other is a contractor that designs, builds and maintains four way intersections for the government and private entities. Of course, yes, the later could collude with the former to make…
Your analogy is bad because it describes behavior which is illegal. If you want to make as much money as possible, you might avoid decisions like the one you present which will cost you more money when it is exposed.
Re: A cartoon intro to DNS over HTTPS
#114Earlier quoted context omitted.
See this thread with one of the authors of the RFC: https://news.ycombinator.com/item?id=16728600
Everybody is right in this thread :) First, just to avoid confusion, the post linked to this HN article is just about the classic recursive resolver model. That's the scope of what is being experimented with actively. Second, the notion of resolverless dns (where dns records are obtained from somewhere other than your recursive resolver) is indeed something DoH contemplates but does not yet allow. That's because issu…
Also notice how the plan is to push not only DNS entries but also TLS certificates:
"Right now, people are really keen to get HTTP/2 “out the door,” so a few more advanced (and experimental) features have been left out, such as pushing TLS certificates and DNS entries to the client — both to improve performance. HTTP/3 might include these, if experiments go well."
https://www.mnot.net/blog/2014/01/30/http2_expectations
Some of those things could be used for bootstrapping SNI encryption as well:
https://www.ietf.org/mail-archive/web/tls/current/msg17474.h...
Re: A cartoon intro to DNS over HTTPS
#115Earlier quoted context omitted.
It does not need to be centralized at all. Any internet service provider with a modicum of Clue can install a DNS over https frontend listening on the IPs of their recursive resolvers, and pull data from their existing bind servers. This does not contain any sort of proprietary or non free software. People are free to ignore the content delivery Network provided recursive resolvers, and set up their own.
That is beside the point. What Firefox is doing is to actively distrust the DNS the ISP is advertising because of the bad practice of some ISPs. Even if the ISP would advertise a DoH endpoint, the same reasons for distrust would still exist (they only mention attacks at the ISP's DNS server or between the ISP's DNS server and the authoritative DNS servers). Also note that DNS is one of those dinosaur protocols like e…
People are understandably highly suspicious of DNS services and privacy issues with giant companies like Comcast, Verizon, Centurylink, etc. But I'd like to point out that there's a large number of small to mid sized ISPs where the final business management decisions rest with the individuals who also have 'enable' on the routers and core Linux/BSD server infrastructure.
There is such a thing as ethics in network engineering, and that term encompasses things like not attempting to MITM your customers' recursive DNS resolution queries, or monitoring/tracking/selling the data.
Re: A cartoon intro to DNS over HTTPS
#116Earlier quoted context omitted.
> Why else would they provide this service for free? Cloudflare runs the largest authoritative DNS server for their customers. The best way to make the DNS server faster is to make users query it directly. For Cloudflare-hosted domains, instead of: User → ISP's DNS resolver → ns.cloudflare.com. you get: User → [ 1111 → ns.cloudflare.com. ] where the latter two are on the same machine.
I work at Cloudflare, this is correct. 1.1.1.1 runs on our existing hardware deployed around the world, it costs us very little. When you use it it improves performance for the 8 million or so sites we sit in front of, that's our actual business.
Mozilla sends people to https://mozilla.cloudflare-dns.com/dns-query.
Can you explain why this site is blocked by uMatrix?
Re: A cartoon intro to DNS over HTTPS
#117Earlier quoted context omitted.
Okay, let's do it by having an analog. You are given advice on how to safely cross a four-way intersection by two companies. One is an insurance company specialised in people being run over by semi trucks at four way intersections. The other is a contractor that designs, builds and maintains four way intersections for the government and private entities. Of course, yes, the later could collude with the former to make…
Your analogy is bad because it describes behavior which is illegal. If you want to make as much money as possible, you might avoid decisions like the one you present which will cost you more money when it is exposed.
See recent behavior of Wells Fargo before you dismiss this. They have built the largest consumer bank on practices that were not legal. Even after some of those practices have been exposed they are #1. Millions of people with multiple semi-truck tire marks on their bodies still bank with them.
Re: A cartoon intro to DNS over HTTPS
#118Earlier quoted context omitted.
Your analogy is bad because it describes behavior which is illegal. If you want to make as much money as possible, you might avoid decisions like the one you present which will cost you more money when it is exposed.
See recent behavior of Wells Fargo before you dismiss this. They have built the largest consumer bank on practices that were not legal. Even after some of those practices have been exposed they are #1. Millions of people with multiple semi-truck tire marks on their bodies still bank with them.
I'm not saying that every for-profit company will abide by the law, but that they may have an inclination to do so because penalties would reduce their profits. So the comparison you are trying to make is not quite the same since there's a condition where a for-profit company might still do something ethically wrong (but legal) to make money, but avoid illegal behavior that would also make money (but cost them more if caught). For a recent example of this: facebook.
Re: A cartoon intro to DNS over HTTPS
#119Earlier quoted context omitted.
As an ISP, I'm skeptical of the motivations of big CDNs and Google in general, but it's becoming an ietf standard. I run recursive resolvers for clients numbering in the hundreds of thousands, with an ACL that allows only our ARIN IP blocks to query them. It is not hard to put a dns-over-https frontend in place for my clients which pulls queries from my own trusted bind9 servers. Any ISP with a clue can do the same.
What’s your ISP’s web address?
I share some controversial opinions on here semi-anonymously and wouldn't want my personal positions on certain topics to be confused with an official position held by the companies I contract for. I can say that it's not a huge one, it's a mid sized regional ISP.
Re: A cartoon intro to DNS over HTTPS
#120Earlier quoted context omitted.
What’s your ISP’s web address?
I share some controversial opinions on here semi-anonymously and wouldn't want my personal positions on certain topics to be confused with an official position held by the companies I contract for. I can say that it's not a huge one, it's a mid sized regional ISP.
Oh! I thought you were the CEO of an ISP. I'm curious about starting my own someday so I take notes of smaller operations as inspiration.