@jpmens Very poor article (as always with McCarthy, the form trumps the content). 1) It never mentions the possibility of other DoH resolvers, outside of Cloudflare 2) It never mentions that DoH to the ISP resolver is pointless since the problem is pecisely the ISP's resolver behaviour.
@bortzmeyer @jpmens And your answer is very biased and somewhat dishonest:
* configuring an alternate resolver is something that will only be done by power users. Default config matters a lot.
* bypassing ISP resolvers was never the purpose of an encryption protocol. The goal is to protect data over the network from snooping and from alteration.
@bortzmeyer @jpmens Most sound people complain about Mozilla-Cloudflare partnership. Not about DoH itself, although there is a bit to say about it as a protocol as well.
I, for one, have no problem with Chrome strategy for DoH implementation and deployment. But I am a fierce opponent of Mozilla's strategy.
"As a side-note: we already deny RFC1918-addresses from DNS-over-HTTPS
responses so in that regard, using TRR will save you from these DNS attacks!"
So, I was wrong. DoH-to-Cloudflare-by-default is not an issue, as far as DNS rebinding is concerned. Sorry 😶😥
A Mastodon instance for info/cyber security-minded people.