Hacker News new | past | comments | ask | show | jobs | submit login

The answer is: DHCP. In an environment where a captive portal is active you can ensure that only one DHCP server is running in your segment with no rogue DHCP servers. So telling a client with DHCP that a captive portal is active, and with URL to show it, is sane. This would eliminate a lot of stupid probing done by clients. Same goes for announcing DoT/DoH servers that way.

The same applies for your "home" environment. Since you usually don't want to run multiple DHCP servers, this would also work there.




And it isn't like anyone needs to modify DHCP standards to support this. Just use any of the "options" text to add DoH/DoT, the same way browsers are advised of PAC URL's today. Only the clients would need updates to know how to use this, and adding the capability to an OS should be fairly easy to implement.

  option wpad-url code 252 = text;
  option wpad-url "http://10.10.10.10/proxy.pac\n";
I'm sure there is a clean way to overload or augment this capability to extend it to DoH/DoT.


I did something similar for a PoC at my university. It worked, no surprise there. All you need to do is have a another client script in Debian to configure your resolver.


I should add that DoH developers should reach out to ISC for comment on DHCP, to get an idea what the cleanest method would be to implement DoH/DoT in DHCP that would work for 90%+ of DHCP implementations.


https://datatracker.ietf.org/group/add/documents/

There is some work regarding this.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: