Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS over HTTPS

github.com

Post reply on HN
Print view View original

181–190 of 195 posts

Re: DNS over HTTPS

#181

Post by [deleted] »

SEMW wrote: post #61
nijaru wrote: post #54

Earlier quoted context omitted.

It is not actually translating anything since performant is not considered a real word in English, although I commonly see it used in the tech world.

> performant is not considered a real word in English, although I commonly see it used... This is close to being a contradiction in terms. The purpose of words is to communicate, and if a word is being successfully used to communicate -- which clearly it is -- what exactly does it mean to say that isn't "considered a real word"? Also, "Considered" by whom? The dictionary? Dictionaries are descriptivist -- they record…

[deleted]

Re: DNS over HTTPS

#182

Post by kuschku »

aplorbust wrote: post #180
kuschku wrote: post #172

Earlier quoted context omitted.

Wrong. SNI has to be sent without any previous negotiation. Therefore the client does not know if a site will require SNI or not. Assumption 1: browser vendors do not want to break sites relying on SNI (Confirmed by WHATWG) Assumption 2: at least one major site will continue to use SNI Conclusion: browsers will continue to send SNI.

"Therefore the client does not know if a site will require SNI or not." The client that I use assumes no SNI required. (It intentionally does not support SNI.) If it fails because the website is on a shared host and requires SNI, then it retries via a local SNI-enabled proxy bound to localhost. "Conclusion: browsers will continue to send SNI." Some clients/browsers will continue to send the domainname in the clear fo…

That is awesome (and I personally also always err on the side of safety/privacy there), but I don't think this will help much.

Anyone that can set your setup up can also just openvpn to a remote server, and redirect all DNS queries over that connection (which is quite easily doable, actually).

Everyone that can't do this would still use SNI, so DNS-over-HTTPS wouldn't provide any security win for them.

Re: DNS over HTTPS

#183

Post by [deleted] »

banachtarski wrote: post #71
alien_at_work wrote: post #45

I really hope this doesn't catch on widely. It should be a tool for use where censorship issues can't be solved politically. Otherwise, why even have protocols at all? Just say the only protocol is HTTP. IP, etc. are just an HTTP implementation detail.

I would love this to catch on wildly! DNS through TLS means it's all end-to-end encrypted, DNS reflection attacks are harder, etc. The "why even have protocols" doesn't make sense. Protocol can be layered just fine (HTTP itself is a good example). DNS as it exists now is another random special snowflake that vendors need corresponding snowflake implementations for.

[deleted]

Re: DNS over HTTPS

#184

Post by qznc »

alien_at_work wrote: post #45

I really hope this doesn't catch on widely. It should be a tool for use where censorship issues can't be solved politically. Otherwise, why even have protocols at all? Just say the only protocol is HTTP. IP, etc. are just an HTTP implementation detail.

Why do we have ports at all? Except 80 and 443 many ports are blocked anyways.

I'd say there is an arms race between admins and users. Step by step features get forbidden and blocked usually in the name of security. For example, NAT took away your globally visible IP address.

The next step is probably blocking domains. In a dystopian vision, Google and Facebook become the proxies for all traffic as all other domains get blocked for most users.

Re: DNS over HTTPS

#185

Post by loup-vaillant »

tedunangst wrote: post #163
gsich wrote: post #157

Earlier quoted context omitted.

And how should I know that there is a captive portal? I connect (connection is established after receiving IP address!) and use iodine (or similar).

I'm sure the jury will be delighted to hear your explanation.

"I used iodine all the time, so I can't even notice the presence of a captive portal, if any."

"My son handles the computer stuff for me, I don't even know about that logging page you're talking about."

"I thought restricted networks had a WPA-2 password? That's what they use at my workplace."

Re: DNS over HTTPS

#186

Post by pbhjpbhj »

loup-vaillant wrote: post #185
tedunangst wrote: post #163

Earlier quoted context omitted.

I'm sure the jury will be delighted to hear your explanation.

"I used iodine all the time, so I can't even notice the presence of a captive portal, if any." "My son handles the computer stuff for me, I don't even know about that logging page you're talking about." "I thought restricted networks had a WPA-2 password? That's what they use at my workplace."

"The door to the house was open, move of the stuff was tied down, how could i be expected to know I wasn't authorised to use it??"

Judges just aren't that stupid.

Re: DNS over HTTPS

#187

Post by pbhjpbhj »

cabaalis wrote: post #115
PakG1 wrote: post #89

Earlier quoted context omitted.

What's cromulent mean? I looked it up at dictionary.com and couldn't find anything. Or are you making up more words to point out the irony? :)

I wonder if you can use "cromulent" to guess the age of a person. Older people would not have watched the Simpsons in the early 90s. Younger people very likely missed this obscure episode. I would guess an age of the user to be 30-35.

You're not far out, but I must have missed that episode originally and only watched it in the last few years. I possibly also learnt it from Reddit first.

Re: DNS over HTTPS

#188

Post by pas »

aplorbust wrote: post #155

"Do DNS resolves over HTTPS for privacy, performance and security. Also makes it easier to use a name server of your choice instead of the one configured for your system ." "A server that is acting both as a normal web server and a DNS API server is in a position to choose which DNS names it forces a client to resolve (through its web service) and also be the one to answer those queries (through its DNS API service).…

> How might this affect users who block ads via DNS?

They should make sure to use a trusted DNS over HTTPS resolver.

Re: DNS over HTTPS

#189

Post by gsich »

pbhjpbhj wrote: post #186
loup-vaillant wrote: post #185

Earlier quoted context omitted.

"I used iodine all the time, so I can't even notice the presence of a captive portal, if any." "My son handles the computer stuff for me, I don't even know about that logging page you're talking about." "I thought restricted networks had a WPA-2 password? That's what they use at my workplace."

"The door to the house was open, move of the stuff was tied down, how could i be expected to know I wasn't authorised to use it??" Judges just aren't that stupid.

Only that the comparison is stupid.

Re: DNS over HTTPS

#190

Post by Angostura »

v_lisivka wrote: post #102
Angostura wrote: post #88

Earlier quoted context omitted.

I think the word that was being grasped for is 'faster'. It suffers in that doesn't sound very technical.

GPU can perform more operations than CPU, but GPU is slower than CPU, not faster.

So is the GPU more or less 'performant?'

That's right - the CPU is faster at completing the job, though the GPU executes instructions more quickly.

Post reply on HN