An app running on the system needs to be able ask the OS for an encrypted DNS lookup or where it should perform such a lookup and get be able to decide what to do when it can’t.
The UI needs to be there to accept DoT or DoH networks from DHCP on trusted network profiles but the a user-chosen default on untrusted networks.
Should application vendors simply do nothing until then, even when they can do something now? Should programmers always wait for the perfect solution to come along and only then ship the definitive version? What happened to building what we can now and incrementally improving over time?
There isn't even a consensus on how best to implement encrypted DNS. How do we decide which proposal to standardize on if we're so reluctant to test them in the wild? Without successes and failures to learn from, there is even less chance that OS vendors will deviate from the status quo.
However, the "centralization problem" isn't solved by more competitors existing because widely deployed applications will still have to choose a single option for all but a tiny segment of users that will change it.
If the default comes from the OS vendor then we're in a slightly better place since the default for macOS and iOS will be Apple's servers, Windows will be MS, Android will be Amazon or Google. Competition in this space comes from the people who decide what DNS service to use, not the people standing up the service.
Alternatively, I see no reason why someone can't write a small application that runs a resolver on localhost, adjusts your hosts file accordingly, and forwards queries to any third party or distributed network of your choice. Wait a sec, I already have dnsmasq and/or systemd-resolved doing this on some of my machines. It can be done right now with no need to wait for the OS vendor to change things.
The local resolver that proxies DoH or DoT is nice (I'm using it right now too!) but it doesn't solve the problem of applications wanting to be sure they're getting an encrypted connection.
You seem to be presuming that a single "service" is necessary. "Alternative" centralized services are still a centralized service. The solution to Cloudflare being able to log everything isn't to hand that same power to someone else.
I run my own recursive resolver. Only the first request for a domain's NS record goes to a centralized service; every other request goes to the domain specific nameserver. Asking ns.example.com for the A/AAAA record for www.example.com doesn't tell example.com (collectively) much more than they will learn from the HTTPS request that usually follows.
Yes, ".com" can log that I asked for the authoritative nameserver for "example.com", but this is usually cached. The centralized nameservice doesn't see most of the DNS traffic.
Yes, the communication with each domain's authoritative nameserver is often unencrypted. This is unfortunate, and I strongly support an encrypted replacement protocol for all communication with nameservers.
Using DoH sends all of the above to one entity... which then likely sends it unencrypted to the authoritative nameservers. The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS.
> for a lot of people in a lot of countries, a choice to use any resolver that isn't controlled by their ISP/government is a step in the right direction
Providing this as an option for people in those situations is great. That doesn't mean it will be a benefit for everyone. For many people, DoH is a significant loss of privacy.
> So please stop trying to drag down other people who are doing their best to make progress.
Please stop using this cheap appeal to emotion that presumes one solution will help everyone.
> Show us the code or GTFO.
We don't need to when the existing DNS situation was already a better option. Please learn about the diverse way that DNS is actually used in practice. Also, please consider the damage that is done by encouraging apps to bypass OS-control of DNS. This takes a lot of control away from the user, and will piss off a lot of people that use DNS-based adblocking.
not necesarilly. With HTTPS the ISP will see the IP being connected to, not the domain. Since there can be multiple domains behind a single IP address, the ISP cannot know the exact domain. On the other hand since more and more websites use cloudflare revproxy service, quite often all the ISP will see is one of cloudflare IPs being connected to, whereas Cloudflare will know the exact domain (and URI) your browser is requesting. And Cloudflare will get that information regardless of the way you look up DNS record
A fully distributed alternative can just as well be considered a "service" if it can be plugged into a browser or OS to replace the default resolver.
> The ISP learns about the result regardless right after the domain name has been resolved to an A/AAAA record, when the browser sends the TCP+SYN packet to start HTTPS.
Cloudflare is working hard on closing that loophole. Thanks to their evil monopoly, hundreds of hostnames resolve to the same set of IP addresses. The only clue as to which of them a person is trying to visit is in the SNI header, which requires some serious deep-packet inspection to figure out. Even that is going to be encrypted soon.
> That doesn't mean it will be a benefit for everyone.
> Please stop using this cheap appeal to emotion that presumes one solution will help everyone.
Who is this "everyone" that you keep talking about? Last time I checked, everyone and their cat was using Chrome. Chrome is planning to enable DoH in a future version only if it detects that you are already sending DNS queries to a service that supports DoH. No change of privacy there. The one browser that's planning to go full-time DoH with a partnership with Cloudflare is Firefox, an underdog with only 4% market share.
So "everyone" is NOT being forced to adopt the same solution. People who want DoH can switch to Firefox. People who don't want it have several other browsers to choose from. It's a free market. Let companies experiment, and let people vote with their feet. Use something else or build something new if you don't like what's available. That was my whole point.
There's so much negativity around the issue, one would have thought that somebody got caught red-handed colluding with the NSA or something :(
Its easy to change from Google to DuckDuckGo on that preference page. A similar user accessible option to change providers (or disable DoH functionality entirely) would go a long way to soothing the community.
Right now, for a lot of people in a lot of countries, a choice to use any resolver that isn't controlled by their ISP/government is a step in the right direction. So please stop trying to drag down other people who are doing their best to make progress. If you don't like the direction that they're headed, build an alternative, write an RFC, or do whatever you can to show us how you think it should be done instead. Show us the code or GTFO.