Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Measuring open DNS resolver use

blog.apnic.net

Post reply on HN
Print view View original

31–40 of 53 posts

Re: Measuring open DNS resolver use

#31

Post by 3xblah »

How about measuring zone file access programs?

How many users utilise the full number of existing domain names in the world today?

How many names do users realistically need to access in a lifetime?

What if we exclude ad servers and other domains that exist solely for marketing?

It depends on the user, but in some cases the majority of their non-commercial web^1 use can be accomplished without ever making remote DNS queries; the IP addresses can be stored and used on a long-term basis. That is because a user may only visit the same small number of websites. The foregoing is of course only an opinion based on testing conducted by yours truly. Every user is different.

Try measuring how many times the non-commercial websites you visit change IP addresses in a year.

You might find that DNS resolution is like that "definition of insanity" meme: making the same query day after day, expecting a different answer.

1 It makes a difference whether or not a user is using the web to make purchases. For making purchases online, DNS resolution is almost always required. Domains and IP addresses in that context are constantly changing. Go figure. OTOH, if you are visiting a website such as news.ycombinator.com on a frequent basis, is it really necessary to look up the IP address for news.ycombinator.com every time you visit the website? I have used the same IP address for years at a time.

Re: Measuring open DNS resolver use

#32

Post by denton-scratch »

tptacek wrote: post #6
cracker_jacks wrote: post #4

Earlier quoted context omitted.

What is the cause for concern? I am trying to understand why DNS-over-HTTPS could be a bad thing from the user end.

It's not. It's an unalloyed good thing. The concern is with configurations that make it hard to use anything but Cloud Flare. There are alternatives.

"Unalloyed" is a strong claim - you are saying effectively that it is pure, flawless gold.

Re: Measuring open DNS resolver use

#33

Post by tptacek »

denton-scratch wrote: post #32
tptacek wrote: post #6

Earlier quoted context omitted.

It's not. It's an unalloyed good thing. The concern is with configurations that make it hard to use anything but Cloud Flare. There are alternatives.

"Unalloyed" is a strong claim - you are saying effectively that it is pure, flawless gold.

I can't think of anything bad about it. One popular strain of criticism is clearly bogus, that it removes a measure of visibility from network operators (that's the point). Another is that it centralizes DNS services at companies like Cloud Flare, which, no, you can run your own DoH resolver server (and probably shouldn't use Cloud Flare regardless). Finally, people say that it's clunky compared to datagram-based alternatives; from my perspective, DNS has been hampered by the UDP service model for decades, and revisiting it so that, at least at the retail level, it's TCP/HTTPS like everything else is an opportunity, not a problem.

Re: Measuring open DNS resolver use

#34

Post by juped »

tptacek wrote: post #33
denton-scratch wrote: post #32

Earlier quoted context omitted.

"Unalloyed" is a strong claim - you are saying effectively that it is pure, flawless gold.

I can't think of anything bad about it. One popular strain of criticism is clearly bogus, that it removes a measure of visibility from network operators (that's the point). Another is that it centralizes DNS services at companies like Cloud Flare, which, no, you can run your own DoH resolver server (and probably shouldn't use Cloud Flare regardless). Finally, people say that it's clunky compared to datagram-based alt…

>you can run your own DoH resolver server

How does this work in your mind?

Re: Measuring open DNS resolver use

#35

Post by tptacek »

juped wrote: post #34
tptacek wrote: post #33

Earlier quoted context omitted.

I can't think of anything bad about it. One popular strain of criticism is clearly bogus, that it removes a measure of visibility from network operators (that's the point). Another is that it centralizes DNS services at companies like Cloud Flare, which, no, you can run your own DoH resolver server (and probably shouldn't use Cloud Flare regardless). Finally, people say that it's clunky compared to datagram-based alt…

>you can run your own DoH resolver server How does this work in your mind?

I don't understand your question. The first Google SERP will give you a multiplicity of tutorials on setting up a DoH server.

Re: Measuring open DNS resolver use

#36

Post by juped »

tptacek wrote: post #35
juped wrote: post #34

Earlier quoted context omitted.

>you can run your own DoH resolver server How does this work in your mind?

I don't understand your question. The first Google SERP will give you a multiplicity of tutorials on setting up a DoH server.

At the point when I would be "run[ning] my own DoH resolver", I'm already at the point of setting up my own resolver. Why wouldn't I just turn on unbound and call it a day?

Re: Measuring open DNS resolver use

#37

Post by tptacek »

juped wrote: post #36
tptacek wrote: post #35

Earlier quoted context omitted.

I don't understand your question. The first Google SERP will give you a multiplicity of tutorials on setting up a DoH server.

At the point when I would be "run[ning] my own DoH resolver", I'm already at the point of setting up my own resolver. Why wouldn't I just turn on unbound and call it a day?

The point of running your own DoH resolver is that you're doing it somewhere off-network, to tunnel DNS out of an ISP network you don't trust to somewhere else you trust more.

You can also just not run DoH if you trust your network. I'm saying DoH is a good thing, not that everyone has to use it.

Re: Measuring open DNS resolver use

#38

Post by juped »

tptacek wrote: post #37
juped wrote: post #36

Earlier quoted context omitted.

At the point when I would be "run[ning] my own DoH resolver", I'm already at the point of setting up my own resolver. Why wouldn't I just turn on unbound and call it a day?

The point of running your own DoH resolver is that you're doing it somewhere off-network, to tunnel DNS out of an ISP network you don't trust to somewhere else you trust more. You can also just not run DoH if you trust your network. I'm saying DoH is a good thing, not that everyone has to use it.

Alright, but the reason for the complaint about centralization you're dismissing is that most people are encountering DoH via Firefox's plan to default resolve via DoH to Cloudflare, rather than in the context of being deft Unix hands searching for a way to tunnel their DNS out of an untrustworthy network.

Re: Measuring open DNS resolver use

#39

Post by tptacek »

juped wrote: post #38
tptacek wrote: post #37

Earlier quoted context omitted.

The point of running your own DoH resolver is that you're doing it somewhere off-network, to tunnel DNS out of an ISP network you don't trust to somewhere else you trust more. You can also just not run DoH if you trust your network. I'm saying DoH is a good thing, not that everyone has to use it.

Alright, but the reason for the complaint about centralization you're dismissing is that most people are encountering DoH via Firefox's plan to default resolve via DoH to Cloudflare, rather than in the context of being deft Unix hands searching for a way to tunnel their DNS out of an untrustworthy network.

I do not think a feature that delegates DNS to Cloud Flare is an unalloyed good. I think the protocol is. The distinction is important.

Re: Measuring open DNS resolver use

#40

Post by axaxs »

tptacek wrote: post #33
denton-scratch wrote: post #32

Earlier quoted context omitted.

"Unalloyed" is a strong claim - you are saying effectively that it is pure, flawless gold.

I can't think of anything bad about it. One popular strain of criticism is clearly bogus, that it removes a measure of visibility from network operators (that's the point). Another is that it centralizes DNS services at companies like Cloud Flare, which, no, you can run your own DoH resolver server (and probably shouldn't use Cloud Flare regardless). Finally, people say that it's clunky compared to datagram-based alt…

Serious question - why do you prefer DoH vs say, DNS over TLS? The former always seemed rather hacky to me.
Post reply on HN