Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside Firefox’s DNS-over-HTTPS engine

daniel.haxx.se

Post reply on HN
Print view View original

121–130 of 134 posts

Re: Inside Firefox’s DNS-over-HTTPS engine

#121

Post by greglindahl »

vetinari wrote: post #59
greglindahl wrote: post #26

Earlier quoted context omitted.

Did you see someone in this discussion suggesting "but mainstream users do not need that"? I just checked again and I don't see anyone making that suggestion.

It is paraphrased. The argument is, that it improves things for the mythical naive mainstream user, and for where it break things, well they are minority anyway.

I didn't see anyone making that argument, either. Are you trying to summarize what I said? If so, that's not what I said. I'd love to have a discussion about these issues, but it's not going to happen if everyone's talking past each other, plus random downvotes.

Re: Inside Firefox’s DNS-over-HTTPS engine

#122

Post by jlgaddis »

effie wrote: post #72
gkya wrote: post #40

Earlier quoted context omitted.

I do want to use this on all my devices, not that I'm criticising the DoH concept per se. Only that it seems to me that the browser is not the correct place for the DNS resolver; thus I wonder why it's not the OS but the browser that gets the new features.

One reason could be that large number of users of web have no real power to set up their operating system to use their preferred DNS server (e.g. non-technical employees in many big corps). The present-day OSes are designed to favor the administrator and to restrict the users.

> (e.g. non-technical employees in many big corps)

IMO, employees should be using whatever their organization has configured for them -- not whatever they wish.

A "regular user" changing the DNS servers on his work PC (joined to an Active Directory domain) to 8.8.8.8, for example, WILL run into problems at some point. They say they have workarounds for this but I think it's safe to say that bugs will likely be found. In the meantime, things will be broken for those users.

Moving this setting into the web browser (where it likely CAN be changed by a user) is not the proper solution.

Re: Inside Firefox’s DNS-over-HTTPS engine

#123

Post by jlgaddis »

dreae wrote: post #109
xorcist wrote: post #101

Earlier quoted context omitted.

Every user is free to run their own resolver or use any of their ISPs or third parties, which is pretty close to the definition of something decentralized.

Except, as others have pointed out, there are documented cases of ISPs hijacking DNS traffic, even for people who have configured their client to use resolvers other than their ISP, which is possible because of DNS's lack of authentication or encryption. Besides, I don't see how adding an option for DoH to Firefox is centralizing anything, you're free to set the DoH URL to whatever you like, and you're free to run yo…

> Besides, I don't see how adding an option for DoH to Firefox is centralizing anything ...

AUIU, this is currently disabled by default but will be enabled by default in the future.

When that switch is flipped, that's when the "centralizing" begins.

If this were to be disabled by default and forever remain that way, I would be perfectly fine with it.

Re: Inside Firefox’s DNS-over-HTTPS engine

#124

Post by jlgaddis »

Using Firefox 60.0.1 on Fedora 28, I just went into "about:config" and set "network.trr.mode" to "5" [0] since 1) I intentionally have local DNS servers that I wish to use and 2) I do not wish to send any more of my data to Cloudflare (as much as possible).

I thought this might be a good way to ensure that this behavior does not get turned on without my knowledge (whenever the time comes that Mozilla enables it by default).

Unfortunately, browsing broke immediately. I could not access any sites that I tried to access ("Hmm. We’re having trouble finding that site.") until I changed this setting back to the default ("0").

[0]: "Explicitly off. Also off, but selected off by choice and not default."

Re: Inside Firefox’s DNS-over-HTTPS engine

#125

Post by sildur »

codewithcheese wrote: post #31

I am in Indonesia where Reddit, Vimeo, The Pirate Bay and other sites are blocked. I just enabled TRR in Firefox 60 (They mention best support is in 62) and now I have full unblocked access to all those sites. Awesome.

Well, shame on you. All the armchair experts at hacker news say that the implementation is really bad and you should feel really bad for using it. So please stop using it and make them happy.

Re: Inside Firefox’s DNS-over-HTTPS engine

#126

Post by geofft »

peterwwillis wrote: post #99
geofft wrote: post #93

Earlier quoted context omitted.

One, SSH on port 443 is not the same thing as HTTPS on port 443 (I've seen systems that block the former and not the latter). Two, running a proxy to move all my browsing elsewhere seems like the hack. Changing the internet's norms so normal DNS is HTTPS-based, and everything just works everywhere for everyone, seems like a stable long-term solution.

Everything already works everywhere for everyone with regular DNS. The only thing that is broken is firewalls. Specifically, nobody wants to force network administrators to fix them, so instead they're trying to work around them. Not only is this unnecessary, it's stupid, and just a cheap workaround for something which should have been solved by the industry 18 years ago, but is now left to be wrangled by 3 companies…

> The only thing that is broken is firewalls. Specifically, nobody wants to force network administrators to fix them, so instead they're trying to work around them. Not only is this unnecessary, it's stupid, and just a cheap workaround for something which should have been solved by the industry 18 years ago, but is now left to be wrangled by 3 companies with leverage over users.

Solving this is known as "the robustness principle," aka "internet engineering." Expecting every device in between every two points on the internet to a) work reliably and b) not make questionable decisions about packets that it can parse has never worked. Successful internet protocols, e.g. TCP and HTTPS, are those which put the least reliance on the network to behave reasonably. Unsuccessful ones, e.g. IPv6, are the ones that put the most reliance on the network to behave reasonably.

It's true that the successful ones are nowhere as pretty as the unsuccessful ones. But for most people, success is more important.

Re: Inside Firefox’s DNS-over-HTTPS engine

#127

Post by wahern »

unethical_ban wrote: post #10
dogecoinbase wrote: post #6

Earlier quoted context omitted.

TRR doesn't read or care about /etc/hosts There's no way to exclude or white list specific domains Sigh. This is aggressively breaking normal DNS behavior (and will be an absurd hassle for a very large number of organizations, but in terms of extremely normal split-horizon and orgs with regulatory obligations to catch HTTPS traffic). Applications should not contain their own encapsulated resolvers, let alone resolver…

They're trying to improve the security of a fundamental protocol - if we waited for committees every time we wanted something new, we wouldn't have HTTP2, HTML5 or a dozen other technologies. I agree they shouldn't take away the "god-mode" /etc/hosts, which is only ever populated very intentionally by sysadmins and power users. If anything, that should be a flag just like the various modes of using TRR. And finally -…

What good is it? TLS SNI already exposes the domain name. Even if that is addressed in the far future, you still can't hide the IP addresses you're connecting to. The only real engineering problem with DNS is authentication, which is adequately solved (however poorly) with DNSSEC and operating systems shipping local resolvers.

Moreover, whatever promises CloudFlare and others make, they're still centralization points and therefore ripe targets for infiltration and exfiltration.

The moment browsers actually solve the privacy problem will be the moment 9/10ths of the internet goes poof and disappears along with their monetization strategies. As long as Google is viable then these are just tricks arguably doing more harm (increasing reliance on centralized vendors, increasing complexity of the software stack) than good.

Re: Inside Firefox’s DNS-over-HTTPS engine

#128

Post by wahern »

geofft wrote: post #22
dogecoinbase wrote: post #20

Earlier quoted context omitted.

No, you wanted encryption for DNS transport, and I completely agree with that desire. This is a terrible half-measure that bypasses many existing security precautions people have intentionally taken by default , and moreover exposes private data to a company with a history of handling such poorly.

I specifically want DNS over HTTPS - except for specialized use cases over known networks where every device in between is tested as behaving properly, protocols that aren't TLS (over TCP) are a hassle to me both as an end user and as a developer, because someone is going to break them. And once you have TLS, there's little benefit in using something other than HTTP inside, and a lot of benefit in using something whe…

You trust CloudFlare today. Tomorrow CloudFlare could become a Comcast subsidiary.

The willingness of people to put all their stock in a corporation with a promise of benign benevolence boggles my mind. I'm not particularly cynical, but I recoil at the notion that you'll now need an entire HTTP+TLS stack just to do DNS "properly", and that 99% of people will be using a single DNS provider.

EDIT: It's not even benign benevolence. I see that DOH includes server push. So now it's obvious how CloudFlare will monetize this--they're positioned to be able to push DNS updates directly to clients, reducing latencies when domain names change, particularly automated DNS topologies for load balancing, failover, etc. Reducing latencies, that is, if you're a paid CloudFlare customer.

Re: Inside Firefox’s DNS-over-HTTPS engine

#129

Post by crtasm »

geofft wrote: post #92
watermelon0 wrote: post #44

Earlier quoted context omitted.

If malware can modify /etc/hosts, then it shouldn't have any problems modifying Firefox executable or, even easier, it's configuration.

This is true, but most malware is neither high-effort nor high-quality. It's very easy to edit /etc/hosts. It's a lot harder to inject yourself into the binary in a way that works. It's harder still to inject yourself into the binary in a way that works if the binary is actively trying to not be injected into, or using some security-by-obscurity scheme for signing the config, or whatever. Yes, it's all running at the…

Yes but you don't need any of that in this case, Firefox's config files are easily editable to toggle am option like using DoH.

Re: Inside Firefox’s DNS-over-HTTPS engine

#130

Post by davidu »

zackbloom wrote: post #106
dannyw wrote: post #105

Earlier quoted context omitted.

My ISP in Australia already censors various domain names due to copyright lawsuits. ISPs tampering with DNS is not a red herring, but a real issue. Furthermore, ISPs in some countries like India forces all port 53 traffic to their own censored servers. DNS over TLS won’t solve that.

People also don't realize that their ISP literally sells their DNS traffic. There is a strong market for it, it's not theoretical.

Not really. There's not anything close to what I'd call a strong market for it.
Post reply on HN