Ctrl blog

The main benefit is multiplexing - being able to use the same connection for multiple transactions at the same time. This can have benefits in finding and keeping the congestion window at its calculated maximum size, reduce connection-related start-up, as well as overcome waiting for a currently-used connection to be free if you have a max connection per server model.

The other potential benefits were priorities and server-initiated push, but both I’d say largely went unused and/or were too much trouble to use. Priorities were redesigned in HTTP 3 - more at https://blog.cloudflare.com/adopting-a-new-approach-to-http-prioritization/ - and Chrome recently decided push in HTTP 2 wasn’t worth keeping around - https://www.ctrl.blog/entry/http2-push-chromium-deprecation.html

HTTP 2’s main problem is head-of-line blocking in TCP - basically, if you lose a packet, you wait until you get that packet and acknowledge a maximum amount of packets thereafter - slowing the connection down. With multiplexing, this means that a bunch of in-flight transactions, as well as potentially future ones, are blocked at the same time. With multiple TCP connections, you don’t have this problem of a dropped packet affecting multiple transactions.

HTTP 3 has many more benefits - basically, all the benefits of multiplexing without the head of line blocking (instead, only that stream is affected), as well as ability to negotiate alternative congestion control algorithms when client TCP stacks don’t…

The fact that it can be trivially blocked by anyone on the network path does not make it "much better".

Of course anyone on the "network path" can block almost any protocol; DoT isn’t unique in that regard.

The concern is many large businesses block port 853 but that's because prior to the development of DoT, there was no reason for IT departments to configure firewalls to enable it. Most organizations only have a handful of ports available, including 443, which is what HTTPS uses and therefore DoH works as a result.

I've been running DNS over TLS using the Unbound [1] resolver for my home LAN on a spare laptop for a few weeks now and it’s been great.

Given the privacy trade-offs between privacy and security, many IT departments would opt to make port 853 available for DoT rather than increasing the ability for their users to be tracked.

As I mentioned elsewhere in this thread, the article Centralised DoH is bad for Privacy, in 2019 and beyond [2] clearly describes the issues with DoH:

DNS over HTTPS opens up DNS to all the tracking possibilities present in HTTPS and TLS. As it stands, DNS over UDP almost always gets some free privacy by mixing all devices on a network together – an outside snooper sees a stream of queries coming from a household, a coffeeshop or even an entire office building, with no way to tie a query to any specific device or user. Such mixing of queries provides an imperfect but useful modicum of privacy.

DNS over HTTPS however neatly separates…

Absolutely worth it to read the linked post by the EdgeDeflect author too: https://www.ctrl.blog/entry/microsoft-edge-protocol-competition.html

Even if you'll eventually somehow be able to circumvent this, I'm more baffled by the sheer amount of effort Microsoft puts into locking Edge as the (de-facto) default browser. The changes OP described show pretty clearly this is deliberate and not just for whatever technical reasons there could be.

E.g. even if microsoft-edge:// links had some proprietary features that are required for OS integration - say, opening the page in a specific existing process or something - it makes no sense to rewrite ordinary https:// urls into microsoft-edge:// urls - which Windows seems to be doing ("and links sent to the device from a paired Samsung or Android devices").

On the other hand, if they are so hell-bent on making Edge the default browser, why are they go through all the trouble with "link associations" and permit other browsers at all? By now it seems sort of odd they didn't simply hardwire https:// to Edge directly.

In any way, this smells like another antitrust lawsuit waiting around the corner.

>Effort have been made at keeping the impact of ads and tracking low: https://www.ctrl.blog/about/privacy-policy#privacy-policy-ad...

FWIW, that's what every website will say. I don't have any reason to trust your site any more than I trust any other site. I don't want to be tracked by anybody, regardless of their intentions.

> The ads help fund writing and research into technologies that restrict ads without blocking them outright. You choosing to block ads is your choice, but it takes away incentives for researching and writing about the topics you care to read about. You can sign-up for Flattr if you prefer not to see ads and still support writers.

I'm sorry, but merely putting something online doesn't entitle you to make money from it. Posting an article or tweet or picture or other content on the public internet is an inherently non-profit activity, and it always has been. It doesn't entitle you to follow me around the internet.

If you want to make money posting online use a paywall.

You want multiple NS records containing hostnames of nameservers from two or more providers on independent infrastructure (i.e. not two providers that are both hosted on, for example, AWS' compute).

I would advise against running your own nameserver unless you have confidence in your ability to operate it correctly.

You can increase the TTLs if you don't anticipate record data changing frequently, or are able to tolerate delays in your DNS record changes being served (until the cached answers expire).

Choice of resolver (e.g. 1.1.1.1, 8.8.4.4) is out of your control (except of course, on your own devices and machines). Increasing the TTLs may improve robustness, assuming that your clients' resolvers are well-behaved and respect TTLs [0].

[0] https://www.ctrl.blog/entry/dns-client-ttl.html

I've lost the whole day trying to understand the pretty complicated logic on how to have control of my linux (fedora) DNS with the many internet/connections nad wireguard's profile, and once again I went back to https://www.ctrl.blog/entry/resolvconf-tutorial.html (disable everything and just handle /etc/resolv.conf the 'old' way, and now finally I have no more leaks https://dnsleaktest.com

as for wireguard, a pretty brutal settings in all wireguard profiles:

PostUp = echo "nameserver <DNS IP in wireguard>" > /etc/resolv.conf

PostDown = echo "nameserver 127.0.0.1" > /etc/resolv.conf

and even a

dns=none

in /etc/NetworkManager/NetworkManager.conf

p.s. I am aware of the great discussion in https://news.ycombinator.com/item?id=19435631 especially usr1106 comment