Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside Firefox’s DNS-over-HTTPS engine

daniel.haxx.se

Post reply on HN
Print view View original

21–30 of 134 posts

Re: Inside Firefox’s DNS-over-HTTPS engine

#21

Post by acqq »

textmode wrote: post #2

"Caveats TRR doesn't read or care about /etc/hosts There's no way to exclude or white list specific domains" For me, the primary advantage of HOSTS/DNS is the ability to control answers to application queries for addresses and block ads. This seems to remove all control a user might have through controlling such lookups. Yikes. I think DOH is useful but in a different way. For example, it is useful for retrieving bul…

Also problematic:

"0 - Off (default). use standard native resolving"

...

"5 - Explicitly off. Also off, but selected off by choice and not default."

It seems that the plan for the "0 - default" is to switch the users to other modes without the user knowing it, and to keep the behavior off the user must specifically change the option to "5."

Re: Inside Firefox’s DNS-over-HTTPS engine

#22

Post by geofft »

dogecoinbase wrote: post #20
greglindahl wrote: post #14

Earlier quoted context omitted.

I wanted this feature.

No, you wanted encryption for DNS transport, and I completely agree with that desire. This is a terrible half-measure that bypasses many existing security precautions people have intentionally taken by default , and moreover exposes private data to a company with a history of handling such poorly.

I specifically want DNS over HTTPS - except for specialized use cases over known networks where every device in between is tested as behaving properly, protocols that aren't TLS (over TCP) are a hassle to me both as an end user and as a developer, because someone is going to break them. And once you have TLS, there's little benefit in using something other than HTTP inside, and a lot of benefit in using something where everyone already has standard command-line tools and libraries and debugging tools for it.

And I trust Cloudflare, and more specifically Mozilla legal's ability to negotiate with Cloudflare, more than I trust approximately any ISP.

Re: Inside Firefox’s DNS-over-HTTPS engine

#23

Post by anonymfus »

acqq wrote: post #21
textmode wrote: post #2

"Caveats TRR doesn't read or care about /etc/hosts There's no way to exclude or white list specific domains" For me, the primary advantage of HOSTS/DNS is the ability to control answers to application queries for addresses and block ads. This seems to remove all control a user might have through controlling such lookups. Yikes. I think DOH is useful but in a different way. For example, it is useful for retrieving bul…

Also problematic: "0 - Off (default). use standard native resolving" ... "5 - Explicitly off. Also off, but selected off by choice and not default." It seems that the plan for the "0 - default" is to switch the users to other modes without the user knowing it, and to keep the behavior off the user must specifically change the option to "5."

No, it is not problematic, it's a good engineering. Imagine in the future DNS over HTTPS will be supported by OS and there will be an OS-wide setting for it. Then it will make sense to change default setting in FireFox to use OS-wide setting.

Re: Inside Firefox’s DNS-over-HTTPS engine

#24

Post by vetinari »

greglindahl wrote: post #17
mortenlarsen wrote: post #16

Earlier quoted context omitted.

Only the use case with the largest market share matters? That kind of thinking, really irks me.

No, I don't think like that. It does bother me when Firefox introduces a feature which covers up a huge hole in TLS, and they get a large number of complaints on HN.

Of course it gets large number of complains, when it creates more problems than it solves, and it is papered over "but mainstream users do not need that".

Mainstream users do not need most software ever made.

Re: Inside Firefox’s DNS-over-HTTPS engine

#25

Post by vetinari »

geofft wrote: post #22
dogecoinbase wrote: post #20

Earlier quoted context omitted.

No, you wanted encryption for DNS transport, and I completely agree with that desire. This is a terrible half-measure that bypasses many existing security precautions people have intentionally taken by default , and moreover exposes private data to a company with a history of handling such poorly.

I specifically want DNS over HTTPS - except for specialized use cases over known networks where every device in between is tested as behaving properly, protocols that aren't TLS (over TCP) are a hassle to me both as an end user and as a developer, because someone is going to break them. And once you have TLS, there's little benefit in using something other than HTTP inside, and a lot of benefit in using something whe…

I specifically do not want each application having it's own resolver. That's something operating system has to provide and is configured by administrator, for everything. Some systems go even further and do not allow outcoming traffic on port 53 for proces other than system resolver. Masquerading that as 443 opens a new problem.

You don't have to trust anyone, you can run a recursive resolver too. Even some home routers do that already.

Re: Inside Firefox’s DNS-over-HTTPS engine

#26

Post by greglindahl »

vetinari wrote: post #24
greglindahl wrote: post #17

Earlier quoted context omitted.

No, I don't think like that. It does bother me when Firefox introduces a feature which covers up a huge hole in TLS, and they get a large number of complaints on HN.

Of course it gets large number of complains, when it creates more problems than it solves, and it is papered over "but mainstream users do not need that". Mainstream users do not need most software ever made.

Did you see someone in this discussion suggesting "but mainstream users do not need that"? I just checked again and I don't see anyone making that suggestion.

Re: Inside Firefox’s DNS-over-HTTPS engine

#28

Post by greglindahl »

vetinari wrote: post #25
geofft wrote: post #22

Earlier quoted context omitted.

I specifically want DNS over HTTPS - except for specialized use cases over known networks where every device in between is tested as behaving properly, protocols that aren't TLS (over TCP) are a hassle to me both as an end user and as a developer, because someone is going to break them. And once you have TLS, there's little benefit in using something other than HTTP inside, and a lot of benefit in using something whe…

I specifically do not want each application having it's own resolver. That's something operating system has to provide and is configured by administrator, for everything. Some systems go even further and do not allow outcoming traffic on port 53 for proces other than system resolver. Masquerading that as 443 opens a new problem. You don't have to trust anyone, you can run a recursive resolver too. Even some home rout…

You might have noticed that Firefox runs in a lot of messed up environments, where, for example, bad installers downloaded by the user have done many bad things to the OS, including installing bogus hosts files which block known anti-virus and anti-malware websites. Firefox had a huge crackdown on malicious toolbars and extensions, and that was a good thing for most people. Do you have a clever suggestion for how Firefox might take your concept of trusting the OS and some administrator, which doesn't exist for most home users, and make it secure against malicious installers?

Re: Inside Firefox’s DNS-over-HTTPS engine

#29

Post by bagder »

acqq wrote: post #21
textmode wrote: post #2

"Caveats TRR doesn't read or care about /etc/hosts There's no way to exclude or white list specific domains" For me, the primary advantage of HOSTS/DNS is the ability to control answers to application queries for addresses and block ads. This seems to remove all control a user might have through controlling such lookups. Yikes. I think DOH is useful but in a different way. For example, it is useful for retrieving bul…

Also problematic: "0 - Off (default). use standard native resolving" ... "5 - Explicitly off. Also off, but selected off by choice and not default." It seems that the plan for the "0 - default" is to switch the users to other modes without the user knowing it, and to keep the behavior off the user must specifically change the option to "5."

"I better speculate on the reason here because surely Daniel is part of a conspiracy meant destroy the browsing experience of millions"

or...

It could be prepared for when the user gets asked what they want and then Firefox can remember an explicit "no" as compared to not selection ever made.

/ Daniel (author of the blog post)

Re: Inside Firefox’s DNS-over-HTTPS engine

#30

Post by joelthelion »

gkya wrote: post #27

Is there a particular reason a DNS resolver should be implemented in a web browser? Wouldn't it be better if it was a system-wide configuration?

It's been 30 years and DNS is still a major security and confidentiality flaw in all widely used OSes. I welcome my browser doing something about it. If in the future OSes and ISPs provide better alternatives, this feature can always be turned off.
Post reply on HN