<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Well,<br>
<br>
1 think for sure.<br>
<br>
An application bypassing the OS and auto deciding where to
resolve an address will break our DNS views for private versus
public resolution of the same hostname. I see fun times to be had
in the Security world...<br>
<br>
At least make it optional, not enabled by default.<br>
<br>
PS: I know it is not Friday, but gratz to Alphabet for
systemd'ing DNS.<br>
<pre class="moz-signature" cols="72">-----
Alain Hebert <a class="moz-txt-link-abbreviated" href="mailto:ahebert@pubnix.net">ahebert@pubnix.net</a>
PubNIX Inc.
50 boul. St-Charles
P.O. Box 26770 Beaconsfield, Quebec H9W 6G7
Tel: 514-990-5911 <a class="moz-txt-link-freetext" href="http://www.pubnix.net">http://www.pubnix.net</a> Fax: 514-990-9443
</pre>
<div class="moz-cite-prefix">On 2019-10-02 13:14, John Levine wrote:<br>
</div>
<blockquote type="cite" cite="mid:20191002171401.266D5B81842@ary.qy">
<pre class="moz-quote-pre" wrap="">In article <146431.1569964368@turing-police> you write:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">-=-=-=-=-=-
On Tue, 01 Oct 2019 16:24:30 -0400, Warren Kumari said:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">"More concretely, the experiment in Chrome 78 will **check if the
user’s current DNS provider** is among a list of DoH-compatible
providers, and upgrade to the equivalent DoH service **from the same
provider**. If the DNS provider isn’t in the list, Chrome will
**continue to operate as it does today.**"
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
I suppose this is the point somebody has to put the words "nostrils", "tent",
and "camel" in the same sentence?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
This looks to me more like the tail end of the caravan. Users have always been
at the mercy of their browsers, which have always done unexpected things.
Assuming we agree that automatically upgrading http requests to https
is OK, how is this any different? Same endpoints, encrypted channel.
The Google people I've talked to are quite aware of the implications
of using a different DNS resolver and I would be surprised if they
ever did it without a very explicit request from the user. In this
regard they are quite different from Mozilla who are impervious to the
reasons that sending random users' traffic to Cloudflare is not a good
idea.
R's,
John
</pre>
</blockquote>
<br>
</body>
</html>