Hacker News Reader

Comment by somat | Hacker News Reader

Until the apps figure out dns over http. sigh

You can at least partially mitigate this by simply blocking the major DNS-over-https endpoints. There aren't that many. However, in my experience this really pisses off some devices e.g. Google/Nest Home speakers even if you have regular DNS working fine. You also of course won't catch the really nefarious devices phoning home over a custom non-public endpoint. It can be interesting just for logging purposes as well, that's what I do.

https://jpgpi250.github.io/piholemanual/doc/Block%20DOH%20wi... really digs into the nitty gritty of how to do it to a crazy extent.

This really feels like a game of whack-a-mole.

Personally, I think DoH was a mistake. Instead of the network admin configuring the name resolution services (via DHCP, for example) each app has a hard-coded list of IP addresses that it will use to resolve hostnames. Instead of a system resolver that does the job we now have a resolver, complete with hard-coded server configuration, baked into various applications/devices.

I imagine that eventually we'll see content and DoH served from the same endpoint. Or ads proxied from the same location as the content.

Yep, playing whack-a-mole trying to block it is a losing battle long term, but for now it kinda works. Serving content from the same endpoints is indeed the whole point because it makes it hard to block without collateral damage.

Probably the only way to really block it is some kind of SSL unwrapping and deep packet inspection at the firewall but that's a HUGE hassle to deal with and is itself a potential privacy issue.

Reply on news.ycombinator.com