> 5) Privacy is already solved using "DNS over https".

Both yes and no. It shields the user from ISP's DNS-based invigilation but at the same time it hides application requests from the user, renders user's own DNS-based filtering (pihole and such) useless and can just transfer spying ability from local ISP to big corp.

Probably an unpopular opinion but personally, I don't consider DoH as an upgrade but a deprivation of user's control.

I see its theoretical benefits for less technical users who haven't heard of pihole or even problems that it solves. Just theoretical, because what benefits the user is often in opposition to what benefits the corporation.

I imagine the GNU answer would be that you shouldn't run hostile / nonfree software on your machines, and you should simply be able to tell your software not to contact undesired servers (via configuration or, worst case scenario, recompilation).

Having recently fully de-Big-Teched all my devices, I have the luxury of agreeing with that philosophy.

As a slightly less harsh compromise, even if you run hostile apps you should be able to install a personal root certificate on your devices and MITM their traffic. Still, I imagine most IoT devices don't give you any way to do so, so you should avoid them or keep them disconnected from the wider Internet if they're still useful otherwise.

Either way, the pihole corner case is not a very good argument against DoH, which is far more often a security improvement.

A better argument is the big corp one, since DoH indirectly boosts their power (because a self-hosted site becomes less anonymous than one hosted on a shared AWS IP).

> Having recently fully de-Big-Teched all my devices, I have the luxury of agreeing with that philosophy.

I'm curious as to what this entailed for you. To me this sounds like I'd cut off contact with over half my family. The social media I could get around/ignore altogether, but I never figured out how I'd manage the messaging situation.

I was inaccurate, sorry. My devices only run either Linux or rooted LineageOS, but I do run some hostile Big Tech apps on them like WhatsApp or Tinder. However, I use tools like TrackerControl and Insular to prevent them from calling hosts other than those I have explicitly whitelisted, or from accessing data they shouldn't.

I still avoid installing them when possible. Facebook, Airbnb, and many others work just fine via their websites.

Is anything wrong with Matrix?

Honestly just never explored it much, but my whole family and friend circle is on Facebook Messenger. Does this work through Matrix in some way?

It solves the problem of your ISP's DNS resolver being hostile in one way or another. But you still have to have complete trust in the resolver you choose. Which is not great if most people choose $BIGCORP's resolver.

In my opinion, most of DoH's protocol problems (and implicated problems) have been solved by oblivious DoH.

We still need more ODoH proxies for me to completely trust the system, but any ISP could set those up if they wanted to. There's probably some information that can be extracted from the encrypted DoH request, but I don't think it's anywhere close to the problem DoH posed when it was first introduced (and more importantly, the problems caused by the way it was introduced in Firefox). I think the benefits massively outweigh the disadvantages.

Leveraging alternative protocols for DNS has always been an option and always will be. Apps and IoT have been doing this for years. Any application that cares about being blocked can trivially work around DNS problems with their own HTTPS-derived protocol and some do. What's left to block are the companies that won't deal with DoH problems anyway.

The control DNS interception provides is mostly an illusion. Kids at high school know how to bypass DNS blocks; application developers can be even harder to block. The only solution is to not run untrusted software in your network, or work with a traffic whitelist for hardware and software you can't control.

> but at the same time it hides application requests from the user, renders user's own DNS-based filtering (pihole and such) useless

Can't you proxy it over a local DNS-over-https server that will provide filtering/caching and then have it query the upstream server?

I cannot trust non-free software to use OS DNS settings (Chrome taught me that).

I wouldn't want to proxy all HTTPS traffic (may not be possible if software ignores system-wide TLS CAs and uses bundled trust chain).

DoH introduces bunch new problems without solving any that I had.

You can simply run your own DoH endpoint, or use the endpoint of someone you trust.

What about software that could query another endpoint without my knowledge?

Even early Google Chrome shat on OS DNS settings and was querying 8.8.8.8 but that could be filtered.

What about it? If you can't trust it, you can't trust it. You either control it, don't control it and don't care, or don't control and it's a moot point. Nothing you deploy even needs to use "real DNS" to look things up; it could just set up a TLS channel with an IPv4 rendezvous.

The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better about what your Chromecast or Amazon Stick or whatever does on your network doesn't make a whole lot of sense. I don't mean to put a bunch of stuff on you that you didn't say, but this is a very common pushback to DoH, and it makes no sense.

> The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better

You're imagining things.

That ISPs are blocking DoT so they can continue monetizing DNS metrics? No, that's happening.

There's no reason that DoH couldn't be a shared OS service.

6) In the spec we clarify: "While DNS is distributed, in practice it relies on centralized, trusted registrars to provide globally unique names. As the awareness of the central role DNS plays on the Internet rises, various institutions are using their power (including legal means) to engage in attacks on the DNS, thus threatening the global availability and integrity of information on the Internet."

The problem is that the current implementation and deployment of DNS is the issue. GNS has built-in security privacy using crypto and p2p on the one hand with enough user-centric flexibility for trust and zone governance on the other to mitigate power grabs.

I hate that I had to double check when you said "GNS uses crypto" and realised you meant crypto as in cryptography, not the other meaning commonly associated with blockchain coins.

> Real problem: domain squatters. Can't see GNS solves this.

What's the point of squatting random identifiers? Seriously, what damage does it do to you if I "squat" on ´www.000G006K2TJNMD9VTCYRX7BRVV3HAEPS15E6NHDXKPJA1KAJJEG9AFF884´ ?

Actually, GNS does solve this partially: If there is a squatter for, e.g. example.com, and this is a troll preventing Example Co from claiming their "name", they could just lobby/advertise for this mapping configuration in start zone configurations:

example.com = <theirZonePublicKey>

to be shipped with implementations. The squatter of "example" at the "com" registrar can be circumvented. If users/implementations choose to do so. The secure and unique names under the authority of Example Co will always be reachable in their zone.

I would consider this to "unsolve it".

Today Example Co can go to the courts and say "we own the name 'example', so we should have example.com". This works in many countries today. (Or they can offer current owner a sum of money).

With GNS they would have to lobby all sorts of GNS providers. That's a worse situation.

Well compelling the TLD owner (in this case .com) through the courts to change the delegation to your zone also works in GNS. (You would not force some kind of "hand over" of the example.com domain. Because that is not how it works).

Similarly "buying the domain" simply means having this party yield the registration at the domain registrar to you.

Anyway, both also works in GNS. My example addresses the case where the legal claim is not possible and the other party uncooperative while "consensus" is that it is a squatter with no claim. (Or, by extension, a censorious circumstance, think TPB)

1) Censorship is a very real problem on the clearnet.

2) Users ultimately decide what root zones to trust or directly what nicks map to what public keys.

3) This is fundamentally the same class of attack as MITM/Evil Maid, it is impossible to completely defend against this. Existing DNS/PKI does not fix this either, It merely put everyone's eggs in one basked and hands the problem off to rent-seeking intermediaries (CA's, Registrars, etc.) which serve no purpose other than racketeering.

The purpose is not to make MITM impossible, just harder. Users will familiarize themselves with the risks of the system just as they do with Tor/I2P addresses.

Most users already receive phishing messages telling them to "Go to microsoft.signin.net to reset your password!" so they already know not to trust domains unless they trust the entity giving them the domain - that should be a sign that the existing DNS isn't socially expected to authenticate identities before letting them own a domain.

When you want to go to a company's website, do you use a search engine or just go to <company_name>.com and hope for the best? If so, do you expect every company to squat every TLD with their name?

5) LOL! Yeah... encrypts your DNS request directly to cloudflare or <intermediary>'s servers. GNS fixes this.

6) The centralization of the existing internet infrastructure in general is something that should be avoided. I for one, do not mind if it makes your job more difficult. It is not just critical for global security but also for personal liberty on the internet.

The centralization of crap like DNS serves as a major hurdle for average users and affects the use of the internet as a free-speech tool, even if you might not realize it. How do you get a domain? You have to pay a registrar, which means you need a credit card. How does a user host their own blog/email/whatever without jumping through all these hoops? They don't, they just use twitter or gmail or something and accept corporate censorship. DNS is a wedge towards "web 2.0" social media and thus censorship.

I wonder what Arab Spring would look like if everyone had easy access to a secure, private, decentralized internet instead of the what we have today where users are funneled into a handful of monopolies for corporate gain and social control.

A functional internet probably makes your job harder because the majority of the software industry is built on rent-seeking business that offers (service-based) solutions to systematic artificial problems like that of DNS, PKI, IP.

Censorship is a big problem. The Daily Stormer is a canary in the coal mine for how controversial clearnet websites can be censored in countries that have not yet gone the China route.

I mean, fuck the Daily Stormer, but the sites that have been most subject to state-mandated DNS blocking are primarily torrent search engines, which most people would agree are a good thing. I'm willing to accept the loss of DNS blocking as an avenue to attack the Daily Stormer in order to preserve the Pirate Bay.

TPB is still alive on Tor BTW:

http://piratebayo3klnzokct3wt5yyxb2vpebbuyjl7m623iaxmqhsd52c...

1) is a much smaller problem than 2) indeed, but it does still happen.

5) This hides your queries from middle boxes, but your DNS server can still see the domains you are looking up. (There are some proposals to address this that involve a proxy who can't decrypt your request, so the DNS server can't see who sent the query.)