Having recently fully de-Big-Teched all my devices, I have the luxury of agreeing with that philosophy.
As a slightly less harsh compromise, even if you run hostile apps you should be able to install a personal root certificate on your devices and MITM their traffic. Still, I imagine most IoT devices don't give you any way to do so, so you should avoid them or keep them disconnected from the wider Internet if they're still useful otherwise.
Either way, the pihole corner case is not a very good argument against DoH, which is far more often a security improvement.
A better argument is the big corp one, since DoH indirectly boosts their power (because a self-hosted site becomes less anonymous than one hosted on a shared AWS IP).
I'm curious as to what this entailed for you. To me this sounds like I'd cut off contact with over half my family. The social media I could get around/ignore altogether, but I never figured out how I'd manage the messaging situation.
I still avoid installing them when possible. Facebook, Airbnb, and many others work just fine via their websites.
We still need more ODoH proxies for me to completely trust the system, but any ISP could set those up if they wanted to. There's probably some information that can be extracted from the encrypted DoH request, but I don't think it's anywhere close to the problem DoH posed when it was first introduced (and more importantly, the problems caused by the way it was introduced in Firefox). I think the benefits massively outweigh the disadvantages.
Leveraging alternative protocols for DNS has always been an option and always will be. Apps and IoT have been doing this for years. Any application that cares about being blocked can trivially work around DNS problems with their own HTTPS-derived protocol and some do. What's left to block are the companies that won't deal with DoH problems anyway.
The control DNS interception provides is mostly an illusion. Kids at high school know how to bypass DNS blocks; application developers can be even harder to block. The only solution is to not run untrusted software in your network, or work with a traffic whitelist for hardware and software you can't control.
Can't you proxy it over a local DNS-over-https server that will provide filtering/caching and then have it query the upstream server?
I wouldn't want to proxy all HTTPS traffic (may not be possible if software ignores system-wide TLS CAs and uses bundled trust chain).
DoH introduces bunch new problems without solving any that I had.
Even early Google Chrome shat on OS DNS settings and was querying 8.8.8.8 but that could be filtered.
The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better about what your Chromecast or Amazon Stick or whatever does on your network doesn't make a whole lot of sense. I don't mean to put a bunch of stuff on you that you didn't say, but this is a very common pushback to DoH, and it makes no sense.
You're imagining things.
Both yes and no. It shields the user from ISP's DNS-based invigilation but at the same time it hides application requests from the user, renders user's own DNS-based filtering (pihole and such) useless and can just transfer spying ability from local ISP to big corp.
Probably an unpopular opinion but personally, I don't consider DoH as an upgrade but a deprivation of user's control.
I see its theoretical benefits for less technical users who haven't heard of pihole or even problems that it solves. Just theoretical, because what benefits the user is often in opposition to what benefits the corporation.