zlacker

> You can't control it as a network administrator

That’s the design intent. Because not all network administration is benign.

DoH is a tool like any other. Good or bad entirely on why and how it’s used. And your own perspective on that use case.

>>noizej+(OP)
But when the network is mine, and I'm the administrator, anything that prevents me from seeing what's happening is a Bad Thing.

DoH opens me up to security problems that I wouldn't otherwise have, and the extent I have to go to in order to stop it is crazy.

> DoH is a tool like any other. Good or bad entirely on why and how it’s used.

Except that it's a tool I have little control over, and no control over how and why it's used. That's the problem.

DoH is a plague.

>>JohnFe+h2
> But when the network is mine, and I'm the administrator, anything that prevents me from seeing what's happening is a Bad Thing.

That's not true when the just the network itself is yours. It's only true when all of the computers on it are too.

> DoH opens me up to security problems that I wouldn't otherwise have, and the extent I have to go to in order to stop it is crazy.

What? No it doesn't.

> Except that it's a tool I have little control over, and no control over how and why it's used. That's the problem.

You're not supposed to be able to have control over what tools other people use on their own computers.

>>joseph+Bb
> It's only true when all of the computers on it are too.

I was unclear. This is exactly the case I'm talking about. The network, and all of the devices on the network, are mine.

> What? No it doesn't.

It does. It makes it easier for bad actors -- mostly advertising networks -- to bypass my DNS filtering. They can do it all with their own code, encrypted through HTTPS to hide it, and never touch my DNS systems, nor be affected by browser settings.

> You're not supposed to be able to have control over what tools other people use on their own computers.

Again, I'm talking about having control over my own machines, not anyone else's.

>>JohnFe+QR1
> It makes it easier for bad actors -- mostly advertising networks -- to bypass my DNS filtering. They can do it all with their own code, encrypted through HTTPS to hide it, and never touch my DNS systems, nor be affected by browser settings.

If that makes DoH bad, then privacy is bad too since it makes it easier for terrorists and pedophiles to evade the law.

>>joseph+QX1
On my network, running my machines, these privacy mechanisms really are bad. Having them doesn't give me any privacy (the entire system is my private system to begin with -- who am I being private from?).

The only privacy they are affording is specifically to entities that I don't want operating on my machines to begin with, who are mostly interested in violating my privacy.

So this privacy mechanism, in this use case, really is bad because it reduces my privacy.