News for hackers. Stuff that matters.

A comment on Chrome is deploying HTTP/3 and IETF QUIC. Parent comment

Re:Chrome is deploying HTTP/3 and IETF QUIC by userbinator on Wednesday October 07, 2020 @03:39PM (#24711864)
HOSTS files are the simplest and can already remove quite a bit of cruft, but what's effectively tunneling DNS in its own VPN will bypass that.

Ad blocking extensions are really a "last defense" and can be slowly lobotomised as they are under browser vendors' control.

[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by stefan_ on Wednesday October 07, 2020 @04:37PM (#24712442)
You got it the wrong way around. Ad blocker extensions should be your first choice, this DNS blocking business is really for devices where that is not possible ("Smart" TV et al) and it's getting less effective by the day.
[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by staticassertion on Wednesday October 07, 2020 @04:37PM (#24712446)
I assume DNS over Whatever will still respect the HOSTS file? I'd be really surprised to find otherwise, but would love to hear if that's the case! If you don't trust the browser you already have very little defense against ads, no? After all, the browser could always just resolve DNS itself.

HOSTS files may also be simplest (I totally disagree btw), but I can't imagine they're anywhere near the most common.

[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by userbinator on Wednesday October 07, 2020 @07:35PM (#24714085)
After all, the browser could always just resolve DNS itself.

That's exactly how DoH is being implemented, and it's why it has caused so much controversy.

[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by staticassertion on Wednesday October 07, 2020 @11:14PM (#24715319)
Pretty sure Chrome has been using its own DNS resolver for ages. I don't see the issue either way.
[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by cookiengineer on Thursday October 08, 2020 @03:30AM (#24716779)
> Pretty sure Chrome has been using its own DNS resolver for ages.

That is correct, the IPv6 probes are embedded in the Chromium source, and are removed by the Ungoogled Chromium and/or Inox patchset [1].

[1] https://github.com/Eloston/ungoogled-chromium/tree/master/pa...

[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by silon42 on Thursday October 08, 2020 @10:00AM (#24719140)
How do they handle "enterprise" proxies that ban direct internet access? I probably should setup that at home.
[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by cookiengineer on Thursday October 08, 2020 @11:08AM (#24719771)
Chrome itself always requests HTTP first, except for HSTS and their own pinned certificates list which is actually shipped within the source code.

That's also a major difference to Ungoogled Chromium, where UC will request "https://..." by default if you just enter the domain.

So in the case of Enterprise Proxies that have no locally force-installed cert to sniff on internet traffic will likely end up with HTTP-everywhere being used. But usually employers that encourage such bad practices also install their snakeoil MITM certificates locally.

[ Parent | on HN ]
Re:Chrome is deploying HTTP/3 and IETF QUIC by judge2020 on Wednesday October 07, 2020 @06:22PM (#24713491)
Chrome respects HOSTS file modifications itself[0], but I'd still recommend a pi-hole with DOH set up[1].

0: https://i.judge.sh/chief/Spoon/notepad_fwyvP8v6li.png

1: https://docs.pi-hole.net/guides/dns-over-https/

[ Parent | on HN ]