Hacker News Reader

>They would need to have a fallback in case people block DoH.

How do you block DoH?

Blackhole 8.8.8.8, 8.4.4.8, 1.1.1.1, and 1.0.0.1.

Technically, the provider could use something else, but are they so worried about ad blocking that they’ll run BGP anycast themselves?

Add 9.9.9.9, and the other IP. Besides 4.2.2.2 and 4.2.2.1. Also the IPv6 equivalents. There's almost an infinite number of DNS servers.

Block port 443 and configure machines to use an http proxy with a cert installed?

The 90's called, they want their technology back >:-(

Zscaler is a multi-billion dollar company, and the comment you replied to basically describes their primary product. Cloudflare now has a Secure Web Gateway product. So does VMware, and Cisco, and just about any networking/security vendor who is trying to make a play in the "SASE" space.

Hate to say it, but invisible TLS-intercepting proxies are more widely used today than they were in the 90s.

that would be a nightmare to manage and impractical for most home networks

Sure, but if you’re rolling out an SOE for a business it’s really not much more work.

Reply on news.ycombinator.com