Where is the DNS headed?

https://www.potaroo.net/ispcol/2020-06/row.html

by m-app • 6 years ago

81 53 6 years ago

potaroo.net

Ericson23143• 6 years ago

s/HTML/HTTP/c in a few places.

teddyh• 6 years ago

What does the “c” flag do?

iso9472• 6 years ago

I think it’s forcing case sensitive. I’ve never seen it though.

dredmorbius2• 6 years ago

"Confirm". It prompts for verification before substituting, in vim:

https://www.linux.com/training-tutorials/vim-tips-basics-sea...

dpenguin• 6 years ago

There are a lot of arguments about how DoH with TLS 1.3 will give us privacy etc by the proponents of DoH(not this article).. but it’s basically moving the trust from ISPs to CDNs. There are fewer major browsers and fewer major CDNs than ISPs, I suppose.. so not sure if it’s a good move.

kd913• 6 years ago

People can host their own DoH server themselves. If I can setup DoH and a VPN over one weekend with a Raspberry Pi, then others can do it too.

I am using DNSCryptProxy on a Pi and it fully supports DoH + eSNI even without cloudflare. Works perfectly with Firefox.

The service picks from 65 DoH servers based against the fastest ping time.

That was/is a lot better than before when in reality my only choice was my ISP DNS. In fact I just learned for the last few years that my ISP was hijacking all DNS requests anyway.

Ericson23143• 6 years ago

Why can't the ISPs run DoH too?

I agree that due to social issues the problems are fairly real (ISPs ain't gonna do shit). But on a purely technical level DoH should be fine.

gsich4• 6 years ago

They can. But the problem lies with Browsers (looking especially at Firefox) just ignoring that. The technical aspects of DoH (or DoT) are fine.

bityard2• 6 years ago

but it’s basically moving the trust from ISPs to CDNs.

Not just CDNs, ISPs can certainly operate their own DoH servers on their existing DNS infrastructure. If they want to continue selling their users' browsing data to marketing firms, that is what they will have to do.

This also moves trust to the browser and OS TLS certificate stores, which may be problematic depending on your opinion of whether or not you can trust every single one of the governments and organizations behind the hundreds of root CAs.

troquerre4• 6 years ago

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake (https://handshake.org) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it shows promise with NextDNS.io and Vercel.com supporting it.

[1] CDNs are a lesser evil than ISPs but I still wouldn’t want to need to trust them to protect my privacy.

stiray2• 6 years ago

This is also my concern. ISPs are typically located in same country making them follow the laws of that country.

I belive authors of the DoH idea were doing it with good intentions but road to hell is paved with good intentions.

What we are doing with DoH is actually breaking decentralised internet infrastructure to centralized (or lets say, less centralized...for now) and this was never a good thing (historywise).

For test why is this bad you can try to block google and amazon ASNs and try to surf around the web. You will notice that the internet is quite different (a hint, yandex.ru was the only search engine I have found that still works)

For instance selling the information about user accessing some domain would be a big no-no in my country.

They are obliged by law to protect customers information except if ordered by court.

With DoH all bets are off. Surely it will give some privacy for users where ISPs are sticking their noses into customers data (like in USA), they wont be able to do it anymore but for me, I trust in our ISPs (or laws) while I surely dont trust google or cloudflare.

We will just give internet resolving into hands of multinational corporations, what could go wrong, right? (Just quick ideas: for $10 / day we offer redirection from yourdomain.com to sellingcrap.com or we resolve .ourinternaldomain only over DoH and not resolve to external ips to force you to use our DoH,...)

kitteh• 6 years ago

What about your ISPs employees? Do you trust a sysadmin pulling 40-50k a year (or less) to not sell your DNS resolver data?

Do you think your ISP has better controls and a security team than some of the big CDNs and cloud providers to detect and prevent this?

The reason I bring it up is because I know a number of ISPs whose sysadmins were on the take and selling bulk regular dumps of DNS resolver data under the table to other parties for years.

hamilyon2• 6 years ago

Your comment opened my eyes in a sense. DoH could be both huge net positive for people in country like Russia, where not law mandetes logging every internet request and indefinite storage of them.

At the same time it could actually hurt privacy of people already protected by law in developed countries.

bawolff2• 6 years ago

Handshake sounds exactly like namecoin which has been here for a while. I guess its trying to be better by not requiring all nodes to be full nodes or something. I feel like that is not the reason why namecoin failed.

As an aside, anyone else notice how it seems like all blockchain projects are annoyingly full of marketing speak, and talk in circles for the tech part. How hard is it to clearly and concisely list the technical goals and properties your solution has?

tasuki3• 6 years ago

How hard is it to clearly and concisely list the technical goals and properties your solution has?

Very? If you find https://handshake.org/ too marketing-y (I don't) perhaps you'll find the design notes more substantial: https://handshake.org/files/handshake.txt

troquerre4• 6 years ago

Handshake took inspiration from predecessors like Namecoin but it’s very different. First is scope: Namecoin puts domain names on its blockchain under the .bit TLD whereas Handshake targets TLDs. It does so because Handshake aims to improve the security of TLS by shifting trust from CAs to its blockchain. The CA model is weak bc only a single CA among the thousands of CAs that your computer trusts needs to get compromised in order for your security to get compromised. And the likelihood of a single CA failure increases over time. That’s the opposite of what you want in a robust system.

With Handshake, certs can be pinned directly on the blockchain, which becomes more secure as more nodes join the network and across time as more blocks get mined on top of the pinned cert. This shifts the system from diminishing security to accumulating security. That’s the main innovation behind Handshake.

There are other differences in the issuance model as well. Namecoin’s issuance destined it for failure from day one since names are registered for a flat fee without restriction. This meant that squatters and early adopters could lock up the namespace without paying the true market price of the name. Handshake uses an auction system for name registration and releases the namespace over time (the release date is determined by hashing the name % 52), which means that names are registered for their true market price and newcomers can still register good names. This difference is critical and already playing out successfully — the highest auction was for 200k HNS, which is equivalent to $20k USD and 7/12 of the namespace is still unreleased.

mytailorisrich• 6 years ago

Handshake does not seem to try to solve the same problem as DoH, but rather somewhat what DNSSEC is solving.

DoH's point is mostly to hide DNS traffic. DNSSEC's point is to validate a DNS record all the way to root.

The benefits on Handshake over existing solutions are unclear to me.

skynode• 6 years ago

Handshake is more of a solution to a political/governance problem than a technical one.

troquerre4• 6 years ago

The root of trust for DNSSEC is a key that's stored and controlled by people, and needs to go through routine key signing ceremonies. This is fallible and even recently there have been issues with the key signing ceremony https://www.icann.org/news/blog/root-key-signing-key-ceremon.... One could argue that this system works "good enough" but ultimately I'd prefer that the root of trust for security on the internet to be more robust than relying on humans to avoid error. That's what Handshake is trying to do — instead of using a key in a physical vault as the root of trust, you use a distributed blockchain that's very difficult to break.

It's also relevant to note that 51% attacks to most payment/store-of-value blockchains like Bitcoin, but for Handshake 51% attacks don't really affect the security of the network because an attacker would need to get the private keys for a name in order to attack its certificate.

ribasushi• 6 years ago

CDNs are a lesser evil than ISPs

This keeps being repeated, and I simply do not understand it. Could you elaborate how you arrive at this conclusion that CDN > ISP?

My take:

An unsavory ISP is the only thing I can "vote against" as an end user. I can boycott it by switching elsewhere, I can pick from a ton of mobile providers, I can use a VPN to "subcontract" my connectivity experience to an order of magnitude more providers, or if I am really so inclined I can shuffle all of that by the likes of Tor.

There is NOTHING I can do as an individual to avoid a CDN, aside from never visiting content backed by that CDN.

swiley3• 6 years ago

Even without switching ISPs you can just use a different recursive resolver by editing your libc resolver config file. This is more difficult when each application has its own config (or none at all.)

andreareina2• 6 years ago

Every ISP I have access to performs DNS-based blocking; to the extent of intercepting ALL UDP DNS traffic (i.e. using other resolvers doesn't work). DoH gets around that.

And I think from the context of the parent, you can choose your CDN('s resolver) -- my version of Firefox (77 on macOS) has NextDNS among the default DoH providers.

esperent• 6 years ago

If you can switch ISP, good for you. On my road, there's only one, and it's owned by the government.

swiley3• 6 years ago

IMO compared to google (or most companies running ads) my ISP has been extremely well behaved. They mostly act as a pipe.

Keep in mind some of these US companies that are willing to run resolvers think censoring the DNS over the content it points to is a good thing.

Hnrobert42• 6 years ago

If I understand correctly, the author presents a case for securing DNS by moving away from a shared directory toward application-specific directories. At the end, he takes a sharp turn to worry that such a move will tear apart the openness of the internet. I suppose an analogy is moving from phone numbers, with shared telco-managed directories, to chat apps managing their own directories. You can’t contact me on Instagram with my HN handle because they don’t use shared directories.

Ok, but there are more important reasons. Walled-garden directories is a symptom not a cause. For that matter, SNI and path-based load balancers are examples of the application-level address resolution overlay already in practice. Those techniques merely implement, not drive, balkanization.

Basically, application-layer DNS doesn’t pass the “but for” test. As in, it is not correct to say “but for application-layer DNS, Facebook/WeChat/Google couldn’t build walled gardens. With it they can.”

Santosh83• 6 years ago

How is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying? Surely nothing stops your favourite ISP or any other local startup from providing DoH services right? Presumably the DNS servers will still talk to each other on the backend over plain text, but if a DoH front-end can be provided by ANY DNS service then how can it be accused of centralising the Internet?

vetinari3• 6 years ago

How is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying?

It is not merely encrypting the information. Hand-in-hand comes running the resolvers (which, as you noted everyone can) and having all the DNS-using software use them.

Which is much bigger problem, that causes the centralization. Applications are coming today hard-coded for a specific resolver. Configuring it is application-specific and not-automatable, and certainly not automatable in generic manner for all applications. I.e. as a network operator you cannot say that everyone should be using this or that resolver, as you can with the plain old 53/udp DNS and DHCP.

Users are not going to reconfigure each and every application every time they change their network. They will leave it at the default value. The net effect is that the centralization will just happen.

zamadatix2• 6 years ago

Applications can choose to ignore the system resolver regardless if it's over UDP or HTTPS. DoH/DoT is showing up in operating system resolvers just not as fast as apps like browsers were willing/able to add it. Standard DHCP options for defining DoH details are still missing though (I think, haven't checked in a while)

swiley3• 6 years ago

Because I as a user have a hard time configuring my computer to use a different resolver.

Where is the DNS headed?

Related Stories