Hacker News Reader

Comment by xg15 | Hacker News Reader

> Most people don't have their own DNS server, so their DNS traffic is already who-knows-what server with who-knows-what monetization in place (plus its in plaintext, so the rest of the internet gets it too).

I know perfectly well who operates my DNS server: My ISP. If they are doing shady stuff, I can sue them, raise awareness or switch providers.

I can't do the same with hardwired DoH endpoints.

View on HN

My ISP, at&t, sells my dns queries by default. I turned it off in the account privacy settings, but I still dont trust them and they are the only ISP that serves my house. As well, firefox lets you choose your dns over https provider in settings, its hardly "hardwired".

It's easier to switch ISPs than it is to just configure FireFox to use some other DoH provider?

So now we need to worry about making custom DNS config for every single app on a computer?! It’s absurd.

I feel like that’s a slippery slope that will probably never happen. Most likely you’ll have to configure your browser(s) and that’s it.

Does your OS allow you to configure global DNS-over-HTTPS settings? Then you can hardly blame apps for not importing them.

Yes, getting rid of shitty old standards means we have to live with multiple in parallel for a while and in the mean time bear additional complexity/work. Otherwise civilization will never advance.

My OS (glibc, specifically) provides a way to resolve names (gethostbyname) using various means (hosts file, mDNS, DNS, directory service) configured by nsswitch.conf. Some distributions (e.g. Ubuntu) even move this to a separate daemon (systemd-resolved) which does stuff like DNSSEC validation and DNS-over-TLS (DNS-over-HTTPS is not (yet) supported natively, you need an extra program for this). I don't think moving common functionality from the OS into individual applications is "getting rid of shitty old standards", we will end up with multiple duplicated implementations.

I agree, an common, likely OS provided API to resolve names is in the theory the best way to go. Not least because it allows OS vendors to replace the implementation with more modern and secure variants over time by pushing sane standards. Sadly they didn't do their job and most DNS is still un-encrypted. Eventually others comes along and do it by themselves. Obviously not on the OS level, since they don't have control over that.

Yes, "multiple duplicated implementations" is the natural consequence of badly maintained software. But eventually I'd hope OS maintainers get their act together and implementations will start to converge again.

Reply on news.ycombinator.com