Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default
by dagenix on Saturday September 07, 2019 @11:34AM
(#20904397)
It's easier to switch ISPs than it is to just configure FireFox to use some other DoH provider?
[ Parent
| on HN ]
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default
by orev on Saturday September 07, 2019 @11:40AM
(#20904439)
So now we need to worry about making custom DNS config for every single app on a computer?! It’s absurd.
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default
by Faark on Saturday September 07, 2019 @02:30PM
(#20905616)
Does your OS allow you to configure global DNS-over-HTTPS settings? Then you can hardly blame apps for not importing them.
Yes, getting rid of shitty old standards means we have to live with multiple in parallel for a while and in the mean time bear additional complexity/work. Otherwise civilization will never advance.
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default
by Jenda_ on Saturday September 07, 2019 @10:50PM
(#20908298)
My OS (glibc, specifically) provides a way to resolve names (gethostbyname) using various means (hosts file, mDNS, DNS, directory service) configured by nsswitch.conf. Some distributions (e.g. Ubuntu) even move this to a separate daemon (systemd-resolved) which does stuff like DNSSEC validation and DNS-over-TLS (DNS-over-HTTPS is not (yet) supported natively, you need an extra program for this). I don't think moving common functionality from the OS into individual applications is "getting rid of shitty old standards", we will end up with multiple duplicated implementations.
Re:What’s Next in Making Encrypted DNS-over-HTTPS the Default
by Faark on Sunday September 08, 2019 @02:07PM
(#20912207)
I agree, an common, likely OS provided API to resolve names is in the theory the best way to go. Not least because it allows OS vendors to replace the implementation with more modern and secure variants over time by pushing sane standards. Sadly they didn't do their job and most DNS is still un-encrypted. Eventually others comes along and do it by themselves. Obviously not on the OS level, since they don't have control over that.
Yes, "multiple duplicated implementations" is the natural consequence of badly maintained software. But eventually I'd hope OS maintainers get their act together and implementations will start to converge again.