Hacker News Reader

Comment by gerdesj | Hacker News Reader

DNS over http will eventually destroy DNS as we know it. Thanks Goog n co!

DNS at the moment over 53/UDP is manageable and malleable. DNS over http is not and is up to your browser and hence a vendor.

Life on the helpdesk will become rather more nasty and worse than it is now and we probably won't get tools to diagnose what is going on inside the browser, and so life for IT will be increasingly crap.

I suggest we don't let the FAANGS run the world or the browser.

View on HN

DoH does not depend on a browser! Try this out with cURL

    curl --http2 -H 'accept: application/dns-json' "https://1.1.1.1/dns-query?name=cloudflare.com" --next --http2 -H 'accept: application/dns-json' "https://1.1.1.1/dns-query?name=example.com"

There are DoH resolvers[0] that you can use that act as a "middleman" between your browser (configured to use a standard DNS server) and DoH (which is more secure and private)

[0] https://github.com/DNSCrypt/dnscrypt-proxy

I personally consider curl to be a CLI web browser.

Is this satire? DNS is not malleable when every middlebox fucks with your queries. The protocol rusted in place a long time ago.

there are still environments (countries, orgs, isps) were dns fuckery is kept low and the overhead of dot/doh is just wasted energy/time.

not to say it is bad to have secure alternatives, but i think the internet will loose a lot of resiliancy and efficiency in the switch.

Exactly. DoH seems a fix to work around US ISP monopolies vs something actually desirable. Normal DNS has plenty of opportunities to work around bad providers and keep going.

This makes no sense at all. No part of DoH service involves a browser.

Correct, but on the other note, browsers do do involve the DoH.

DNS over port 53 (udp/tcp actually) is no different from the manageability perspective, browsers could just have easily decided to skip the OS resolver with a TCP socket and just because it's HTTPS doesn't mean you cant still do resolution at the system level with it.

> DNS at the moment over 53/UDP is manageable and malleable.

As for that malleable part... You always trust the networks you're on? Because my ISP, in the US, will inject JS into an insecure page load when I'm at 80% of my monthly data cap - I can only assume they're sniffing anything and everything in the clear. It's 2022, we shouldn't consider insecure transports viable. Zero trust, cliche or otherwise.

Reply on news.ycombinator.com