Guys this is an enterprise feature. I hate windows as much as the next guy but y’all should actually read the article. Its not forced upon anyone.
Yeah, this sounds like a pretty interesting feature that will (in theory at least) make enterprise networking more secure.
I highly doubt this will even be possible to use on Windows home or maybe even Pro. It’s probably locked behind at least some kind of extra licence as well.
It will also likely require quite a bit of effort to set up properly in enterprises.
People are freaking out over absolutely nothing. Just read the article and use common sense.
article should have less loaded heading though. by now it should be expected that most read only that. Heading in general should contain the essence of the article so the general idea can be seen at a glance.
Yes, but people obviously shouldn’t comment and get mad unless they have at least read some of the article.
Yes, this mostly works as a managed DNS solution for enterprise networks that actually does what people in large organizations need and solves a ton of issues.
“protective DNS”
There is no way there isn’t a hidden agenda. You already could block malicious websites at the browser level
Doing so at the dns layer is a much better option, as it prevents the end user or malware from bypassing those restrictions with a non-standard browser or modifying the client settings (which shouldn’t happen, but can).
In an enterprise environment, which is exactly what this is aimed at, that kind of protection is a boon against the random shit end users click on.
Not all connections are at the browser level.
I couldn’t figure out if this is enterprise-only or if it will be forced into home editions.
In the how this works section they detail that it comes from MDM solutions. In English this is a feature for it admins of companies who use the intune management software from Microsoft. You probably need pro or better to even use the feature.
At a quick glance, it looks to be a way of whitelisting domains at a DNS level, but with the added feature of having allowed DNS servers.
The amount of Windows bashing in this thread is hilarious, for what amounts to Enterprise grade DNS-over-TLS with additional whitelisting. Doesn’t help the home user, but likely won’t break home users internet access either.
Lemmy in general hates Windows.
Removed by mod
As a sysadmin, that actually sounds pretty useful. If they add a blocklist feature, it might be a good system-wide malware / ad blocking solution.
With the shady path they’ve been on lately, I wouldn’t be surprised if they locked down the home editions to only using their servers, so they can use the data points/telemetry to sell ads, etc.
They want to get around people’s pi holes
They couldn’t give less of a shit about the 7 people in the world that use pi-holes
Changes like these tend to be pushed out to the home editions first, and the enterprise version will have a setting to turn this on or off.
This is due to companies usually having a more complex network than home users.
This is a feature for complex enterprise networks and exclusively so. Enabling it will be very opt in, as you will have to do quite a bit of set-up before it works.
This is totally an enterprise feature. I have read enough enterprise documentation to know that. For example All of the wording talking about who is going to use this is “Admins”, “organizations” and “end users”. That is business/enterprise 101 talk right there.
If it is even available on the home versions it is going to be off by default as it requires a good bit of setup to turn on.
If Microsoft wanted to track you via DNS they would just do the same thing that Google and Apple are doing with their phones. Have a secure DNS option that is on by default. That uses DoH amd happens to use their DNS servers.
Also Microsoft doesn’t need DNS to track anyone in Windows. As they control the OS.
Both are scary
One reason more which make me feel good about installed Linux.
FUCK M$!!
Lemmy feeling kind of repetetive with these comments
Removed by mod
I totally get what you’re saying, even though I disagree with small details. Also, about the OP, I think DNS and its resolution should obligatory be server in a decentralized manner. If Microsoft takes control over such vital service, and since we agree they own the market (regarding home computers, laptops etc), it raises serious concerns about people’s access to information, which is much more worrisome than (the also included) privacy concerns.
There no way even possible via the GUI to config power management for things like low/critical battery conditions /actions on Linux.
I don’t think you should bash Linux for choosing an immature desktop environment.
KDE has this and I don’t think it’s a new feature. System settings, power management, advanced power settings to set low and critical levels and what to do at critical, and “energy saving” menu to configure everything else. The interface is better than any windows implementation of this that I have seen.Yes I’ve also been frustrated by the inferiority of the default mint DEs, but saying that Linux can’t do those is not true.
Every time I’ve installed Linux as my main OS (many, many times since I was younger), it gets to an eventual point where every single thing I want to do requires googling around to figure out problems
For me windows would be the same if I ever reinstalled it
can’t wait to search for some drivers so I can get the cursor acceleration disabled. Or enabled. Or configured?
KDE, configurable in system settings gui. For ages.
Linux doesn’t even use a common shell (which is a good thing in it’s own way), and that’s a massive barrier for users.
There’s no single shell that’s true, but why do you think bash is not common? All distros I have used so far (debian, ubuntu, mint, suse, arch (no I don’t use it by the way)) has used bash.
After finishing the sentence, I realized you probably mean the desktop environment. Yeah there are pros and cons of all of them, I think KDE is the most suitable for most uses but for old machines maybe it’s not what I would choose.settling on a single GUI (which is arguably half of why Windows became a standard
Windows does not have a single gui. They change it roughly every 2 major OS versions, and recently they are not just changing it but turning it into a steaming hot pile of garbage, first with the settings app in 10, and now full-on in 11.
Just use Linux for what it is good, for everything else you can always use VirtualBox…
Linux is open for business.
This is the best summary I could come up with:
Translating human-readable domain names into numerical IP addresses has long been fraught with gaping security risks.
Microsoft on Friday provided a peek at a comprehensive framework that aims to sort out the Domain Name System (DNS) mess so that it’s better locked down inside Windows networks.
Adding cryptographic authentication and encryption to DNS often obscures the visibility admins need to prevent user devices from connecting to malicious domains or detect anomalous behavior inside a network.
As a result, DNS traffic is either sent in clear text or it’s encrypted in a way that allows admins to decrypt it in transit through what is essentially an adversary-in-the-middle attack.
Admins are left to choose between equally unappealing options: (1) route DNS traffic in clear text with no means for the server and client device to authenticate each other so malicious domains can be blocked and network monitoring is possible, or (2) encrypt and authenticate DNS traffic and do away with the domain control and network visibility.
Jake Williams, VP of research and development at consultancy Hunter Strategies, said the union of these previously disparate engines would allow updates to be made to the Windows firewall on a per-domain name basis.
The original article contains 482 words, the summary contains 198 words. Saved 59%. I’m a bot and I’m open source!
Why does the thumbnail say “Windows” twice? /j
Why can’t we have bulk downloads of the main A records for most domains similar to IP block owners? Even if they have to be updated often… I think it could increase privacy.
Sounds interesting, and it looks like it covers a lot of what our network VPN does (I can’t get any DNS resolution to any DNS servers other than the designated Corp ones, which is annoying as shit when trying to test other reachable servers). My only concern is if this policy would block local DNS resolution prior to the VPN coming up, as it might introduce a catch 22 where I can’t resolve my VPN endpoint in order to auth and access the internal resolver
That’s because you’re using a full tunnel vpn
You want an e2e encrypted public DNS? https://www.quad9.net/
You want to white- / blacklist IPs and domains? Configure your DNS
Bruh they just recently introduced easy-to-use DoT and DoH
To gain the most security value from ZTDNS, system admins will need to enumerate the expected domains and/or IP ranges they expect their clients to connect to,” Jake Williams wrote. “Failure to do so will result in self-inflicted denial of service.”
Glad I’m on Linux/macos at home/work. Wtf is happening.
“Self-inflicted”. If you don’t comply, we’ll break your computer, and that’s your fault. Why did you make us do that???
It’s a security feature. Microsoft is not breaking anything. It’s the sysadmin that could accidentally break their own stuff if they don’t set it up correctly.
They don’t even have to set it up if they don’t want too.
Removed by mod
