系统与基础设施hacks.mozilla.org
DNS over HTTPS 漫画入门
A cartoon intro to DNS over HTTPS
2018 — 2019，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这是 Mozilla Hacks 的一篇漫画式科普文章，用插画讲解 DNS over HTTPS（DoH）的工作原理：传统 DNS 查询以明文发送、易被 ISP 或中间人窃听和篡改，而 DoH 将查询加密后通过 HTTPS 发送，从而保护用户隐私。文章还介绍了 Firefox 中启用 DoH 的相关实践。
为什么经久不衰：它用最直观易懂的方式解释了一个至今仍在争论的基础设施变革，是理解 DNS 隐私问题的经典入门材料。
HN 评论精选
质疑免费 DoH 服务的动机，认为其背后是数据收集
作为怀疑论者，我认为这是 Google 和 Cloudflare 收集 DNS 数据的尝试，否则为什么要免费提供这项服务？虽然两者的隐私政策禁止存储个人身份信息或将 DNS 数据与其他数据关联，但允许它们记录哪些域名受欢迎、来自哪些地区和设备类型。而且 TLS 本身还会留下可用于指纹识别的特征。
barbegal查看英文原文
As a cynic I would say this is an attempt by Google and Cloudflare to collect DNS data. Why else would they provide this service for free? Both Google's [1] and Cloudflare's [2] DNS privacy policy prohibits them from storing personally identifiable information or from correlating DNS information with other Google data coming from the same IP/account but it does allow them to store information about which domains are popular, from which locations and from which type of device. TLS (and therefore HTTPS) provides a very useful fingerprint based on accepted cipher suites, extensions, compression methods... [1] https://developers.google.com/speed/public-dns/privacy [2] https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ [3] https://devcentral.f5.com/articles/tls-fingerprinting-a-method-for-identifying-a-tls-client-without-decrypting-24598
DoH 把去中心化的 DNS 集中到少数巨头手中，默认设置才是关键
我有点讨厌这件事。把一个去中心化的服务，替换成由少数科技巨头提供的服务。'用户可以配置 Firefox 使用任意支持 DoH 的解析器'——但只有默认设置才重要，普通用户根本不会去了解或配置这些，无论解释得多简单。
mike-cardwell查看英文原文
I kind of hate this. Taking a decentralised service, and replacing it with a service provided by a small handful of tech giants. "But this doesn’t mean you have to use Cloudflare. Users can configure Firefox to use whichever DoH-supporting recursive resolver they want. As more offerings crop up, we plan to make it easy to discover and switch to them." Only defaults matter. Your average web user wont be interested in knowing about or configuring this, no matter how simple the explanation/choice is made.
亲身经历 ISP 的 DNS 劫持，证明 DoH 有现实防护价值
有一段时间我的 ISP（Verizon FIOS）遭遇 DNS 劫持攻击，许多 CDN 的 IP 被替换成一台注入广告 JavaScript 的服务器，连 8.8.8.8 都被劫持（仅针对我家 IP 时）。联系 Verizon 多次无果，只能重置 IP。现在 DoH 越来越普及，我会尽可能到处使用它。虽然 DNSSEC 可能是'更好'的方案，但 DoH 现在就能用。
Klathmon查看英文原文
There was a good chunk of time where my ISP (Verizon FIOS at the time) was having some kind of DNS hijacking attack happening where many CDN IPs were being replaced with an IP of a server that was adding some ad-injecting javascript into many pages (and god knows what else, I still have the payload laying around somewhere as I saved it for future curiosity). At the time my only real recourse was to pump my whole house through a VPN, as even Google's DNS (8.8.8.8) was being hijacked, but ONLY when it was coming from my home IP. (Full disclosure, i'm not very well versed in the networking stack. I know enough to get myself in trouble, but not much more. This was what I understood to be happening, but I could be way off base. However it was happening on multiple devices, multiple OSs, multiple verizon IPs, multiple DNS servers, both with and without a router, and would stop instantly if any of those machines were pointed at a wireless hotspot, or a VPN was turned on. At one point I even sent my router's WAN connection through my phone's hotspot and the problem went away) After talking with verizon many times and each time having to spend an hour or so trying to get through to someone that knew even remotely what I was talking about, all they were able to do was reset my IP, which fixed nothing. Now that DNS-over-HTTPS is becoming more common, i'm going to use it everywhere I can. Yes, DNSSEC might be a "better" solution, but I can use DoH right now to protect myself on all sites and (hopefully soon) all devices. Just the other day I discovered Intra [0] a (still unreleased) app by Google for android which has your whole android phone use DNS-over-HTTPS. I've been running it the last few days and i'm quite pleased with it. Does anyone know of a way to force all DNS queries in windows to use DoH? [0] https://play.google.com/store/apps/details?id=app.intra&hl=en_US
担心 DoH 会削弱 Pi-Hole 等本地 DNS 过滤工具的能力
我有个担忧：DoH 像是在走向 DNS 的端到端加密。这能防住 ISP 和国家级的监听，但会不会削弱我对本地 DNS 的控制？我的威胁模型是网站运营者和本地网络中的设备（如电视盒子、游戏机），为此我用 Pi-Hole。可一旦全面端到端加密，我如何在本地拦截和管理 DNS？
throwaway191020查看英文原文
I have a concern. DNS over HTTPS feels to me like we're edging towards end-to-end encryption for DNS. This seems like a good thing, but even though it will protect against ISP and state level observations of DNS, will it not reduce ones control over DNS locally? My threat model remains web site operators and the malware and tracking inserted at that point. Additionally devices on the network that may observe locally and communicate externally like TV boxes and games consoles. To manage those threats I use Pi-Hole. But once we start end-to-end encrypting, and especially when we start verifying those ends, how do I locally intercept and manage DNS for my privacy and security? Is this a genuine concern about DNS over HTTPS? Or is the plan to enable systems like Pi-Hole to be a trusted and configurable resolver too so that consumers retain the ability to control their own systems like this?
历次讨论
同类还值得读
TTY 揭秘（2008）
The TTY demystified (2008)
经典文章深入剖析了 Unix/Linux 中 TTY 子系统的工作原理，包括线路规程、终端驱动、信号与控制字符等机制。
系统与基础设施上首页 11 次 · 2009–2025linusakesson.net编辑精选为什么 GNU grep 这么快
Why GNU grep is Fast
FreeBSD 邮件列表上一篇广为流传的帖子，解释 GNU grep 为什么快：核心在于 Boyer-Moore 字符串搜索算法配合精心优化的内部循环和 I/O，让程序在搜索时“…
系统与基础设施上首页 9 次 · 2010–2022lists.freebsd.orgXplain：为普通人讲解 X11
Xplain – Explaining X11 for the rest of us
《Xplain》是作者（HN 用户 Jasper_）写的一系列 X11 长文，用他在浏览器中重建的 X11 绘图模型做交互演示，讲解 X11 的绘图模型与窗口系统设计。
系统与基础设施上首页 6 次 · 2013–2020magcius.github.io编辑精选旋风教程：为 Linux 创建极小 ELF 可执行文件（1999）
A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux (1999)
breadbox 写于 1999 年的经典教程，主题是如何为 Linux 手工构造并裁剪出体积极小的 ELF 可执行文件。
系统与基础设施上首页 6 次 · 2007–2025muppetlabs.comPostgreSQL 内部原理
The internals of PostgreSQL
《The Internals of PostgreSQL》是一本免费在线书籍，系统讲解 PostgreSQL 的内部实现，包括查询处理、并发控制、WAL、缓冲区管理等核心机制。
系统与基础设施上首页 5 次 · 2017–2025interdb.jp编辑精选