Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Where is the DNS headed?

potaroo.net

Post reply on HN
Print view View original

51–57 of 57 posts

Re: Where is the DNS headed?

#51

Post by gsich »

tialaramex wrote: post #47
gsich wrote: post #42

Earlier quoted context omitted.

They can. But the problem lies with Browsers (looking especially at Firefox) just ignoring that. The technical aspects of DoH (or DoT) are fine.

Mozilla provides a clear policy for how you get your resolver onto their list. US ISPs (the DoH resolver is only enabled by default in the US) could obey that policy and apply to be added to the list. But it seems like none of them have done that. Maybe the policy terms are objectionable? Let's see: "Only aggregate data that does not identify individual users or requests may be retained beyond 24 hours." But how will…

Mozilla can't verify that the providers behave. Apart from the obvious NXDOMAIN answers (not many providers will do so).

Also it is questionable why a free service would be better then a paid one. If one assumes that the ISP is evil, DNS providers are not suddenly less evil.

Re: Where is the DNS headed?

#52

Post by tialaramex »

gsich wrote: post #51
tialaramex wrote: post #47

Earlier quoted context omitted.

Mozilla provides a clear policy for how you get your resolver onto their list. US ISPs (the DoH resolver is only enabled by default in the US) could obey that policy and apply to be added to the list. But it seems like none of them have done that. Maybe the policy terms are objectionable? Let's see: "Only aggregate data that does not identify individual users or requests may be retained beyond 24 hours." But how will…

Mozilla can't verify that the providers behave. Apart from the obvious NXDOMAIN answers (not many providers will do so). Also it is questionable why a free service would be better then a paid one. If one assumes that the ISP is evil, DNS providers are not suddenly less evil.

As with its Trust Store Mozilla operates in public. If you believe that providers aren't behaving you can and should present evidence to the community.

Mozilla isn't suggesting you choose services based on how cheap they are, but on whether they implement these policies.

NextDNS, who are on Mozilla's list, offer a paid service if you want advertising filters or porn filtering or whatever but if you're damn sure you "get what you pay for" then pay them their subscription fee and don't switch on any filters.

Re: Where is the DNS headed?

#53

Post by gsich »

tialaramex wrote: post #52
gsich wrote: post #51

Earlier quoted context omitted.

Mozilla can't verify that the providers behave. Apart from the obvious NXDOMAIN answers (not many providers will do so). Also it is questionable why a free service would be better then a paid one. If one assumes that the ISP is evil, DNS providers are not suddenly less evil.

As with its Trust Store Mozilla operates in public. If you believe that providers aren't behaving you can and should present evidence to the community. Mozilla isn't suggesting you choose services based on how cheap they are, but on whether they implement these policies. NextDNS, who are on Mozilla's list, offer a paid service if you want advertising filters or porn filtering or whatever but if you're damn sure you "…

>Mozilla isn't suggesting you choose services based on how cheap they are, but on whether they implement these policies.

Mozilla doesn't know if they do. They can't verify it. So if Mozilla says "Cloudflare and Nextdns adhere to our policies" it's not verifiable by me and neither by them. I don't see a "trust but verify"-implementation. This is my gripe with this behaviour.

Re: Where is the DNS headed?

#54

Post by troquerre »

mytailorisrich wrote: post #18
troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

Handshake does not seem to try to solve the same problem as DoH, but rather somewhat what DNSSEC is solving. DoH's point is mostly to hide DNS traffic. DNSSEC's point is to validate a DNS record all the way to root. The benefits on Handshake over existing solutions are unclear to me.

The root of trust for DNSSEC is a key that's stored and controlled by people, and needs to go through routine key signing ceremonies. This is fallible and even recently there have been issues with the key signing ceremony https://www.icann.org/news/blog/root-key-signing-key-ceremon.... One could argue that this system works "good enough" but ultimately I'd prefer that the root of trust for security on the internet to be more robust than relying on humans to avoid error. That's what Handshake is trying to do — instead of using a key in a physical vault as the root of trust, you use a distributed blockchain that's very difficult to break.

It's also relevant to note that 51% attacks to most payment/store-of-value blockchains like Bitcoin, but for Handshake 51% attacks don't really affect the security of the network because an attacker would need to get the private keys for a name in order to attack its certificate.

Re: Where is the DNS headed?

#55

Post by troquerre »

andreareina wrote: post #31
ribasushi wrote: post #23

Earlier quoted context omitted.

> CDNs are a lesser evil than ISPs This keeps being repeated, and I simply do not understand it. Could you elaborate how you arrive at this conclusion that CDN > ISP? My take: An unsavory ISP is the only thing I can "vote against" as an end user. I can boycott it by switching elsewhere, I can pick from a ton of mobile providers, I can use a VPN to "subcontract" my connectivity experience to an order of magnitude more…

Every ISP I have access to performs DNS-based blocking; to the extent of intercepting ALL UDP DNS traffic (i.e. using other resolvers doesn't work). DoH gets around that. And I think from the context of the parent, you can choose your CDN('s resolver) -- my version of Firefox (77 on macOS) has NextDNS among the default DoH providers.

NextDNS is great. I've been using it for the last few months to access Handshake sites[1] and there have been no issues, and it's important that there are more resolvers than just Cloudflare and Google on the market.

[1] You need to enable it in your NextDNS settings.

Re: Where is the DNS headed?

#56

Post by zamadatix »

vetinari wrote: post #39
zamadatix wrote: post #33

Earlier quoted context omitted.

Applications can choose to ignore the system resolver regardless if it's over UDP or HTTPS. DoH/DoT is showing up in operating system resolvers just not as fast as apps like browsers were willing/able to add it. Standard DHCP options for defining DoH details are still missing though (I think, haven't checked in a while)

> Applications can choose to ignore the system resolver regardless if it's over UDP or HTTPS. They can, but up until Firefox legitimized this practice, they didn't, maybe except some malware. > DoH/DoT is showing up in operating system resolvers just not as fast as apps like browsers were willing/able to add it. The browsers were so fast, that they skipped the discussion about ramification of this change with the res…

On one hand you say browsers are to blame because they went too far too fast bypassing the OS DNS and on the other you say browsers are to blame because they didn't go far and fast enough bypassing the OS DHCP client.

Again are your arguments actually about DoH causing centralization or are you just talking about browsers causing positioning centralization irrespective of the technology?

Re: Where is the DNS headed?

#57

Post by vetinari »

zamadatix wrote: post #56
vetinari wrote: post #39

Earlier quoted context omitted.

> Applications can choose to ignore the system resolver regardless if it's over UDP or HTTPS. They can, but up until Firefox legitimized this practice, they didn't, maybe except some malware. > DoH/DoT is showing up in operating system resolvers just not as fast as apps like browsers were willing/able to add it. The browsers were so fast, that they skipped the discussion about ramification of this change with the res…

On one hand you say browsers are to blame because they went too far too fast bypassing the OS DNS and on the other you say browsers are to blame because they didn't go far and fast enough bypassing the OS DHCP client. Again are your arguments actually about DoH causing centralization or are you just talking about browsers causing positioning centralization irrespective of the technology?

> On one hand you say browsers are to blame because they went too far too fast bypassing the OS DNS

Yup, they shouldn't have do this.

> On one hand you say browsers are to blame because they went too far too fast bypassing the OS DNS

No. I'm saying, that once they did what they did, they should have finish the job. They left it unifished.

> Again are your arguments actually about DoH causing centralization or are you just talking about browsers causing positioning centralization irrespective of the technology?

My point is that the way DoH was implemented is causing centralization. DoH could be implemented without causing this effect.

Post reply on HN