Where is the DNS headed?
potaroo.net
Where is the DNS headed?
1–10 of 57 posts
Re: Where is the DNS headed?
#2s/HTML/HTTP/c in a few places.
Re: Where is the DNS headed?
#3[deleted]
Re: Where is the DNS headed?
#4There are a lot of arguments about how DoH with TLS 1.3 will give us privacy etc by the proponents of DoH(not this article).. but it’s basically moving the trust from ISPs to CDNs. There are fewer major browsers and fewer major CDNs than ISPs, I suppose.. so not sure if it’s a good move.
Re: Where is the DNS headed?
#5There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake (https://handshake.org) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it shows promise with NextDNS.io and Vercel.com supporting it.
[1] CDNs are a lesser evil than ISPs but I still wouldn’t want to need to trust them to protect my privacy.
Re: Where is the DNS headed?
#6There are a lot of arguments about how DoH with TLS 1.3 will give us privacy etc by the proponents of DoH(not this article).. but it’s basically moving the trust from ISPs to CDNs. There are fewer major browsers and fewer major CDNs than ISPs, I suppose.. so not sure if it’s a good move.
[deleted]
Re: Where is the DNS headed?
#7There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…
This is also my concern. ISPs are typically located in same country making them follow the laws of that country.
I belive authors of the DoH idea were doing it with good intentions but road to hell is paved with good intentions.
What we are doing with DoH is actually breaking decentralised internet infrastructure to centralized (or lets say, less centralized...for now) and this was never a good thing (historywise).
For test why is this bad you can try to block google and amazon ASNs and try to surf around the web. You will notice that the internet is quite different (a hint, yandex.ru was the only search engine I have found that still works)
For instance selling the information about user accessing some domain would be a big no-no in my country.
They are obliged by law to protect customers information except if ordered by court.
With DoH all bets are off. Surely it will give some privacy for users where ISPs are sticking their noses into customers data (like in USA), they wont be able to do it anymore but for me, I trust in our ISPs (or laws) while I surely dont trust google or cloudflare.
We will just give internet resolving into hands of multinational corporations, what could go wrong, right? (Just quick ideas: for $10 / day we offer redirection from yourdomain.com to sellingcrap.com or we resolve .ourinternaldomain only over DoH and not resolve to external ips to force you to use our DoH,...)
Re: Where is the DNS headed?
#8If I understand correctly, the author presents a case for securing DNS by moving away from a shared directory toward application-specific directories. At the end, he takes a sharp turn to worry that such a move will tear apart the openness of the internet. I suppose an analogy is moving from phone numbers, with shared telco-managed directories, to chat apps managing their own directories. You can’t contact me on Instagram with my HN handle because they don’t use shared directories.
Ok, but there are more important reasons. Walled-garden directories is a symptom not a cause. For that matter, SNI and path-based load balancers are examples of the application-level address resolution overlay already in practice. Those techniques merely implement, not drive, balkanization.
Basically, application-layer DNS doesn’t pass the “but for” test. As in, it is not correct to say “but for application-layer DNS, Facebook/WeChat/Google couldn’t build walled gardens. With it they can.”
Re: Where is the DNS headed?
#9There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…
This is also my concern. ISPs are typically located in same country making them follow the laws of that country. I belive authors of the DoH idea were doing it with good intentions but road to hell is paved with good intentions. What we are doing with DoH is actually breaking decentralised internet infrastructure to centralized (or lets say, less centralized...for now) and this was never a good thing (historywise). F…
What about your ISPs employees? Do you trust a sysadmin pulling 40-50k a year (or less) to not sell your DNS resolver data?
Do you think your ISP has better controls and a security team than some of the big CDNs and cloud providers to detect and prevent this?
The reason I bring it up is because I know a number of ISPs whose sysadmins were on the take and selling bulk regular dumps of DNS resolver data under the table to other parties for years.
Re: Where is the DNS headed?
#10s/HTML/HTTP/c in a few places.
What does the “c” flag do?