Hacker News new | ask | show | jobs
by yuft 2473 days ago
Maybe if the OS providers were more proactive about DNS over TLS/HTTPS, Mozilla wouldn't have needed to do this to keep users secure.
1 comments

Android does support DNS-over-TLS, and it does it in a way that does not break networks - whatever it gets from DHCP, it tries the same server with DoT first. Users can also configure their preferred DoT server.

Linux, or at least the glibc-based distributions, have a concept of nss_modules; you can configure whatever mechanism you want, some people are using DNSCrypt or nss-tls, for example. Systemd-resolved, with all the hate it gets, does support DoT. So do other local caching resolvers, like Knot.

With other systems, you would have to discuss that with the respective vendors. Vendors also discuss these issues with customers, and very few customers are fond of breaking their systems. Activism, as Mozilla has shown, is a good way to irritate a good chunk of your user base. The change would have to be gradual, and allow the local admins to be in control (like Android and Linux distributions do).