Re: [Doh] comments to DoH/RFC8484

[StarBrilliant <[e-mail]>]

Hi Stefan,

I am not an IETF person. But as the core maintainer of the project "m13253/dns-over-https", my short answer to your question is:
DoT is nation-widely blocked in China; while DoH is not (and can't be), unless it's a well-known DoH server on their human-maintained block-list.

Speaking of encrypted DNS, besides DoT, we also have DNSCrypt many years ago. They both work well in countries where you could sue your ISP if they forbid you from using them. DoH not only hides the content of your DNS communication, but also hides the fact itself that you are using an encrypted DNS service.

Any technology could potentially become a double-edged sword. You could gain Internet neutrality by hiding DNS from your ISP; but your home IoT products can also send encrypted DNS requests hiding from you. We can't stop the development of technology; instead, standardizing them would push the balance more towards the kind side than the evil side.

Also, DoH allows web applications written in JavaScript to submit DNS requests, where DoT can't.

Best regards,
StarBrilliant

On Mon, Jun 28, 2021, at 10:52, Stefan Kärst wrote:
> hi Team,
> 
> I'd like to add some personal thoughts about RFC8484
> 
> I'm working as an system administrator for quite a long time now. I 
> started working in IT in 1991.
> 
> part of my daily work is to analyse problems regarding applications 
> running on GNU/Linux, either as VMs, bare metal or within clouds and/or 
> containers. based on my experience half of all problems are caused by 
> network issues including DNS.
> 
> because of this it is important for me to be able to reproduce problems 
> and collect data to support customers. one of these tasks include 
> querying DNS. whether on the customers machines or on my own. as DNS is 
> an open globally distributed system, I can be sure to get the same 
> answers as applications/computers at the customers site are using.
> 
> DoH not only breaks protocol layering. It makes our work useless in 
> terms of reproducing the data applications use. this is as bad as 
> caching of IP addresses within applications.
> 
> both things do not belong into any application. IMHO
> there are dns resolvers and caching services like nscd available for 
> both purposes.
> 
> as application use encrypted communication, we cannot check the (meta) 
> data and provide any kind of support if things do not work. even if DNS 
> would be encrypted .. it still is an open system so I can get the same 
> answers as any software would use.
> any software that works as a monolithic black box is a nightmare for 
> system administrators.
> 
> I really hope you drop DoH in favour of DNS over TLS. with DNSSEC and 
> DANE there are standards available that make more sense in terms of 
> enhancing DNS rather than reinventing the wheel and put things into 
> application for what the operation system is meant to be responsible.
> 
> I wish you could use your powers to promote DNS over TLS to keep DNS an 
> open distributed system for all! (except you are working for the Chinese 
> or Russian government and wish to make such services a secret to anybody ;)
> 
> IMHO DoH has aspects of "security through obscurity" ;)  I cannot see 
> any advatage in DoH.
> 
> 
> HTH
> Kind Regards!
> greetings from germany
> Stefan Kärst
> 
> 
> https://en.wikipedia.org/wiki/Communication_protocol#Protocol_layering
> https://en.wikipedia.org/wiki/Security_through_obscurity
> 
> 
> _______________________________________________
> Doh mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/doh
> 
> 
> *Attachments:*
>  * OpenPGP_signature