[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Mozilla Firefox DoH to CloudFlare by default (for US users)?



On dv., set. 13 2019, Simon Richter wrote:

Hi,

On Fri, Sep 13, 2019 at 12:28:23PM +0200, Marco d'Itri wrote:

> Note that by way of counterargument, Google and its services > have > been blocked in mainland China by the Great Firewall for > nearly a > decade now, so I question whether there is really such a > thing as
> "too big to block."

This is a false dichotomy: not all nation states are willing to go to
the extreme lengths as China.

Also, China cannot block Github, because they have no equivalent, and even if they did, it wouldn't have the same content. Google is too easily
replicated, because they have no immediate contributors.

I expect that China will set up a proxy service with clones of all relevant Github repositories soon to keep read-only access to free software around
but inhibit organizing through shared documents.

CloudFlare has too many services behind them that are important for the economy and not replicable, so they are in a better position than Github
here.

Also, this is a cat and mouse game and DoH is probably just the next
step :encrypted SNI will probably be needed as well later.

Mandatory Encrypted SNI with no fallback option -- everything else can be
circumvented easily.

This is a game that we should not play, really. It raises the cost of running a service on the Internet so only big players can afford to do so.

We are throwing some ice cubes into the boiling pot so there are local zones that are warming up slow enough that the frogs there do not notice.
This is a losing strategy.

   Simon


There's also this:
 https://use-application-dns.net/
 https://tools.ietf.org/html/draft-grover-add-policy-detection-00

The way I read it, it means that "soon" DoH would be enabled by default for "everyone" unless it can be trivially disabled by the network operator.

Quite confusing, at least for me it'd look as having all the issues of centralising DNS (a couple kill-switches for de-facto global censorship) and then undoing all the benefits of using encrypted DNS in the first place.
--
Evilham


Reply to: