News for hackers. Stuff that matters.

A comment on The Big DNS Privacy Debate at FOSDEM. Parent comment

Re:The Big DNS Privacy Debate at FOSDEM by detaro on Thursday February 07, 2019 @11:46AM (#19106364)
Some would argue "still UDP based" is objectively worse, since it can be blocked.

I don't think DNSCrypt is better for caching, doesn't it just protect one "leg" from a client (which can be a local cache) to a resolver (which also can be a cache) just like DoH? Similarly for pinning keys (although I think DNSCrypt made exchanging keys easier).

[ Parent | on HN ]
Re:The Big DNS Privacy Debate at FOSDEM by em-bee on Thursday February 21, 2019 @08:58AM (#19216873)
blocking or not blocking DNS is a two edged sword.

as we see in the discussion about the chromecast ultra: https://news.ycombinator.com/item?id=19170671 it is not necessarily desirable to have a way for apps to resolve DNS that can't be blocked at all.

[ Parent | on HN ]
Re:The Big DNS Privacy Debate at FOSDEM by michaelt on Thursday February 07, 2019 @12:40PM (#19106794)
In the internet of the future, DNS will move from UDP to TCP because it's better, and HTTP/3 will move from TCP to UDP because it's better.

Web 4.0 will consolidate these improvements, producing DNS over HTTP over QUIC over UDP.

[ Parent | on HN ]
Re:The Big DNS Privacy Debate at FOSDEM by detaro on Thursday February 07, 2019 @12:46PM (#19106843)
Probably, yes. The key from that perspective is to have it in the same format as the content traffic.
[ Parent | on HN ]
Re:The Big DNS Privacy Debate at FOSDEM by Arnavion on Thursday February 07, 2019 @03:51PM (#19108474)
We already have DNS over HTTP(S) now.
[ Parent | on HN ]
Re:The Big DNS Privacy Debate at FOSDEM by svsucculents on Saturday February 09, 2019 @08:20AM (#19122099)
What a mess.
[ Parent | on HN ]
Re:The Big DNS Privacy Debate at FOSDEM by gsich on Thursday February 07, 2019 @11:56AM (#19106450)
Major advantage is the latency. TCP needs 3 trips, TLS an additional 4. With dnscrypt you have one request and one response.

Then again, Cloudflare and Quad9 terminate the connection almost instantly after finishing your request. Tested this with DoT though. (stubby with high timeout set)

[ Parent | on HN ]
Re:The Big DNS Privacy Debate at FOSDEM by icebraining on Thursday February 07, 2019 @12:19PM (#19106631)
Are you sure that's not a problem with the client? It seems Cloudflare supports leaving the connection open just fine (at least using the cloudflared client).
[ Parent | on HN ]