[tptacek]

He's an authority on the DNS, but that doesn't mean he's right about everything to do with it. He's an advocate for DNSSEC, for instance, which is a fiasco. In this instance, his concern about DoH enabling malware or closed-source devices is incoherent (none of these bugbears even need to use DNS at all if they don't want to). The concern DoH addresses, meanwhile, is not abstract: if you're in the US on a major ISP, it's almost certain that your ISP is monetizing your DNS lookups.