Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Where is the DNS headed?

potaroo.net

Post reply on HN
Print view View original

21–30 of 57 posts

Re: Where is the DNS headed?

#21

Post by vetinari »

Santosh83 wrote: post #16

How is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying? Surely nothing stops your favourite ISP or any other local startup from providing DoH services right? Presumably the DNS servers will still talk to each other on the backend over plain text, but if a DoH front-end can be provided by ANY DNS service then how can it…

> How is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying?

It is not merely encrypting the information. Hand-in-hand comes running the resolvers (which, as you noted everyone can) and having all the DNS-using software use them.

Which is much bigger problem, that causes the centralization. Applications are coming today hard-coded for a specific resolver. Configuring it is application-specific and not-automatable, and certainly not automatable in generic manner for all applications. I.e. as a network operator you cannot say that everyone should be using this or that resolver, as you can with the plain old 53/udp DNS and DHCP.

Users are not going to reconfigure each and every application every time they change their network. They will leave it at the default value. The net effect is that the centralization will just happen.

Re: Where is the DNS headed?

#23

Post by ribasushi »

troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

> CDNs are a lesser evil than ISPs

This keeps being repeated, and I simply do not understand it. Could you elaborate how you arrive at this conclusion that CDN > ISP?

My take:

An unsavory ISP is the only thing I can "vote against" as an end user. I can boycott it by switching elsewhere, I can pick from a ton of mobile providers, I can use a VPN to "subcontract" my connectivity experience to an order of magnitude more providers, or if I am really so inclined I can shuffle all of that by the likes of Tor.

There is NOTHING I can do as an individual to avoid a CDN, aside from never visiting content backed by that CDN.

Re: Where is the DNS headed?

#24

Post by kd913 »

dpenguin wrote: post #4

There are a lot of arguments about how DoH with TLS 1.3 will give us privacy etc by the proponents of DoH(not this article).. but it’s basically moving the trust from ISPs to CDNs. There are fewer major browsers and fewer major CDNs than ISPs, I suppose.. so not sure if it’s a good move.

People can host their own DoH server themselves. If I can setup DoH and a VPN over one weekend with a Raspberry Pi, then others can do it too.

I am using DNSCryptProxy on a Pi and it fully supports DoH + eSNI even without cloudflare. Works perfectly with Firefox.

The service picks from 65 DoH servers based against the fastest ping time.

That was/is a lot better than before when in reality my only choice was my ISP DNS. In fact I just learned for the last few years that my ISP was hijacking all DNS requests anyway.

Re: Where is the DNS headed?

#25

Post by ca98am79 »

tasuki wrote: post #14
bawolff wrote: post #12

Earlier quoted context omitted.

Handshake sounds exactly like namecoin which has been here for a while. I guess its trying to be better by not requiring all nodes to be full nodes or something. I feel like that is not the reason why namecoin failed. As an aside, anyone else notice how it seems like all blockchain projects are annoyingly full of marketing speak, and talk in circles for the tech part. How hard is it to clearly and concisely list the…

> How hard is it to clearly and concisely list the technical goals and properties your solution has? Very? If you find https://handshake.org/ too marketing-y (I don't) perhaps you'll find the design notes more substantial: https://handshake.org/files/handshake.txt

you can also view it at http://handshake.txt if you are using a handshake resolver

Re: Where is the DNS headed?

#26

Post by swiley »

Santosh83 wrote: post #16

How is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying? Surely nothing stops your favourite ISP or any other local startup from providing DoH services right? Presumably the DNS servers will still talk to each other on the backend over plain text, but if a DoH front-end can be provided by ANY DNS service then how can it…

Because I as a user have a hard time configuring my computer to use a different resolver.

Re: Where is the DNS headed?

#27

Post by swiley »

troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

IMO compared to google (or most companies running ads) my ISP has been extremely well behaved. They mostly act as a pipe.

Keep in mind some of these US companies that are willing to run resolvers think censoring the DNS over the content it points to is a good thing.

Re: Where is the DNS headed?

#28

Post by swiley »

ribasushi wrote: post #23
troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

> CDNs are a lesser evil than ISPs This keeps being repeated, and I simply do not understand it. Could you elaborate how you arrive at this conclusion that CDN > ISP? My take: An unsavory ISP is the only thing I can "vote against" as an end user. I can boycott it by switching elsewhere, I can pick from a ton of mobile providers, I can use a VPN to "subcontract" my connectivity experience to an order of magnitude more…

Even without switching ISPs you can just use a different recursive resolver by editing your libc resolver config file. This is more difficult when each application has its own config (or none at all.)

Re: Where is the DNS headed?

#29

Post by [deleted] »

ribasushi wrote: post #23
troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

> CDNs are a lesser evil than ISPs This keeps being repeated, and I simply do not understand it. Could you elaborate how you arrive at this conclusion that CDN > ISP? My take: An unsavory ISP is the only thing I can "vote against" as an end user. I can boycott it by switching elsewhere, I can pick from a ton of mobile providers, I can use a VPN to "subcontract" my connectivity experience to an order of magnitude more…

[deleted]
Post reply on HN