>DoH also means breaking stuff like pihole and other ad filtering. No, it doesn'...

ignoramous · on March 22, 2020

> e.g. I run DoH behind my home's dns cache server.

I think GP is referring to the fact that apps can now bypass network / os wide dns stub / recursive resolvers undetected with DoH.

> This is where HTTPS and eSNI further help.

I believe TLS v1.3 specifically has anti-censorship and anti-surveillance properties baked in: https://blog.cloudflare.com/rfc-8446-aka-tls-1-3/

kohtatsu · on March 23, 2020

They could have had their own resolver before, or even hard coded IPs.

Using software that doesn't respect you is the problem.

seized · on March 23, 2020

Firewalls can redirect port 53 to another IP. That prevents things from hard coding to a specific IP.

kohtatsu · on March 23, 2020

Euh, it prevents a custom resolver sure, but hard-coded IPs bypass the need for DNS completely.