Re:If You Use Comcast DNS Servers, You Cannot Read This (try...
by eurleif on Sunday April 29, 2012 @03:13PM
(#3906735)
>You could then send queries to multiple DNS servers simultaneously, so that no single server can censor.
>Now think of all the latency added by that system
If you send the requests at the same time, the latency should be the same as querying the slowest of the DNS servers individually (or the nth fastest server, where n is the number required to establish a quorum, if you don't require results from all the servers).
I think this is a little naive. Let's say you want to fix this, what could you do? Well, you could sign the responses; that would prevent hijacking, but it wouldn't stop the ISP from returning SERVFAIL, since the server could really be unavailable.
Well, then you could use another DNS server, and encrypt the queries so that the ISP has no idea what's being queried (and therefore can't do selective censoring). But now you've replaced one single point of censorship for another.
You could then send queries to multiple DNS servers simultaneously, so that no single server can censor.
Now think of all the latency added by that system, and which is useless because the ISP can wait for the DNS to resolve and then drop the HTTP request to that host.
You could make the ISP a dumb pipe by using a VPN, but now you've gone back to replacing an evil for another.
Eventually, to really fix the problem you'd need a Tor like system with anonymity, dynamic routing and hash-based addresses, but that's extremely inefficient and complete overblown for vast, vast majority of cases unless you're in a dictatorship.