Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Where is the DNS headed?

potaroo.net

Post reply on HN
Print view View original

31–40 of 57 posts

Re: Where is the DNS headed?

#31

Post by andreareina »

ribasushi wrote: post #23
troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

> CDNs are a lesser evil than ISPs This keeps being repeated, and I simply do not understand it. Could you elaborate how you arrive at this conclusion that CDN > ISP? My take: An unsavory ISP is the only thing I can "vote against" as an end user. I can boycott it by switching elsewhere, I can pick from a ton of mobile providers, I can use a VPN to "subcontract" my connectivity experience to an order of magnitude more…

Every ISP I have access to performs DNS-based blocking; to the extent of intercepting ALL UDP DNS traffic (i.e. using other resolvers doesn't work). DoH gets around that.

And I think from the context of the parent, you can choose your CDN('s resolver) -- my version of Firefox (77 on macOS) has NextDNS among the default DoH providers.

Re: Where is the DNS headed?

#32

Post by andreareina »

swiley wrote: post #28
ribasushi wrote: post #23

Earlier quoted context omitted.

> CDNs are a lesser evil than ISPs This keeps being repeated, and I simply do not understand it. Could you elaborate how you arrive at this conclusion that CDN > ISP? My take: An unsavory ISP is the only thing I can "vote against" as an end user. I can boycott it by switching elsewhere, I can pick from a ton of mobile providers, I can use a VPN to "subcontract" my connectivity experience to an order of magnitude more…

Even without switching ISPs you can just use a different recursive resolver by editing your libc resolver config file. This is more difficult when each application has its own config (or none at all.)

Without Do{H,T}, your ISP sees all your DNS queries anyway, and some will MitM them.

Re: Where is the DNS headed?

#33

Post by zamadatix »

vetinari wrote: post #21
Santosh83 wrote: post #16

How is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying? Surely nothing stops your favourite ISP or any other local startup from providing DoH services right? Presumably the DNS servers will still talk to each other on the backend over plain text, but if a DoH front-end can be provided by ANY DNS service then how can it…

> How is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying? It is not merely encrypting the information. Hand-in-hand comes running the resolvers (which, as you noted everyone can) and having all the DNS-using software use them. Which is much bigger problem, that causes the centralization. Applications are coming today ha…

Applications can choose to ignore the system resolver regardless if it's over UDP or HTTPS. DoH/DoT is showing up in operating system resolvers just not as fast as apps like browsers were willing/able to add it. Standard DHCP options for defining DoH details are still missing though (I think, haven't checked in a while)

Re: Where is the DNS headed?

#34

Post by esperent »

ribasushi wrote: post #23
troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

> CDNs are a lesser evil than ISPs This keeps being repeated, and I simply do not understand it. Could you elaborate how you arrive at this conclusion that CDN > ISP? My take: An unsavory ISP is the only thing I can "vote against" as an end user. I can boycott it by switching elsewhere, I can pick from a ton of mobile providers, I can use a VPN to "subcontract" my connectivity experience to an order of magnitude more…

If you can switch ISP, good for you. On my road, there's only one, and it's owned by the government.

Re: Where is the DNS headed?

#35

Post by rswail »

andreareina wrote: post #31
ribasushi wrote: post #23

Earlier quoted context omitted.

> CDNs are a lesser evil than ISPs This keeps being repeated, and I simply do not understand it. Could you elaborate how you arrive at this conclusion that CDN > ISP? My take: An unsavory ISP is the only thing I can "vote against" as an end user. I can boycott it by switching elsewhere, I can pick from a ton of mobile providers, I can use a VPN to "subcontract" my connectivity experience to an order of magnitude more…

Every ISP I have access to performs DNS-based blocking; to the extent of intercepting ALL UDP DNS traffic (i.e. using other resolvers doesn't work). DoH gets around that. And I think from the context of the parent, you can choose your CDN('s resolver) -- my version of Firefox (77 on macOS) has NextDNS among the default DoH providers.

The issue isn't whether you can choose your resolver for Firefox, it's that it balkanizes the namespace resolution mechanism.

Sure, Firefox is using CDN resolver #1, "optimized for the browser experience", while Spotify uses the CDN resolver #2, "optimized for music discovery".

The namespace will balkanize, and with that the control moves to the owners of the resolvers. That would be a natural evolution of the infrastructure purely due to literal "network effects".

If data can be gleaned from current DNS requests, what data can be gleaned from a browser sending metadata? Who controls those DoH servers?

At least the current DNS namespace, nominally, is devolved, particularly with the explosion of TLDs. That has other disadvantages, but there are advantages too.

Re: Where is the DNS headed?

#36

Post by Ericson2314 »

dredmorbius wrote: post #22
teddyh wrote: post #10

Earlier quoted context omitted.

What does the “c” flag do?

"Confirm". It prompts for verification before substituting, in vim: https://www.linux.com/training-tutorials/vim-tips-basics-sea...

oh gawd I just type the `c` out of habit now. that wasn't intentional at all.

Re: Where is the DNS headed?

#37

Post by Ericson2314 »

dpenguin wrote: post #4

There are a lot of arguments about how DoH with TLS 1.3 will give us privacy etc by the proponents of DoH(not this article).. but it’s basically moving the trust from ISPs to CDNs. There are fewer major browsers and fewer major CDNs than ISPs, I suppose.. so not sure if it’s a good move.

Why can't the ISPs run DoH too?

I agree that due to social issues the problems are fairly real (ISPs ain't gonna do shit). But on a purely technical level DoH should be fine.

Re: Where is the DNS headed?

#38

Post by belorn »

kitteh wrote: post #9
stiray wrote: post #7

Earlier quoted context omitted.

This is also my concern. ISPs are typically located in same country making them follow the laws of that country. I belive authors of the DoH idea were doing it with good intentions but road to hell is paved with good intentions. What we are doing with DoH is actually breaking decentralised internet infrastructure to centralized (or lets say, less centralized...for now) and this was never a good thing (historywise). F…

What about your ISPs employees? Do you trust a sysadmin pulling 40-50k a year (or less) to not sell your DNS resolver data? Do you think your ISP has better controls and a security team than some of the big CDNs and cloud providers to detect and prevent this? The reason I bring it up is because I know a number of ISPs whose sysadmins were on the take and selling bulk regular dumps of DNS resolver data under the table…

When you say "under the table", do you mean unbeknown to the customer or the employer? The later will likely result in the employee being fired, fined and possible jailed. I would also suspect that a criminal do not file taxes for selling stolen data, so one can likely add tax fraud.

If you know such people you should consider reporting it to the police.

Re: Where is the DNS headed?

#39

Post by vetinari »

zamadatix wrote: post #33
vetinari wrote: post #21

Earlier quoted context omitted.

> How is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying? It is not merely encrypting the information. Hand-in-hand comes running the resolvers (which, as you noted everyone can) and having all the DNS-using software use them. Which is much bigger problem, that causes the centralization. Applications are coming today ha…

Applications can choose to ignore the system resolver regardless if it's over UDP or HTTPS. DoH/DoT is showing up in operating system resolvers just not as fast as apps like browsers were willing/able to add it. Standard DHCP options for defining DoH details are still missing though (I think, haven't checked in a while)

> Applications can choose to ignore the system resolver regardless if it's over UDP or HTTPS.

They can, but up until Firefox legitimized this practice, they didn't, maybe except some malware.

> DoH/DoT is showing up in operating system resolvers just not as fast as apps like browsers were willing/able to add it.

The browsers were so fast, that they skipped the discussion about ramification of this change with the rest of community and just abused their position. One might even wonder, why.

Does not make for good relations in future.

> Standard DHCP options for defining DoH details are still missing though

Yup. Here, browsers are not using their position to finish their push, so maybe the situation is acceptable for them.

Re: Where is the DNS headed?

#40

Post by bityard »

dpenguin wrote: post #4

There are a lot of arguments about how DoH with TLS 1.3 will give us privacy etc by the proponents of DoH(not this article).. but it’s basically moving the trust from ISPs to CDNs. There are fewer major browsers and fewer major CDNs than ISPs, I suppose.. so not sure if it’s a good move.

> but it’s basically moving the trust from ISPs to CDNs.

Not just CDNs, ISPs can certainly operate their own DoH servers on their existing DNS infrastructure. If they want to continue selling their users' browsing data to marketing firms, that is what they will have to do.

This also moves trust to the browser and OS TLS certificate stores, which may be problematic depending on your opinion of whether or not you can trust every single one of the governments and organizations behind the hundreds of root CAs.

Post reply on HN