Earlier quoted context omitted.
Yes.
Not for long.
If the browser is controlling the resolver in question, there's no reason not to hold long-running connections, or reconnecting on disconnect.
A cartoon intro to DNS over HTTPS
121–130 of 137 posts
Re: A cartoon intro to DNS over HTTPS
#122Earlier quoted context omitted.
I work at Cloudflare, this is correct. 1.1.1.1 runs on our existing hardware deployed around the world, it costs us very little. When you use it it improves performance for the 8 million or so sites we sit in front of, that's our actual business.
Mozilla sends people to https://mozilla.cloudflare-dns.com/dns-query . Can you explain why this site is blocked by uMatrix?
Strange, uMatrix doesn't block that site for me. It just doesn't have any content.
Re: A cartoon intro to DNS over HTTPS
#123There are 3 major protocols available for DNS privacy: * DNSCrypt * DNS over TLS * DNS over HTTPS DNSCrypt is the one with better client support and a long list of providers available. If you pick DNS over TLS or DNS over HTTPS you will be restricted to 3 or 4 major players (google, quad9, cloudflare and cleanbrowsing). If you trust them, you are good. For example, this is the list of providers with DNSCrypt support:…
Are OS implementations planning to switch to DNS over TLS or DNS over HTTPS anytime soon? Because if not, any requests made by non-browsers are still susceptible and will only give users a false sense of security.
Because it's better than doing nothing in the short term, and OSes can switch over as time moves on. Browsers have a much faster cadence and automatic updates (mostly).
Re: A cartoon intro to DNS over HTTPS
#124Earlier quoted context omitted.
If only defaults matter, then it's already a dead horse, as the majority of users don't know what DNS even is, and are using their ISP's servers by default.
Why does the amount of people knowing about DNS matter? Especially in the context of decentralization?
Depending on your ISP and/or country of origin, it can matter a lot.
Re: A cartoon intro to DNS over HTTPS
#125Earlier quoted context omitted.
Personally, I highjack all DNS requests made on my network at my router, then use a VPN tunnel to resolve them on a server that I control that runs unbound. My guess is that FIOS was doing the same to you, just without your interests in mind. A similar setup to mine could be deployed at your network edge, and it could then force all of your port 53 DNS requests to go over a more secure protocol. Of course you would h…
>My guess is that FIOS was doing the same to you, just without your interests in mind. It wasn't FIOS doing it, the IP was in Israel and was known as a malware serving IP.
Could be your router was hacked too...
Re: A cartoon intro to DNS over HTTPS
#126Earlier quoted context omitted.
Which I doubt is a problem for Cloudflare or Quad9. Anyway, a TCP based DNS service needs to consider those things. Otherwise it is becoming unusable due to very high response times. A standard 8 GB system with Debian 9 gives me 1048576 max file descriptors. I am sure this can be optimized still.
The default socket receive and send buffers are ~200KB, so you would actually need 400 GB of memory in order to have each of those 1048576 file descriptors connected to a unique socket. And if you were keeping them open for 5 minutes as suggested, that would still limit you to only 3400 clients / second. I do actually agree that they need a longer idle timeout on these connections, but I just wanted to point out that…
I'm pretty sure that they don't HAVE to use the defaults, and for something like DNS, they probably shouldn't be... The buffer should probably be limited to what the largest request segment would be for creating the TLS/HTTPS connection in the first place, which just guessing would be closer to 1K.
Re: A cartoon intro to DNS over HTTPS
#127Earlier quoted context omitted.
Think about Cloudflare itself. Millions of websites hosted behind a handful of IP addresses.
So we go back to re-centralizing for privacy? I love Cloudflare, but... if that's really the answer to this... sigh.
Well, about 8M websites are already behind Cloudflare... if you add the top 50 hosting providers, that's probably 95% of the internet. Traffic is already relatively centralized.
Re: A cartoon intro to DNS over HTTPS
#128I applaud the efforts to increase privacy,reduce data collection and hardened security. Do we really want a SPOF in Cloudflare for this though? A single outage (or AT&T snafu) and many millions of users would be affected.
In fact, it already happened between this Mozilla announcement and now: https://www.cloudflarestatus.com/incidents/2mz3wly2g7dy I think encrypting DNS transport is as important as the next guy (though DoH is bad), but am super unhappy about Mozilla apparently signing on with Cloudflare's ongoing fairly successful attempts to centralize the internet. Sure, they say they'll delete your data "within 24 hours" (they shou…
Which begs the question, do they have a canary page?
In any case, it would be unreasonable to require logging for more than that... even a week would be too much data for many ISPs. Also, they have to have some logging to be able to even try and troubleshoot a problem.
Re: A cartoon intro to DNS over HTTPS
#129As a good and responsible parent DNS over HTTPS will never be an option. I run a DNS server on my local network.
You could still have that DNS server use an upstream DNS over HTTPS or other encrypted channel that unifies traffic, which has the effect of anonymizing.
Re: A cartoon intro to DNS over HTTPS
#130"Threats to users' privacy and security are growing." s/privacy/&, autonomy/' Case in point about autonomy is on HN front page at present: https://news.ycombinator.com/item?id=17196888 The author cites a hypothetical example where a user shopping at Megastore is blocked from accessing her preferred source of DNS data in order to prevent her from checking a price. Extending this hypothetical, imagine if in response to…
I see additional problem with this, which actually endangers autonomy. The resolving is not only done for user-initiated action, but is being done by many programs, even which you might not want to do it. For the same reason, many users use a local firewall to block outcoming connections, like Little Snitch. (Sidenote: if you are using MS Office 2016 for Mac, and are not satisfied with the choice of telemetry that Mi…
As long as you can configure DoH, you can setup your own resolver and do what you want. In the end DoH will probably eventually be an option in the OS level, or not for lighter OSes. I think having it at the application layer is to add a nudge in the OS developer direction.