41–50 of 134 posts
Encrypted DNS is great, but please also do something with SNI. I am sure other users don't want their ISP to peek at what sites they are visiting too.
Earlier quoted context omitted.
I specifically do not want each application having it's own resolver. That's something operating system has to provide and is configured by administrator, for everything. Some systems go even further and do not allow outcoming traffic on port 53 for proces other than system resolver. Masquerading that as 443 opens a new problem. You don't have to trust anyone, you can run a recursive resolver too. Even some home rout…
You might have noticed that Firefox runs in a lot of messed up environments, where, for example, bad installers downloaded by the user have done many bad things to the OS, including installing bogus hosts files which block known anti-virus and anti-malware websites. Firefox had a huge crackdown on malicious toolbars and extensions, and that was a good thing for most people. Do you have a clever suggestion for how Fir…
"Caveats TRR doesn't read or care about /etc/hosts There's no way to exclude or white list specific domains" For me, the primary advantage of HOSTS/DNS is the ability to control answers to application queries for addresses and block ads. This seems to remove all control a user might have through controlling such lookups. Yikes. I think DOH is useful but in a different way. For example, it is useful for retrieving bul…
Firefox's DOH client ignores /etc/hosts, but it shouldn't be too hard to host your own DOH server [1][2] that you could then configure how you see fit. I can see this pattern becoming widespread someday, and with DOH, people can re-use their experience in setting up webservers. [1] https://github.com/st3fan/tinydoh [2] https://github.com/m13253/dns-over-https
Earlier quoted context omitted.
I specifically do not want each application having it's own resolver. That's something operating system has to provide and is configured by administrator, for everything. Some systems go even further and do not allow outcoming traffic on port 53 for proces other than system resolver. Masquerading that as 443 opens a new problem. You don't have to trust anyone, you can run a recursive resolver too. Even some home rout…
You might have noticed that Firefox runs in a lot of messed up environments, where, for example, bad installers downloaded by the user have done many bad things to the OS, including installing bogus hosts files which block known anti-virus and anti-malware websites. Firefox had a huge crackdown on malicious toolbars and extensions, and that was a good thing for most people. Do you have a clever suggestion for how Fir…
I am in Indonesia where Reddit, Vimeo, The Pirate Bay and other sites are blocked. I just enabled TRR in Firefox 60 (They mention best support is in 62) and now I have full unblocked access to all those sites. Awesome.
"Caveats TRR doesn't read or care about /etc/hosts There's no way to exclude or white list specific domains" For me, the primary advantage of HOSTS/DNS is the ability to control answers to application queries for addresses and block ads. This seems to remove all control a user might have through controlling such lookups. Yikes. I think DOH is useful but in a different way. For example, it is useful for retrieving bul…
Firefox's DOH client ignores /etc/hosts, but it shouldn't be too hard to host your own DOH server [1][2] that you could then configure how you see fit. I can see this pattern becoming widespread someday, and with DOH, people can re-use their experience in setting up webservers. [1] https://github.com/st3fan/tinydoh [2] https://github.com/m13253/dns-over-https
They have options to tweak soo many other aspects of TRR/DOH, why can’t they add an option to support /etc/hosts?
The difficulty there, I believe, is that /etc/hosts is commonly parsed by your libc, so firefox will have to reimplement /etc/host parsing on top of their libc if it does not expose /etc/host entries in some way (glibc and muslc both don't to my knowledge)
Earlier quoted context omitted.
I specifically want DNS over HTTPS - except for specialized use cases over known networks where every device in between is tested as behaving properly, protocols that aren't TLS (over TCP) are a hassle to me both as an end user and as a developer, because someone is going to break them. And once you have TLS, there's little benefit in using something other than HTTP inside, and a lot of benefit in using something whe…
I specifically do not want each application having it's own resolver. That's something operating system has to provide and is configured by administrator, for everything. Some systems go even further and do not allow outcoming traffic on port 53 for proces other than system resolver. Masquerading that as 443 opens a new problem. You don't have to trust anyone, you can run a recursive resolver too. Even some home rout…
I am in Indonesia where Reddit, Vimeo, The Pirate Bay and other sites are blocked. I just enabled TRR in Firefox 60 (They mention best support is in 62) and now I have full unblocked access to all those sites. Awesome.
Using an alternative DNS resolver like 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare) could solve that already, and not only in Firefox.
Earlier quoted context omitted.
Also problematic: "0 - Off (default). use standard native resolving" ... "5 - Explicitly off. Also off, but selected off by choice and not default." It seems that the plan for the "0 - default" is to switch the users to other modes without the user knowing it, and to keep the behavior off the user must specifically change the option to "5."
"I better speculate on the reason here because surely Daniel is part of a conspiracy meant destroy the browsing experience of millions" or... It could be prepared for when the user gets asked what they want and then Firefox can remember an explicit "no" as compared to not selection ever made. / Daniel (author of the blog post)
Daniel’s own decisions aren’t in question here. If he works for Mozilla he is not more powerful than the whole company.
Having “off” and “off when selected by user” but not other variants still points to the intention of the default state not remaining off. Which is not problematic. Problematic is however naming the state that will obviously be changed “off.”