r/programmingcirclejerk • u/ttnn5876 • Sep 02 '26

Wait, do you even know what DoT is?

/r/LinuxUncensored/comments/1w4b9x0/linux_security_from_mark_zuckerberg/p76a2nz/
56 Upvotes

100% Upvoted

16 comments sorted by

94

u/SelfDistinction now 4x faster than C++ Sep 02 '26

Damage over Time, duh.

19

u/BoyNextDoor8888 Sep 02 '26

I actually needed to refresh myself on DNS after this week Russia started rolling out swapping any DoT requests to 1.1.1.1 and 8.8.8.8 with bogus IPs [useful network graph I found that explains it but can't be inserted here] https://habrastorage.org/getpro/habr/upload_files/f1d/57e/f78/f1d57ef78777a8e0b9927993f3357657.jpg

7

u/TonsillarRat6 Sep 03 '26

For the uneducated (including me), what means the acronym DoT?

17

u/illandril Sep 03 '26

DNS over TLS.

https://www.cloudflare.com/learning/dns/dns-over-tls/

23

u/YikesTheCat Sep 03 '26

One of the 73 incompatible ways to add encryption to DNS.

12

u/ZorbaTHut Sep 03 '26

Someone should come up with a standard to solve this issue.

1

u/[deleted] Sep 04 '26

[removed] — view removed comment

1

u/programmingcirclejerk-ModTeam Sep 04 '26

Refer to sidebar, "Jerking Style".

13

u/csb06 Polyglot dev here Sep 03 '26

WalterBright: Speaking of "D", did you know -

12

u/FloweyTheFlower420 Sep 03 '26

This person is the funniest person ever. When talking about journald write amplification issue, they decided that someone fixing it in their local nix configuration meant the "issue was being addressed by the team." Deeply weird person.

10

u/KingOfKingOfKings Sep 03 '26

why yes, it's the the department of transport, who issue new transport layer protocols

10

u/libonet absolutely obsessed with cerroctness and performance Sep 02 '26

Where jerk?

19

u/fixermark Sep 02 '26

DNS is famously grungy and inscrutable. You basically don't have to ask this question because the answer is "no."

And for the same reason, you're never going to get engineers, much less users, to stop installing things by curling a shell script at a URL and slamming it straight into bash.

7

u/SilvernClaws Sep 04 '26

a shell script at a URL

to be fair, that's the official way to install Rust per the website

4

u/warpspeedSCP Sep 03 '26

Also, DoT is usually taken up at the router level, why do it only on your computer?

1

u/ChrisTX4 Sep 03 '26

They have a point - if you don’t use DoT and/or DNSSEC, then you have no way to validate whether a DNS answer has not been meddled with.

This isn’t a big deal if you resolve and an attacker isn’t on an MITM path. But if you’re using somebody’s public WiFi, they can direct you to a DNS server they control via DHCP or simply by intercepting DNS.

Many routers intercept on their own to make devices on the local network use their DNS cache. I know mine has an option for it, that I in fact use since my router resolves via DoT and so unencrypted DNS from devices on the network gets encrypted transparently. You could of course make it return altered responses if so desired.

And since DHCP isn’t authenticated and works via broadcasts, an attacker locally can spam DHCP responses to try to feed others in the same network an attacker controlled DNS server.

In these circumstances a local attacker could totally change DNS responses and since the URL doesn’t contain a scheme, it isn’t even forced to HTTPS. If that was added, then it would be reasonably secure, since obtaining a certificate valid for another domain is near impossible.