Hacker News new | past | comments | ask | show | jobs | submit login

Is this standardized/drafted? I am curious how one might implement this.



See this thread with one of the authors of the RFC: https://news.ycombinator.com/item?id=16728600


Everybody is right in this thread :)

First, just to avoid confusion, the post linked to this HN article is just about the classic recursive resolver model. That's the scope of what is being experimented with actively.

Second, the notion of resolverless dns (where dns records are obtained from somewhere other than your recursive resolver) is indeed something DoH contemplates but does not yet allow. That's because issues around tracking, correctness, and attacks haven't been fully explored. So unsolicited DNS is interesting but its not something any browser would accept yet.

There are some other opinions on how HTTPS matches the needs of DNS here: https://bitsup.blogspot.com/2018/05/the-benefits-of-https-fo...


Also notice how the plan is to push not only DNS entries but also TLS certificates:

"Right now, people are really keen to get HTTP/2 “out the door,” so a few more advanced (and experimental) features have been left out, such as pushing TLS certificates and DNS entries to the client — both to improve performance. HTTP/3 might include these, if experiments go well."

https://www.mnot.net/blog/2014/01/30/http2_expectations

Some of those things could be used for bootstrapping SNI encryption as well:

https://www.ietf.org/mail-archive/web/tls/current/msg17474.h...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: