Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside Firefox’s DNS-over-HTTPS engine

daniel.haxx.se

Post reply on HN
Print view View original

61–70 of 134 posts

Re: Inside Firefox’s DNS-over-HTTPS engine

#61

Post by vetinari »

zaarn wrote: post #48
vetinari wrote: post #25

Earlier quoted context omitted.

I specifically do not want each application having it's own resolver. That's something operating system has to provide and is configured by administrator, for everything. Some systems go even further and do not allow outcoming traffic on port 53 for proces other than system resolver. Masquerading that as 443 opens a new problem. You don't have to trust anyone, you can run a recursive resolver too. Even some home rout…

In most Linux setups the resolver is the libc which means each application does have it's own resolver (though commonly dnsmasq or systemd-resolved is used as a local resolver/proxy for DNS). Libc also implements all the stuff around /etc/resolv.conf and /etc/hosts.

While the resolver is in glibc, it is in the form of nss modules. This is one of the primary reasons, why you cannot compile statically with glibc.

Re: Inside Firefox’s DNS-over-HTTPS engine

#62

Post by vetinari »

geofft wrote: post #35
vetinari wrote: post #25

Earlier quoted context omitted.

I specifically do not want each application having it's own resolver. That's something operating system has to provide and is configured by administrator, for everything. Some systems go even further and do not allow outcoming traffic on port 53 for proces other than system resolver. Masquerading that as 443 opens a new problem. You don't have to trust anyone, you can run a recursive resolver too. Even some home rout…

Sure, that's fine. I'm just responding to "... something nobody has asked for," and below it, "No, [you didn't want the thing you say you want], you wanted [other thing]." Not everyone wants the thing I want. But that's different from nobody wanting it. (However, a system-wide DNS resolver using DNS-over-HTTPS is definitely a thing I want! I've been considering writing an NSS module in Rust for it, as a way to play w…

Sure, system-wide DNS resolver using DNS-over-HTTPS (and the autodiscovery using DHCP/RA!) would be a good thing; each app going rogue and piercing through your policies/DNS/firewall is not.

Re: Inside Firefox’s DNS-over-HTTPS engine

#63

Post by vetinari »

greglindahl wrote: post #28
vetinari wrote: post #25

Earlier quoted context omitted.

I specifically do not want each application having it's own resolver. That's something operating system has to provide and is configured by administrator, for everything. Some systems go even further and do not allow outcoming traffic on port 53 for proces other than system resolver. Masquerading that as 443 opens a new problem. You don't have to trust anyone, you can run a recursive resolver too. Even some home rout…

You might have noticed that Firefox runs in a lot of messed up environments, where, for example, bad installers downloaded by the user have done many bad things to the OS, including installing bogus hosts files which block known anti-virus and anti-malware websites. Firefox had a huge crackdown on malicious toolbars and extensions, and that was a good thing for most people. Do you have a clever suggestion for how Fir…

The fun with malware will only start, once it starts finding it's command and control centers using DNS-over-HTTPS to a shadow DNS served by botnet and you won't be able to filter out it's traffic.

Re: Inside Firefox’s DNS-over-HTTPS engine

#64

Post by Operyl »

gsich wrote: post #37
joelthelion wrote: post #30

Earlier quoted context omitted.

It's been 30 years and DNS is still a major security and confidentiality flaw in all widely used OSes. I welcome my browser doing something about it. If in the future OSes and ISPs provide better alternatives, this feature can always be turned off.

It is default off.

For now. In the future it won’t be from what I understand.

Re: Inside Firefox’s DNS-over-HTTPS engine

#65

Post by Operyl »

ksec wrote: post #55

Am I seeing this as another huge opportunity for CDN like Cloudflare and Fastly? Although I am not too comfortable with everything moving to HTTP. HTTP 2 was already complex enough, it seems we want to move everything into HTTP, everything away from TCP to UDP. What happen to QUIC anyway ?

There’s a working group for it that’s bashing out ideas, but I haven’t heard much from it in a while. I recall hearing they’re trying to take the parts they want and merge them into HTTP2.

Re: Inside Firefox’s DNS-over-HTTPS engine

#66

Post by Operyl »

acqq wrote: post #50
bagder wrote: post #29

Earlier quoted context omitted.

"I better speculate on the reason here because surely Daniel is part of a conspiracy meant destroy the browsing experience of millions" or... It could be prepared for when the user gets asked what they want and then Firefox can remember an explicit "no" as compared to not selection ever made. / Daniel (author of the blog post)

Daniel is not responsible for the decisions made by other Mozilla managers who already used their powers to deliver an unsolicited ad to the millions using the means presented as having apparently other purposes. Daniel’s own decisions aren’t in question here. If he works for Mozilla he is not more powerful than the whole company. Having “off” and “off when selected by user” but not other variants still points to the…

It’s worth noting that Daniel is the GP here. You’re talking about him in the third person.

Re: Inside Firefox’s DNS-over-HTTPS engine

#67

Post by tialaramex »

ksec wrote: post #55

Am I seeing this as another huge opportunity for CDN like Cloudflare and Fastly? Although I am not too comfortable with everything moving to HTTP. HTTP 2 was already complex enough, it seems we want to move everything into HTTP, everything away from TCP to UDP. What happen to QUIC anyway ?

The IETF has a QUIC Working Group. If you have relevant skills you should definitely join it.

https://datatracker.ietf.org/wg/quic/about/

Re: Inside Firefox’s DNS-over-HTTPS engine

#68

Post by CarlHoerberg »

> This initial approach, at least, does not cache the intermediate CNAMEs nor does it care about the CNAME TTL values.

That's a total violation of the standard and will break A LOT of things. Example: my.domain.com -> CNAME ec2-1-2-3-4.aws.com 30s TTL -> A 1.2.3.4 30days TTL.

So Firefox will now cache my.domain.com to 1.2.3.4 for 30 days? When you update the record for my.domain.com the change today will be applied in 30s, but with this flawed heuristic it won't expire until after 30 days.

Re: Inside Firefox’s DNS-over-HTTPS engine

#69

Post by kevincox »

KenanSulayman wrote: post #58

> [..] DOH increases privacy, security and sometimes even performance [..] Does anyone know how TLS over TCP can be faster than UDP?

I believe that big DNS responses will be faster because instead of establishing a TCP connection there is already a warm one ready to go.

But yes, for the common case the performance will be the same.

Re: Inside Firefox’s DNS-over-HTTPS engine

#70

Post by kannanvijayan »

xorcist wrote: post #56
joelthelion wrote: post #30

Earlier quoted context omitted.

It's been 30 years and DNS is still a major security and confidentiality flaw in all widely used OSes. I welcome my browser doing something about it. If in the future OSes and ISPs provide better alternatives, this feature can always be turned off.

> I welcome my browser doing something about it. Can we please go easy on the newspeak? Centralizing resolving to a handful of actors will not improve privacy for the most part of end users.

Resolving is already centralized: your ISP has 100% control over what you resolve, and you can't do anything about it. This is doing the opposite - by securely implementing resolution in a user agent, in a tamper-proof way, under the control of the user.
Post reply on HN