News for hackers. Stuff that matters.

A comment on Improving DNS Privacy with Oblivious DoH. Parent comment

Re:Improving DNS Privacy with Oblivious DoH by saurik on Tuesday December 08, 2020 @02:37PM (#25350253)
On every single operating system it is possible for this kind of improvement to be installed as a system-wide replacement for the local resolver, whether by a direct plugin or by running a resolver on localhost. This is how these upgrades can be deployed if you don't want to wait for the OS.

The problem is that browsers and other applications are just unwilling to let the user see how their products work or decide anything for themselves--or even just architect their installers to involve dependencies on a shared resolver upgrade--and so we end up in this hell of applications actively hiding their traffic from you.

And like, "great": now we have a new version of DoH and have to wait for everyone to upgrade their apps that upgraded to DoH before? This is ridiculous bullshit... this should be a single app on your device you now upgrade. Hell: Cloudflare even develops that app for a number of platforms! They aren't even the problem... it is everyone who jumps on "embedding" this behavior :/ :/ :/.

(For a more technically-comprehensive rant about this, read my comment from a year ago:)

https://news.ycombinator.com/item?id=21701808

[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by judge2020 on Tuesday December 08, 2020 @02:57PM (#25350510)
iOS and MacOS technically have this (requires a profile[0]) but Microsoft will probably drag their feed on this for the next 2 years with the amount of enterprise customers they have to keep happy; and, given that the network adapter config is still based on Aero controls, they're probably in no rush to add more configuration options before upgrading it to Metro controls.

0: https://paulmillr.com/posts/encrypted-dns/

[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by teddyfrozevelt on Tuesday December 08, 2020 @08:21PM (#25354134)
It's almost ready in Windows.

https://techcommunity.microsoft.com/t5/networking-blog/windo...

[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by judge2020 on Tuesday December 08, 2020 @10:27PM (#25354994)
nice to see - looks like it's even been ported over to the settings app -

https://blogs.windows.com/windows-insider/2020/08/05/announc...

I still think Chrome and FF having it is a net positive though - The steam hardware survey shows 7% of users' OS is a Windows version before 10, so all of these users can use it today before it gets to them in the next major Windows 10 update.

[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by saurik on Wednesday December 09, 2020 @05:05AM (#25357040)
? On Windows this is trivial to implement as you can just set the resolver to DNS on localhost; the only reason iOS needs something special is because you can't run servers/daemons.
[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by JoshTriplett on Tuesday December 08, 2020 @05:41PM (#25352485)
This is exactly why browsers support doing their own name resolution: because some OSes advance much more slowly.
[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by saurik on Wednesday December 09, 2020 @05:06AM (#25357046)
But instead of it being in the browser, it should be a separate app that upgrades all apps that use the native resolver.
[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by 1over137 on Tuesday December 08, 2020 @03:14PM (#25350727)
Why on earth is a "configuration profile" required for this?
[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by judge2020 on Tuesday December 08, 2020 @04:11PM (#25351400)
I imagine Apple is weary about having a UI for this since it might cause more bad PR/complaints about people being able to get around (for example) school website filters. Chrome eased its UI rollout by introducing a managed policy that admins could configure before the UI was enabled. https://cloud.google.com/docs/chrome-enterprise/policies/?po...
[ Parent | on HN ]
Re:Improving DNS Privacy with Oblivious DoH by alwillis on Wednesday December 09, 2020 @01:39AM (#25355976)
Because if you need to configure a fleet of Macs or iOS devices for a school or business, it’s easy to push a configuration profile to all of them using tools commonly in use by IT departments and admins.
[ Parent | on HN ]