Hacker News Reader

Comment by swiley | Hacker News Reader

The internet supposedly exists because it provided a more reliable way to order nuclear missile launches.

DNS over HTTPS is controversial because the current implementations take power from the end users (by moving the resolver out of libc who’s configuration and often implementation is controlled by end users and into certain applications where the user is lucky if the app allows them to adjust the parameters, especially if the interface is stable and intuitive. They really have to because cramming http and tls into libc is a bit crazy.) Furthermore it concentrates power and data into the hands of a couple of organizations where previously using their resolvers was optional. At this point I’m not entirely sure I trust Google any more than most foreign governments or even my own.

View on HN

Nonsense. End users have the power to configure their browsers just like they have the power to configure their DNS settings, their operating system and all the rest. Of course very few people do. Mostly that power requires something most users don't have: which is knowledge to know they need to do this and how to do this. The people actually capable of doing this lose no power whatsoever.

You seem to not trust Google. Nobody is saying you should or must. Other DNS servers are available. Set up your own one if you must. You have that power. If you are smart enough to actually know how to set up DNS now, you should be able to figure out how to configure that to use https. It's not rocket science.

If not, maybe it's a good thing that your browser stops blasting your DNS queries unencrypted over a public network to absolutely anybody that can be bothered to listen in. This would include all the 3 letter acronym security agencies that you can name (domestic and foreign ones), big ad driven companies, your local police, and everybody else with or without the cooperation from your friendly neighborhood operators or arm twisting of the incompetent politicians representing which ever government is governing wherever you live. The best you can hope for to protect you from that is a combination of incompetence and indifference.

> Nonsense. End users have the power to configure their browsers just like they have the power to configure their DNS settings, their operating system and all the rest.

This power is illusory. If Google decides Chrome will no longer allow changing DNS providers, game over for 60% of internet users. Consider how it's no longer possible to block ads the way you want to in Chrome with manifest 3.

True - but I think this is not the fault of DoH or IETF. On a technical level, the power stems from Google's ability to auto-update Chrome with whatever logic they see fit. On a social level, maybe Chrome's market share and the acceptance of users of that power.

Even without DoH, Google could just as easily have decided to hardwire DNS for Chrome to 8.8.8.8 or to switch Chrome to their own home-grown proprietary name resolution protocol. They don't need a public standard for that.

> If Google decides Chrome will no longer allow changing DNS providers, game over for 60% of internet users.

And if they do that for Android, or Microsoft does the same for Windows, game over for 90% of internet users. Banning DoH doesn't fix that.

>Nonsense. End users have the power to configure their browsers just like they have the power to configure their DNS settings, their operating system and all the rest.

It is already not possible to avoid DoH to Google servers with chromecast

> Of course very few people do. Mostly that power requires something most users don't have: which is knowledge to know they need to do this and how to do this.

Yes, which means that effectively they don't have the power.

>The internet supposedly exists because it provided a more reliable way to order nuclear missile launches.

Not sure about that:

https://en.wikipedia.org/wiki/ARPANET#Debate_on_design_goals

Agree, the internet was NOT created as a missile command and control system.

Baran's seminal work on packet-switching was a RAND C2 study whose concepts were rejected by the extant defence contractors as impractical. When DARPA later wanted to interconnect it's collection of computers to create ARPANET for researchers, Baran's theoretical ideas were dusted off and the rest is history.

Reliable Digital Communications Systems Using Unreliable Network Repeater Nodes (1960)

https://www.rand.org/pubs/papers/P1995.html

>It was from the RAND study that the false rumor started, claiming that the ARPANET was somehow related to building a network resistant to nuclear war. This was never true of the ARPANET, but was an aspect of the earlier RAND study of secure communication. The later work on internetworking did emphasize robustness and survivability, including the capability to withstand losses of large portions of the underlying networks

I was simply pointing to original source docs from one of the co-inventors of packet-based switching, on which the Internet is based. There's a larger series of Baran's works at RAND:

https://www.rand.org/about/history/baran.html

Nukes were definitely part of the Zeitgeist:

In 1962, a nuclear confrontation seemed imminent. The United States and the Union of Soviet Socialist Republics (USSR) were embroiled in the Cuban missile crisis. Both were in the process of building hair-trigger nuclear ballistic missile systems. Each country pondered post-nuclear attack scenarios.

U.S. authorities considered ways to communicate in the aftermath of a nuclear attack. How could any sort of “command and control network” survive? Paul Baran, a researcher at RAND, offered a solution: design a more robust communications network using “redundancy” and “digital” technology.

I think it's worth bringing up at this point that the famous "The Net interprets censorship as damage and routes around it." quote is true only for the layer 3 of the ISO/OSI stack. The Internet as most people understand it is layer 7, and is incredibly centralized.

Web browser DNS resolution hasn't gone through libc in a long time.

Really? Because I remember it respecting the libc resolver configuration are least shortly before the change, now it just ignores it.

Most DNS resolution libraries will read the libc resolver configuration (/ets/nsswitch.conf) and attempt to parse it into something they understand, and potentially fall back to it (for example, if you're doing non-DNS resolution like mDNS).

If you'd like to standardise a way to require DNS-over-HTTPS in supporting software, and convince operating system distributors to generally ship it, I'm fairly sure Firefox would be up for using that rather than its current mechanism, similar to how it uses system proxy settings. As it is there is no such standard.

> If you'd like to standardise a way to require DNS-over-HTTPS in supporting software, and convince operating system distributors to generally ship it, I'm fairly sure Firefox would be up for using that rather than its current mechanism, similar to how it uses system proxy settings. As it is there is no such standard.

There already is a standard way for me to tell all the programs which run on my system which DNS servers to use: /etc/resolv.conf. Any program which does not respect the values I set there is disobeying me.

There is no way to say in /etc/resolv.conf that you want to use a DNS-over-HTTPS server.

> There is no way to say in /etc/resolv.conf that you want to use a DNS-over-HTTPS server.

Sure there is:

    nameserver 127.0.0.1

where I choose to run a nameserver which uses DNS-over-HTTPS on 127.0.0.1:53.

And so we get incredibly far away from the very laudable goal of protecting Internet users - the majority of who primarily use a web browser - by default from malicious DNS servers.

Chrome automatically upgrades known DNS providers to DoH.

Still, it is reasonable to export a standard control interface to the user for site filtering and control.

There isn't one today, aside from running your own DNS server, and you can run your own DNS-over-HTTPS server. My understanding is that Firefox still respects /etc/hosts in DNS-over-HTTPS mode, too. I'm unaware of any such tooling that installs a glibc resolver stub.

RFC8890 explicitly refers to "the interests of that child's parents or guardians" when the child is using a web browser, although individual system configuration is not within the remit of the IETF.

RFC 8484 makes no reference to how DNS-over-HTTPS should be configured, and in the face of widespread DNS hijacking, enforcing DNS-over-HTTPS in browsers may have been the correct solution - but that doesn't mean we can't do better by defining a standard (perhaps under the remit of the Free Desktop XDG group), encouraging operating system vendors to ship secure DNS configured by default, and then convincing Firefox et al to use that standard.

Sure, because big tech pretends to care about privacy and freedom of speech but only insofar as it results in them cutting out every layer of control between their servers and the end users they would like to own. So everything will be tunneled over opaque HTTPS proxies and there will be no facility for people to filter anything - even end users. Apple, for instance, pretends to care about user privacy and control but refuses to offer a configurable IP firewall in iOS or end-user control over name resolution for filtering.

>you can run your own DNS-over-HTTPS server.

Yes, but is there a facility to force the browser to use your server or will Google re-write Chomium to "bypass" "rogue" DoH servers which filter content Google doesn't wish them to filter?

Reply on news.ycombinator.com