News for hackers. Stuff that matters.
Re:Inside Firefox’s DNS-over-HTTPS engine by unethical_ban on Sunday June 03, 2018 @11:25PM (#17224345)
They're trying to improve the security of a fundamental protocol - if we waited for committees every time we wanted something new, we wouldn't have HTTP2, HTML5 or a dozen other technologies.

I agree they shouldn't take away the "god-mode" /etc/hosts, which is only ever populated very intentionally by sysadmins and power users. If anything, that should be a flag just like the various modes of using TRR.

And finally - it's an open protocol in development, and anyone can set it up who wants to. If you don't want to use Google or Cloudflare, you don't have to. And FWIW millions of people are already using 8.8.8.8 and 1.1.1.1 and Cisco's OpenDNS as their primary resolver. That GOOG and CF are at the forefront of another increment of Internet standards should not be surprising.

Re:Inside Firefox’s DNS-over-HTTPS engine by wahern on Tuesday June 05, 2018 @02:48AM (#17235475)
What good is it? TLS SNI already exposes the domain name. Even if that is addressed in the far future, you still can't hide the IP addresses you're connecting to. The only real engineering problem with DNS is authentication, which is adequately solved (however poorly) with DNSSEC and operating systems shipping local resolvers.

Moreover, whatever promises CloudFlare and others make, they're still centralization points and therefore ripe targets for infiltration and exfiltration.

The moment browsers actually solve the privacy problem will be the moment 9/10ths of the internet goes poof and disappears along with their monetization strategies. As long as Google is viable then these are just tricks arguably doing more harm (increasing reliance on centralized vendors, increasing complexity of the software stack) than good.