Hacker News Reader

Comment by nicolaslem | Hacker News Reader

My main gripe is that before DoH, setting a custom DNS via DHCP was enough to get all devices on a network and all applications on these devices to use a custom DNS.

Now we are headed to a future where each software vendor decides how to make DNS queries. I can predict that all of them will apply their own custom heuristics to detect things like split-horizon.

View on HN

> before DoH, setting a custom DNS via DHCP was enough

That ship had already sailed. You also have to run your own DNS, allow DNS egress only from your own DNS, and DNAT the rest back to yours in order to un-break all the things with hard-coded resolvers.

Same with NTP surprisingly. Literally everything I have talks to a NTP server once in a while, but only Linux machines actually ask the network's NTP servers.

Lots of embedded Linux devices have hardcoded NTP servers. Was caught by surprise at this after I'd segregated a bunch of stuff to have no Internet access.

Absolutely, but I found it surprising that even my Kindle contacts an NTP server, or that both Android and Apple phones do.

Why don't they ask DHCP for a nice stratum 1 server instead, I don't know, maybe someone here does?

We are headed toward that future because the broader network has proven that it cannot be trusted; it should come as no surprise that user agents would develop defense mechanisms. If this is another step toward ensuring that ISPs are nothing but dumb pipes, I welcome it.

This is another step toward ensuring that _you_ won't have any visibility what applications running on your computer do, where they connect and why.

Unless OSs quickly implement DoH, if they did, software makers won't have any excuse to roll their own opaque ones, aside of malicious reasons.

End-to-end TLS is dead.

It started with PCI compliance. Next up was Corporate IT making sure idiots weren't signing up for Dropbox with their LAN password. Schools: Well, they always used proxies with no expectation of privacy whatsoever so traffic inspection was nothing new.

In 5 years TLS-recryption -- whether through software or a hardware middlebox -- will be as ubiquitous as a NAT firewall is now. The only question is if the keys will be in the hands of the consumer or in escrow with Big Gov.

The idea that anyone in their right mind would allow uninspectable traffic to egress their network is beyond ridiculous. I'm glad that DoH is making people realize that.

Reply on news.ycombinator.com