Hacker News Reader

Comment by ma2rten | Hacker News Reader

This was very well written. I am pleasantly surprised.

Another concern is that DOH will complicate content delivery to users. Today, content delivery networks (CDNs) host multiple instances of web content on geographically dispersed servers. This creates resiliency for web services and helps to deliver content to users more quickly. If ISPs lose the ability to view users’ DNS queries, they will still be able to route users to a CDN, but not necessarily the closest or most efficient CDN. Technical measures that may alleviate this concern include sharing some user data (like general geolocation data) and CDN load management tactics.

Is this a real concern? Don't ISPs just route on IP addresses?

Other potential implications of DOH implementation involve issues such as international data flow and advertising competition.

What on earth is this referring to?

View on HN

DNS lookups for CDNs will return a different (local) IP for clients in different regions. The proper way to handle this is using EDNS Client Subnet, which is what Google DOH does. CloudFlare DOH doesn't support this, but instead handles this by making the DNS request from a server near to the end user. This is only roughly accurate, and can't for example point a user's request to their ISP's on-prem edge cache: https://samknows.com/blog/dns-over-https-performance

That refers to the fact that DoH gives the same old monopolies on the web (Google, Cloudflare) additional web visit signal data, worsening the already appalling state of the economy on the internet captured by Google and Facebook for more than a decade, with naive nerds cheering in the name of technical progress. It also refers to ad blocking no longer being able to block ads based on domain names and IP addresses.

Other providers can provide DNS over HTTPS. It doesn't affect client side ad blocking. You can still point your browser to a regular DNS server (like some kind of DNS-based adblock solution), just the default changed.

For how long though? I don't necessarily trust either Chrome or Firefox to quietly accept my "why yes, use normal DNS" choice, so I've just gone ahead and set up DoH at home (since I'm already running DNS at home). But then again, I can.

Are you saying DOH does not affect client side ad blocking because it can be shut off?

Of course.

If you blocked ads using browser addon like uBlock, that's going to be neutered with manifest v3 in Blink (i.e. Chrome/Chromium/Edge).

If you blocked ads using pi-hole like setup, now that's sidestepped.

If you wanted to enforce your DNS, now you cannot, because it will be mixed with other https traffic. For now, you can do DPI on the SNI, but that's going to end with eSNI too.

It's referring to the ability of ISPs (as of last year) in the USA being able to use your DNS requests for advertising purposes. The argument for this is to expand competition around ad based products by enabling ISPs to join the game that large web properties currently dominate.

God forbid there's a piece of infrastructure that can't show ads.

Reply on news.ycombinator.com