I am against individual applications making their own DNS queries. This is a responsibility of the OS.
I love the idea that I can query DNS without being spied upon. However, at home, for the protection of my family and me I want all devices to go through a certain DNS server.
So where does this leave us? We're delegating the statement of 'I'm being secure' to the DNS server itself.
Shoutout to my Google Mini which ignores DNS servers in the DHCP response.
It's not just ISP operated DNS. There are many other scenarios where multiple parties share one DHCP server, where the DHCP admin's choice of DNS might not be what every other participant desires. For instance, using a public wifi, roommates sharing a router, visiting someone's house, etc.
Put Roku on that list. They also break in a spectacular fashion if you redirect the queries to a DNS server that returns NXDOMAIN. Its like they query in an infinite loop with no rate limits. They absolutely hammer the DNS server.
Kindle Fire tablet has hard-coded Google's 8.8.8.8 DNS server, bypassing the Pi-Hole ad blocker.
People like you are the reason DoH is being rolled out. I hate the concept, but I would immediately enable it if I caught my IT unapologetically getting in the way of my work like you do.
DoH as protection of my own traffic against snooping ISPs is very much welcome. DoH as protection of locked down apps and devices against their owners - not so much.
But every other network request they will ever make is fine if they do it themselves? Like at some point we have to be like DNS being a service provided by the system to apps was mostly a historical accident or an idea for a network model that never really panned out.
I would have loved to see the alternate universe where your typical unprivileged app has no direct access to sockets and routes all requests through a system service that handles all the application-layer protocols and encryption.
I think that I prefer the network model where I the system owner have control over what the programs executing on my behalf are doing on my system and my network. I really don’t want to be presented the choice of binary blob A, binary blob B or living without Internet access.
> I would have loved to see the alternate universe where your typical unprivileged app has no direct access to sockets and routes all requests through a system service that handles all the application-layer protocols and encryption.
Ditto.