Re: dns over tls or https

Dear Pastebin,

On Tue, Oct 08, 2019 at 06:39:04AM -0600, [email protected] wrote:
> Axel, I have bad news for you - dillo is already doing it's/i/it/t
> own dns - you might want to check the src/dns.c
> it calls getaddrinfo all by itself - imagine that -

*facepalm* You're getting it all wrong.

But that's good to hear, because that's what I call "letting the OS do
DNS".

Because that's just a call to an OS-provided function which utilizes
what is configured in the OS, usually via /etc/resolv.conf,
/etc/nsswitch.conf and /etc/gai.conf (and /etc/services for the port
name lookups) on nowadays' Linux distributions.

What I consider to be bad is if an application _doesn't_ use these
OS-provided system or library calls but does the full DNS resolution
on its own, including deciding which DNS server and transport to use.
(Unfortunately that's the common way, DoT and DoH are used nowadays.)

If the backend of getaddrinfo() or gethostbyname() uses DoT or DoH to
a server configured by the local admin (which might be the sole user
itself), that's totally perfect and I'd appreciate that.

But if an application (i.e. the application developer) decides on its
own that it ignores system wide DNS settings and behaves differently
than the local admin wants, that's definitely bad.

And adding DoH or DoT support to Dillo (or any other web browser or
application) would go into that direction.

If you want to circumvent surveillance or your ISP's DNS manipulations
for their own profit (as said to be common in the US) by using DoH or
DoT, you shouldn't do that just in your web browser but system-wide in
your _whole_ (operating) system.

So I stand uncorrected: DoH and DoT do belong into the OS and not into
(end-user) applications like web browsers.

Using the knot resolver or the unbound resolver as local resolver, you
can configure this (at least on Unices). Of course you still need a
DoT/DoH resolver you can trust.

		Kind regards, Axel
-- 
PGP: 2FF9CD59612616B5      /~\  Plain Text Ribbon Campaign, http://arc.pasp.de/
Mail: [email protected]  \ /  Say No to HTML in E-Mail and Usenet
Mail+Jabber: [email protected]  X
https://axel.beckert.ch/   / \  I love long mails: https://email.is-not-s.ms/

_______________________________________________
Dillo-dev mailing list
[email protected]
http://lists.dillo.org/cgi-bin/mailman/listinfo/dillo-dev
http://www.dillo.org/
You get this email because your address [email protected] is in the
mailing list dillo-dev. If you do not want to get emails from this
mailing list, click on this link to unsubscribe:
http://lists.dillo.org/cgi-bin/mailman/options/dillo-dev/gciwbxd-dillo-dev-537%40m.gmane.org?password=anowwoug&unsub=1&unsubconfirm=1