Join us at The Hedge for a conversation
about engineering,
technology, and business. In this episode, Jeff Houston,
Russ White, and Tom Ammon dig into the
second part of their discussion of DNS over
HTTPS.
In their thirst for speed,
part of the HTTP protocol standard says, look.
I know you're gonna ask for this style
sheet. I know you're gonna ask for this
element.
Look. Let's just save the trouble. Here it
is. I'm gonna push it at you.
I know you're gonna ask for google.com.
I know you are. I can tell you
are. Here's an answer. Now you know I
gave it to you, and what I put
on the wire, you got because the channel's
encrypted.
Is it the right answer?
And is it and is it not just
the right answer but even going further and
saying is it the answer that
for instance, I'm load balancing and I'm now
the server can now mess with my load
balancing algorithm
as,
you know,
an end user or not as an end
user, but as a website
and
play games. Well, that's Well not really The
game the games can be wonderful. I can
push you names
that the DNS can't query using DNS over
UDP.
Right.
Yep. Right? And and if I can play
some games with DNSSEC, I can't even sign
it. It'll look just fine,
but it only exists in a in a
certain context.
So we used to think
when we asked ourselves,
what makes the Internet?
And and the first answer going back to
the, you know, nineteen eighties was,
well, it's one address family and one name
family.
Because if I send you a name, the
name means the same to me as it
does to you. You translate the name into
an address. The address addresses the same host
for me and for you.
Fine in the eighties.
This day and age, what makes the Internet?
And and if you say address space, I'll
smack you around the head and go no.
No.
Nat's killed all that.
We make the v four network work by
phenomenal amounts of address sharing and address translation.
So what makes the Internet is not a
coherent address space.
The only thing that makes the Internet the
Internet is a coherent name space.
If you give me a name of a
resource,
some website, my bank, whatever, and I give
that name to you,
I confidently
expect that you will look at the same
thing.
The same digital artifact will exist.
And in some ways, with an open DNS,
we can both check on it on this.
So the coherency of the namespaces, single namespaces,
is sort of obvious.
Now, yes, I go into some private corporate
world and split DNS, and all bets are
off, but I did that. I physically did
that. But what if my browser
takes me there?
What if my browser
takes me to namespaces
that are fractured, are broken?
And that the name that I use and
context, when I pass that name to you,
you see something entirely different.
What's the Internet at that point?
Yeah. I mean, it there's a lot of
cool things you could do with that, but
there's a lot of really broken things you
can do with that. Right. And and, you
know, it's one of these amazingly powerful weapons
that,
literally, you can imagine all kinds of highly
customized namespaces
that remain an absolute secret.
And there are really cool things you could
do, but, really, some very bad things
that
currently
we rely on to stop you doing bad
things.
For example,
most bots bot armies work on command and
control networks.
I'm like, the only reason why bot armies
are set up is to rent them out.
So you need some mechanism to start them
and stop them and and so on because,
otherwise, why bother?
And the control mechanisms are largely inside the
DNS.
And so this whole idea of an open
DNS with cryptographically generated domain names
is the bread and butter of the DDoS
industry. And oddly enough, also, the open factor
of the DNS is bread and butter to
the law enforcement industry trying to stop it.
And so,
you know, bad names get invented to control
botnets.
The good guys go and chase down the
bad names by looking at query levels of
who's doing queries and say, well, that's obviously
a control name. Let's take it out.
But what if the name goes silent, goes
dark, goes into dough?
And quite frankly
I'm sorry. Your machine can no longer do
HTTPS.
It's it's regarded as insecure. You might as
well shut down the Internet.
You can't do this. It's invisible.
It just looks like any other old web
page.
And so the first kind of issue is
the DNS becomes,
I don't know, less of an area for
control. We need other forms of weapon
to stop the the proliferation of the DNS
being used in in ways that,
you know, proliferate and control badness in its
all its various forms.
That seems retrograde.
It seems like an own goal
that if the desire was improved privacy,
have we overachieved
and actually made life easier for bad people
as much as we've improved the privacy for
everyone else?
Difficult kind of question.
And as I said, because it's not a
geek knob,
it's not even a question that users will
be given the opportunity to answer individually.
Who gets to make the call?
Gee.
I said 78% of the world use Chrome,
12% of the world use Firefox,
and the rest don't matter.
Yep. So who controls this?
A small
clique
cartel?
A small group of developers in the Mozilla
Foundation and a small group of developers employed
by Google
control this.
Is this what we want?
These are difficult,
serious questions
about the integrity of the network, the integrity
of the namespace,
even the cohesion of the network.
Should we, by default,
carry the users down a path
which
effectively closes and seals off
all of those elements and places the control
knobs
inside basically two browser factories.
Well, what's what's wrong with saying
we won't do it in the browser? Why
don't we just allow the stub resolver to
do it and
and and don't implement it in the browser?
How are you gonna stop it? And number
one and number two Sure. Sure. And number
two,
it I guarantee you that in the need
for speed and the quest for speed, it's
going into the browser anyway.
See, Russ has got the answer, I think,
there. It's not I'm like,
fine. Go and use
I don't know. Chrome doesn't do it at
the moment. Don't use Firefox. In other words,
change your browser, but
most users don't see the network in these
kinds of dimensions. Right. What they They just
type in URLs, and it just does stuff.
What they see is is some testing site,
PCNet, or I don't know, whoever. Take take
your pick, Tom's hardware, whoever. They go out
and they do browser war test,
and it turns out that Firefox is faster
because it's doing this, and they all go
download Firefox.
Right. Because That's exactly exactly right. It's faster.
And so in some ways, if Firefox comes
up with a connection to a lightning fast
open recursive resolver,
and the folk who build open recursive resolver
certainly try extremely hard to be extremely fast
everywhere,
then they're gonna use it. And users will
go, yippee. This is really fast.
Now
we've said that all of this is about
better personal privacy.
But, again, here is one of the most
achingly difficult compromises
that any user is gonna have to grapple
with. And, again, the problem is they're not
being asked.
Because if, for example, I choose to use
Google's public DNS service
and I set up my browser, Firefox, to
pin all my queries to Google's public DNS,
no one else can see me, but I'm
sharing my life with Google even more than
I was before.
In other words,
I don't have any secrets from them anymore
because they know everything.
Now I could say the same if I
use CloudFlare or Quad nine or any other
open DNS resolver
that, in essence,
I'm sharing my life with that particular party.
Now
with my ISP,
the theory goes,
it's my country,
my rules,
my
regulations,
and my ISP, if they do anything contrary
to my country's privacy standards,
they have a fine to pay. They have
ramifications. So in some ways, using my ISP
is a known issue that when they behave
badly,
there's mediation measures. Right. Beyond that, if I'm
using my DNS resolver on my host,
I have the ability to install some small
piece of software that randomizes who I'm using.
Whereas if the DNS resolver is hidden in
the browser
Alright. Now let's say that my DNS resolver
in my browser, that is a hidden choice,
goes to a resolver
located in,
oh, look, Absurdistan.
Yeah. Now in Absurdistan,
I, Jeff, am an alien. I have no
rights.
Whatever the privacy rules and regulations are in
Abzurdistan,
I have nothing I can do about that.
So my data's being exfiltrated
without my knowledge
by a bunch of browser vendors who are
chasing speed and actually aren't interested, oddly enough,
in my security and privacy.
They're doing it in the name of enhanced
security and privacy.
But in some ways, there's a certain amount
of destruction going on at the same time.
Because
when I make that HTTPS, that TLS connection
to that recursive resolver,
I can't deny it was me. It's me.
I can't deny I did it. I did
it.
All of a sudden, there's no uncertainty anymore.
Yeah. It was
me.
So the recursive resolver not only gets to
see me, but they get the most valuable
piece of information they could possibly get. It
really is me.
No mucking around. It's me.
And that's something the DNS never provided in
the past because with UDP, you had forwarders
and handlers and load distributors and obfuscators
and all kinds of rubbish. And so when
a query arrives somewhere, sort of, who's asking?
Well, I don't know.
Guess.
But now with HTTPS,
the recursive resolver goes, ah, Russ,
good to see you.
Oh, by the way, here's some names you
might like.
Because it's you. You know? You just gotta
get away from that. And and, again, the
issue is, Russ, you might wanna make that
choice.
But I'm
quite
disturbed
that a bunch of developers inside the browser
factory is making that choice for you.
And once the defaults get shifted,
then I think we're into a very, very
different and rather disturbing world in this space.
And so that's the kind of background to
why that meeting in Prague
was so
tensioned
that everyone went there,
that this is not really about increasing the
privacy of the DNS. Oddly enough, it's actually
about decreasing the privacy of the DNS
selectively.
Yeah. I think that's the critical point. So
is there I mean, where do we go
from here? Is there anything that that we
can tell people who are listening to this,
you know,
cry? No. Enjoy the taste of sweet irony?
I
I I I think this is a difficult
issue,
and I would certainly believe
that at some point,
the technology
debate, which used to be in the DNS,
a very small debate
with a very, very small cadre
of professionals
who, on the whole,
obeyed a principle of
do things incredibly slowly
and
be really, really sure if you wanna change
the world,
got taken over by a,
more aggressive,
browser community
that, you know, has just done WebRTC,
has just done HTTPS,
has just done this, and just done that.
And that world has an entirely different set
of ethics and standards,
that getting product out the door is much
more important than getting good product.
And I suspect that the only real kind
of approach left in this space is to
say, well, we should not be going down
this path so quickly.
We might want to do it, but we
might want to understand
how we make informed and reasonable choices.
Now
this is not just the DNS.
This is not just the DNS
because
there is an increasing
amount of impatience
by the application community
about the incredibly
slow pace of the infrastructure
community.
What if I wanna change this to TCP?
Oh, jeez. I need to make Apple and
Android
and Windows and and and and and and
I've gotta get it in all the distributions,
and I've gotta do this, and I've gotta
oh god. I'm gonna die first.
You can't.
Right?
The the network is now so big. It
it's sort of sclerotic. It's just not changing.
The frustration
from the application folk who are used to
pushing our product is, okay.
I'm gonna do it myself.
And so things that we always thought were
infrastructure
are now moving to so called user space.
So the DNS has moved.
Browsers, anyone can do DNS over HTTPS,
and no firewall can stop you.
Okay?
What about TCP? Well,
need I mention QUIC
Right. Which is another example. You you lift
up what was used to be a lower
level function and just drag it into the
application.
And so now all it does is, hi.
I'm just sending UDP. There's nothing suspicious in
here.
Deep inside this
is a pseudo TCP, and deep inside that
is encryption.
What's going on in those packets? Yeah. You're
not meant to know.
Not even the platform is meant to know.
How quickly can QUIC be changed? Well,
I put out a new version of the
browser, a new version of the app, and
I've changed it. I don't have to wait
for Apple or Android or anyone else. I
just change it.
And so the way we're kind of coping
with an ever larger network
is to actually push control
further and further away from the folk who
used to control it.
So the folk who operated the wires and
the routers, yeah, irrelevant.
The folk who even pushed out operating system
platforms, irrelevant.
Even the folk who've moved the data centers
and set that CDN stuff up, irrelevant.
Because it's now a world negotiated around applications,
And it's the applications themselves that kinda go,
look. I'm not gonna expose anything at all
to the lower levels of the technology stack.
It's just not gonna be there. I'm gonna
suck everything up that's of value and importance,
and I'm gonna drive it directly from inside
the app. It gives me ultimate control,
and it gives me, if you will, a
degree of
relationship
with the end user that nobody else can
intermediate.
I own them. When they're running my app,
they're me, and I'm them.
And I suspect that
having gone down this path,
it's hard to say, can we wind that
back? And and if you did, sort of,
why would we want to?
Yeah. Which is a long way of saying,
Russ, to your question, what can we do
about it?
I, for one, embrace our new overlords and
wish them all the best.
Hope that they that they do well by
us. I hope they I hope I do
well under the regime. I'm like, what else
can I say?
It is a different world in that respect,
and and, yes, power has changed,
and the power is shifted inexorably,
further and further up the stack, and and
the DNS is coming along with it.
Yeah. Well, software eats the world, and we
don't think about the consequences of software eating
the world. We just
we run off and say it glibly and
say, yeah. Software is eating the world. Yeah.
What does that mean? Well, I don't know.
It eats the world. Yeah. Well
You're right. And and now you're kinda seeing
that. And, of course, it's leaving a whole
bunch of players
in a very, very strange position.
They have no ability
to exert influence.
QoS is dead.
The whole issue of I control the way
applications perform on my network. No. You don't.
The applications have long since given up. They
don't expose
enough for the network or the network operator
to control it. I control what you're seeing
through the DNS. I'm sorry. You don't.
And so all those traditional mechanisms, which actually,
I think, comes back from the old telephone
thinking, that the network operator actually set the
standards,
set the agenda,
ran the system, and the application folk were
just folk who, you know, created the color
and the light, but the true control was
was was elsewhere.
That's over now. The application folk are actually
the true controllers of this,
and that all they regard you know, require
from everyone else
is just the crappiest possible cheap network that
just switches packets, and that they'll do the
rest.
Yeah. That's that's interesting because that that has
a lot of implications for a lot of
other places going on in the world. Well,
you know, we could look even at the
things like security,
and and the effort has always been and
and I'll touch upon a subject that the
Russ and I are quite familiar with, routing
security.
And the whole issue goes, if we tighten
up the infrastructure,
everything will be good.
The application
world says,
don't care.
Just don't care. I wanna know who I'm
talking to,
how I talk to them, the path I
use, meh,
not interested.
I will decide if I'm talking to the
right party.
I actually don't value routing security.
It just doesn't matter to me anymore.
And from that respect, you know, the whole
emphasis on
who gets to
run, operate,
oversee the integrity of the service that gets
delivered,
the application folk are kinda going,
leave it to us.
Just leave it to us. We don't want
your input.
Which yes. Again,
it's,
a little worrying from a network engineering perspective.
Right?
Oh, totally. Totally worrying. It it it because
I think it rewrites exactly what network engineering
is on about.
You know, there was this model, and and
it was certainly a model I grew up
with,
where the network engineer
should have had some familiarity with the profile
of traffic that the network was carrying,
and therefore was able to make sound judgment
as to where to place limited resources
to create the maximum number of happy customers.
You know? It was sort of, I will
do these decisions on the behalf of the
users to maximize my profit and to maximize
my customers' enjoyment. There we go. Now
you don't get that say.
You just don't get to play in that
game as a network engineer because the application's
kinda going, I'm not telling you what I'm
doing.
I'm just not telling you what I'm doing.
I'm not telling anyone what I'm doing.
Wow. Yeah. Okay. Now that
now now that we're all depressed.
Well, you want me to talk about dough.
I'm like, that's what dough this this is
why dough is just such a big topic
Yeah, sure. Of course. It's not the dns
per se. Yeah, it's everything that comes with
it So what do you think just to
speculate, what do you think is keeping the
the browser people from just pushing the button?
Why wouldn't they just do it right now?
You know,
ten years ago, they would have.
Ten years ago, they were confident
that both the public commentary
and the underlying regulatory regime
were sufficiently
distracted by, gee whiz, isn't this amazing,
that anything was possible, and you could have
just done it.
Because no one was there to say, that's
not a good thing. That's a bad thing.
Because the argument was one-sided.
You know, the folk who knew what they
were doing were busy employed to do it.
And the other side of this, there was
no one there to voice that view.
But these days,
regulators are emboldened.
The entire GDPR
exercise
that kinda
goes, I am sick and tired of you
folk playing with my data as if it
didn't matter.
It's my data. Look after it or pay
horrendous fines.
Up to you, but get better. And what
it really says is that the regulators are
prepared to say,
I'm not gonna accept technology
at all. I'm going to accept it on
a conditional basis.
Folk have to feel comfortable in using it
and confident
that it's a two way relationship, and and
the end user is actually having being respected
in this process.
So what's stopping this is that if Google
went all the way,
and all the way is
Chrome gets hardwired to go to Google's public
DNS by default,
and you have to go down the nerve
node path
to unravel it.
My suspicion at that point is that
whatever antitrust,
anti, you know, massive business
sentiment is out there,
that move would unleash a certain amount of
immediate regulatory reaction.
Mhmm. Because
tying up that particular browser, 78%
of the world,
with that particular view of the DNS,
with shutting down everyone else's view,
with
concentrating a huge amount of strategic information about
what people are doing inside the same company
is kind of like,
if you think there's competition out there, you're
just not thinking right.
At that point, we're all dancing Google's tune.
And
if that's about as bad as it gets,
then I guess that's as bad as it
gets. So would Google do it?
I would hope.
And in fact, I'm pretty confident that somewhere
inside that massive company are a few adults.
And and a little a little bit of
adult supervision
because
knowing that you can do it
is completely different from deciding that you will
do it.
And it's certainly a case that you can,
and as as I said before, as long
as it's a nerd knob and kinda difficult
to turn on,
doesn't matter.
But if the default is there for the
shift that way for whatever reason,
then at that point, we're going down a
path that is,
awesomely fearsome. It just is difficult to understand
where it goes after that Yeah. Because it
displaces so much control in one one one
entity.
We don't know how to deal with it.
Right. Yeah.
Well, Jeff, thanks for coming on the hedge
and depressing us all.
Yeah. I mean, this was really a good
conversation. Now is there any place anybody can
go to read other than IPJ about dough?
Because I know your article in IPJ was
very perceptive and very good,
Internet Protocol Journal. But is there but but
there are there other places people should be
looking?
There is an overall,
advocacy page about the technology of privacy,
the DNS privacy project.
And Synodin,
Sarah Dickinson,
is a big big, player in that. And
that's a page, well, we're seeing. It doesn't
have the commentary, but it certainly describes the
technology.
For commentary around it and for a sort
of a larger thing, I certainly have written
a number of things myself about this. And,
as usual, you'll find that on potaroo.net.
It's a small, furry Australian animal.
Www.potaroo.net,
and you'll find some articles there about DNS,
DNS privacy,
and some discussion about, well, what does it
mean and where is it going?
Related areas.
My suspicion is
that things will go sleepy until someone turns
it on big time, and then every last
news outlet, tech news outlet on the planet
will go, oh, my god, Armageddon's
just happened.
But at that point, it'll be too late.
Okay. Alright. So we know where to find
you on pot potteroo.net.
I know you also ride on Circle ID
from time to time and APNIC.
I I see your stuff out on APNIC.
Twitter
or anything like that?
No. Not me. Not me.
I I find 15 words, about 15,000 words
too few.
So if you go to Poturu, you know,
don't go there for a two minute look
because you're not gonna make it.
It'll take a little bit apart for me.
No. That's no. That's fine. I don't I
don't really do a lot on Twitter either.
People DM me on Twitter and I check
it about once a month and go Oh,
somebody dm me like a month ago.
Yeah,
I have I have the same issue. I
I just like whatever
so
So tom, where can people find you?
Well, I do,
look at Twitter a little more often than
once a month, Tom Ammon, and then I'm
also on LinkedIn.
Okay.
And I'm Russ. You can find me at
rule eleven dot tech, and you can follow
the hedge on rule11.tech,
unless Tom decides to start blogging too, and
then there would be more than one place
to follow it But you know, I've been
trying with tom. It just doesn't
It hasn't taken
So thanks for coming on jeff and thanks
for taking your time,
and enjoy
standing on the ceiling
I just the books are amazing to me
that
Gravity is a wonderful thing. Thanks. Russ. Thanks,
Tom
Thank you for joining us. You can find
the hedge at rule11.tech.