Re: [hrpc] "Paul Vixie and Peter Lowe on Why DoH is Politically Motivated"

[Eric Rescorla <[e-mail]>]

On Tue, Nov 16, 2021 at 8:36 AM Vittorio Bertola <
[e-mail]> wrote:

>
> Il 15/11/2021 20:20 Eric Rescorla <[e-mail]> ha scritto:
>
> However, at present, it is generally possible to filter DoH because
> DoH and ordinary HTTPS are usually on different hosts and therefore
> you can use SNI. It's true that it's possible to co-host DoH in such a
> way that it is indistinguishable from non-DoH HTTPS traffic, but it is
> *also* possible to co-host DoT and HTTPS in this way, provided that
> (1) you use a non-standard port and (2) you use ECH. The point here is
> that either DoH or DoT can be run in a way that makes it hard to filter
> if that's what you're trying to do.
>
> That's exactly why the difference between DoT and DoH is political way
> more than technical: I trust you that both may be used in ways that make
> them hard to block, but for DoT it is an unintended consequence, while for
> DoH it is an intended objective of the designers, stated in the
> specification itself and in several public statements.
>

As I said previously, I'm not interested in debating whether DoH is
political or not. My point was merely that:

1. It's a deployment question whether to make DoH or DoT unblockable.
2. Current DoH deployments are generally easily blockable.
3. If people want to deploy DoT in unblockable ways, they can do so.

Therefore the fact that browsers are choosing to deploy DoH  rather than
DoT does not have a significant impact on whether it will be blockable in
practice.

-Ekr