Quad9 DOH HTTP/1.1 Retirement, December 15, 2025 • Hacker News Board

Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025

#61

Post by 1vuio0pswjnm7 » Fri, Dec 05, 2025, 2:18 PM UTC

1vuio0pswjnm7 wrote: post #57

itopaloglu83 wrote: post #9

Earlier quoted context omitted.

DOH prevents malicious network providers from blocking DOT traffic to enforce their own DNS services for “efficiency” reasons. Most ISPs just want to sell your data and with encrypted client hello and DOH they’re losing visibility into what you’re doing.

Except encrypted client hello (ECH) is just a draft and isn't being used server side on the public www If I'm wrong then please provide some examples of servers that support ECH

Why does SNI even exist

Whoever designed TLS did not expect third parties, so-called "content delivery networks", "cloud providers", etc., wanting to offer hosting to an unlimited number of customers ($$) on a limited pool of IP addresses

Problem of cleartext SNI was solved in 2011, well before "QUIC" existed

http://curvecp.org/addressing.html

Without TLS and without SNI anyone can host multiple HTTPS sites on a single IP address

Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025

#62

Post by gfody » Fri, Dec 05, 2025, 6:59 PM UTC

bawolff wrote: post #60

gfody wrote: post #58

Earlier quoted context omitted.

makes sense but I still would prefer to solve that problem with "batch" semantics at a higher level rather than depend on the wire protocol to bend over backwards

The problem with batch semantics is you do have to know everything up front. You cant just do one request and then 20 ms later another. For DNS this might come up in format parsing. E.g. in html, First you see tag, fire off the DNS request for that, and go back to parsing. Before you get the DNS result you see an tag for a different domain and want to fire off the DNS result for that. With a batch method you would ha…

clearly dns requests ought to be batched in this scenario, but we can imagine a smarter mechanism than http2 multiplexing to do it

the problem with relying on the wire protocol to streamline requests that should've been batched is that it lacks the context to do it well

Re: Quad9 DOH HTTP/1.1 Retirement, December 15, 2025

#63

Post by riedel » Fri, Dec 05, 2025, 10:02 PM UTC

1vuio0pswjnm7 wrote: post #55

hypeatei wrote: post #39

Earlier quoted context omitted.

If you're using a reverse proxy, maybe. I don't think it's sufficient to kill a whole version of HTTP because of that.

There is an argument HTTP/2 was created by CDNs for CDNs (reverse proxies)

For sure it was not created for things like the web of things. Around 2015 I had so much hope for it to be usable for embedded devices (like using compression with preshared ducts), but at least at the time the complexity of http/2 were overwhelming, with the actual improvements underwhelming.