I am in Indonesia where Reddit, Vimeo, The Pirate Bay and other sites are blocked. I just enabled TRR in Firefox 60 (They mention best support is in 62) and now I have full unblocked access to all those sites. Awesome.
Inside Firefox’s DNS-over-HTTPS engine
31–40 of 134 posts
Re: Inside Firefox’s DNS-over-HTTPS engine
#32this states it bypasses my local resolver.
Does it still account for /etc/hosts blocks? I use a few thousand entries to black hole malware and ad networks and I’d rather not lose this.
Re: Inside Firefox’s DNS-over-HTTPS engine
#33Earlier quoted context omitted.
Regular users today don't use that feature, so you're choosing a rather odd hill to die on. To put this another way: it's a significant benefit for my random non-techie friends to be able to use this new feature plus HTTPSEverywhere. And even as a techie, I don't use a hosts file to block anything. So I'm not bothered by how Firefox chose to implement this, like most people.
There's plenty of ad blocking, spyware blocking, ransomware blocking, etc. software that absolutely uses the hosts file to blackhole requests. Much of it is free and intended for home computer use.
Regular users use a browser extension like ublock or Adblock to block ads. Not improving DNS security for the sake of a few users obscure Adblock mechanism would be pretty silly.
Re: Inside Firefox’s DNS-over-HTTPS engine
#34They have options to tweak soo many other aspects of TRR/DOH, why can’t they add an option to support /etc/hosts?
Re: Inside Firefox’s DNS-over-HTTPS engine
#35Earlier quoted context omitted.
I specifically want DNS over HTTPS - except for specialized use cases over known networks where every device in between is tested as behaving properly, protocols that aren't TLS (over TCP) are a hassle to me both as an end user and as a developer, because someone is going to break them. And once you have TLS, there's little benefit in using something other than HTTP inside, and a lot of benefit in using something whe…
I specifically do not want each application having it's own resolver. That's something operating system has to provide and is configured by administrator, for everything. Some systems go even further and do not allow outcoming traffic on port 53 for proces other than system resolver. Masquerading that as 443 opens a new problem. You don't have to trust anyone, you can run a recursive resolver too. Even some home rout…
Sure, that's fine. I'm just responding to "... something nobody has asked for," and below it, "No, [you didn't want the thing you say you want], you wanted [other thing]."
Not everyone wants the thing I want. But that's different from nobody wanting it.
(However, a system-wide DNS resolver using DNS-over-HTTPS is definitely a thing I want! I've been considering writing an NSS module in Rust for it, as a way to play with writing a loadable module with tokio, to see if that even works.)
Re: Inside Firefox’s DNS-over-HTTPS engine
#36this states it bypasses my local resolver. Does it still account for /etc/hosts blocks? I use a few thousand entries to black hole malware and ad networks and I’d rather not lose this.
In the caveats section it says that it is ignored
Re: Inside Firefox’s DNS-over-HTTPS engine
#37Is there a particular reason a DNS resolver should be implemented in a web browser? Wouldn't it be better if it was a system-wide configuration?
It's been 30 years and DNS is still a major security and confidentiality flaw in all widely used OSes. I welcome my browser doing something about it. If in the future OSes and ISPs provide better alternatives, this feature can always be turned off.
It is default off.
Re: Inside Firefox’s DNS-over-HTTPS engine
#38Encrypted DNS is great, but please also do something with SNI. I am sure other users don't want their ISP to peek at what sites they are visiting too.
Re: Inside Firefox’s DNS-over-HTTPS engine
#39Encrypted DNS is great, but please also do something with SNI. I am sure other users don't want their ISP to peek at what sites they are visiting too.
... that's why the article you're commenting on mentions SNI and that we hope to address that too (but separately) going forward!
Re: Inside Firefox’s DNS-over-HTTPS engine
#40Is there a particular reason a DNS resolver should be implemented in a web browser? Wouldn't it be better if it was a system-wide configuration?
It's been 30 years and DNS is still a major security and confidentiality flaw in all widely used OSes. I welcome my browser doing something about it. If in the future OSes and ISPs provide better alternatives, this feature can always be turned off.
I do want to use this on all my devices, not that I'm criticising the DoH concept per se. Only that it seems to me that the browser is not the correct place for the DNS resolver; thus I wonder why it's not the OS but the browser that gets the new features.