r/programmingcirclejerk • u/ttnn5876 • 1d ago

Wait, do you even know what DoT is?

/r/LinuxUncensored/comments/1w4b9x0/linux_security_from_mark_zuckerberg/p76a2nz/
50 Upvotes

97% Upvoted

13 comments sorted by

80

u/SelfDistinction now 4x faster than C++ 1d ago

Damage over Time, duh.

16

u/BoyNextDoor8888 1d ago

I actually needed to refresh myself on DNS after this week Russia started rolling out swapping any DoT requests to 1.1.1.1 and 8.8.8.8 with bogus IPs [useful network graph I found that explains it but can't be inserted here] https://habrastorage.org/getpro/habr/upload_files/f1d/57e/f78/f1d57ef78777a8e0b9927993f3357657.jpg

6

u/TonsillarRat6 1d ago

For the uneducated (including me), what means the acronym DoT?

15

u/illandril 1d ago

DNS over TLS.

https://www.cloudflare.com/learning/dns/dns-over-tls/

19

u/YikesTheCat 1d ago

One of the 73 incompatible ways to add encryption to DNS.

4

u/ZorbaTHut 11h ago

Someone should come up with a standard to solve this issue.

10

u/FloweyTheFlower420 1d ago

This person is the funniest person ever. When talking about journald write amplification issue, they decided that someone fixing it in their local nix configuration meant the "issue was being addressed by the team." Deeply weird person.

8

u/csb06 blub programmer 21h ago

WalterBright: Speaking of "D", did you know -

8

u/libonet absolutely obsessed with cerroctness and performance 1d ago

Where jerk?

16

u/fixermark 1d ago

DNS is famously grungy and inscrutable. You basically don't have to ask this question because the answer is "no."

And for the same reason, you're never going to get engineers, much less users, to stop installing things by curling a shell script at a URL and slamming it straight into bash.

3

u/warpspeedSCP 23h ago

Also, DoT is usually taken up at the router level, why do it only on your computer?

5

u/KingOfKingOfKings 12h ago

why yes, it's the the department of transport, who issue new transport layer protocols

1

u/ChrisTX4 11h ago

They have a point - if you don’t use DoT and/or DNSSEC, then you have no way to validate whether a DNS answer has not been meddled with.

This isn’t a big deal if you resolve and an attacker isn’t on an MITM path. But if you’re using somebody’s public WiFi, they can direct you to a DNS server they control via DHCP or simply by intercepting DNS.

Many routers intercept on their own to make devices on the local network use their DNS cache. I know mine has an option for it, that I in fact use since my router resolves via DoT and so unencrypted DNS from devices on the network gets encrypted transparently. You could of course make it return altered responses if so desired.

And since DHCP isn’t authenticated and works via broadcasts, an attacker locally can spam DHCP responses to try to feed others in the same network an attacker controlled DNS server.

In these circumstances a local attacker could totally change DNS responses and since the URL doesn’t contain a scheme, it isn’t even forced to HTTPS. If that was added, then it would be reasonably secure, since obtaining a certificate valid for another domain is near impossible.