Re:The GNU Name System
by tptacek on Monday July 25, 2022 @02:06PM
(#32228467)
You can simply run your own DoH endpoint, or use the endpoint of someone you trust.
[ Parent
| on HN ]
What about software that could query another endpoint without my knowledge?
Even early Google Chrome shat on OS DNS settings and was querying 8.8.8.8 but that could be filtered.
What about it? If you can't trust it, you can't trust it. You either control it, don't control it and don't care, or don't control and it's a moot point. Nothing you deploy even needs to use "real DNS" to look things up; it could just set up a TLS channel with an IPv4 rendezvous.
The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better about what your Chromecast or Amazon Stick or whatever does on your network doesn't make a whole lot of sense. I don't mean to put a bunch of stuff on you that you didn't say, but this is a very common pushback to DoH, and it makes no sense.
> The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better
You're imagining things.