Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

81–90 of 777 posts

Re: Mozilla’s DNS over HTTPs

#81

Post by zaarn »

ComputerGuru wrote: post #56
Jonnax wrote: post #48

Earlier quoted context omitted.

I think if you want to get that detailed you'd be pushing a custom managed Firefox profile.

You have twenty different applications using DoH for “increased security” and you need a custom profile for each? Why not a single line in resolv_doh.conf?

What local resolver supports resolv_doh.conf at this time?

At the moment, Mozilla wants to push this for users where DoH just works, for people it doesn't providing options to disable it.

Once resolv_doh.conf becomes a thing for all platforms (Linux, OSX and Windows) they can use that.

Re: Mozilla’s DNS over HTTPs

#82

Post by userbinator »

Jonnax wrote: post #74
userbinator wrote: post #64

Earlier quoted context omitted.

I'm not a network admin working in a business, but I am the network admin of my home network, and I really do not want applications starting to effectively contain their own VPN clients and subverting my control.

DNS isn't a VPN nor really a security product. It's just a look up table. The job blocking domains should be the job of a firewall. Of course this becomes more complex. But any application can implement DNS over HTTPS. Malware could even just get a list of IPs from another IP. An application can even just hard code IPs rather than using DNS and then they're in the same position.

Tunneling DNS inside HTTPS effectively forms part of a VPN already (and I wonder when Mozilla will decide to also stuff the rest of the traffic through...)

DNS-based blocking is not perfect, but is currently still very powerful for things like adblocking.

You're basically saying that Firefox is now behaving like malware, which I agree with...

Windows 10's telemetry is also another piece of software which has started to become hostile in this manner, hardcoding IPs and such.

Re: Mozilla’s DNS over HTTPs

#84

Post by lovelearning »

As a resident of a country whose government and ISPs heavily and habitually censor the Internet for political reasons, I for one truly appreciate Firefox's DoH. They should also enable 'network.security.esni.enabled' by default because the censors here have upgraded from DNS to SNI-based blocking. I get it that better solutions are possible, but got to teach people to first walk before teaching them to run. AFAIK, Chrome still doesn't support this kind of simple user-friendly privacy options for the average non-technical user.

Re: Mozilla’s DNS over HTTPs

#85

Post by BiteCode_dev »

Cloud flare is American and we know since the PRISM scandal that US based tech companies are directly plugged into the NSA, and everybody in the chain will deny it under the threat of prison.

So, if this rolls out 'as-is' in any other country than the US, we will go from "all DNS requests are clear text, but dispatched among many entities" to "DNS requests are encrypted, but all read and controlled by american agencies".

We (may) have gain (some) privacy (maybe). But we also (certainly) gained a serious dependency.

Re: Mozilla’s DNS over HTTPs

#86

Post by tomashubelbauer »

josteink wrote: post #24

Can someone at Mozilla explain why they present what is purely textual content as a PNG? I mean, this is ridiculous: https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/net...

Apparently, screen reader users do not deserve to be able to learn about the future of the web Mozilla is envisioning.

Re: Mozilla’s DNS over HTTPs

#87

Post by Aissen »

josteink wrote: post #24

Can someone at Mozilla explain why they present what is purely textual content as a PNG? I mean, this is ridiculous: https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/net...

The fun part is that this seems to have been copied from an HTML FAQ and a link "see relevant documentation here" has simply disappeared in the process.

Re: Mozilla’s DNS over HTTPs

#88

Post by johnp_ »

josteink wrote: post #24

Can someone at Mozilla explain why they present what is purely textual content as a PNG? I mean, this is ridiculous: https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/net...

It even seems to break inline links, like in the "split-horizon" section:

> System administrators can find relevant documentation here.

I'm pretty sure "here" should be a link, but of course that doesn't work when the marketing department uses a PNG instead of HTML.

I'm also surprised that Mozilla / the CDN don't optimize the PNG. `zopflipng` reduces the size from 285K to 153K.

And of course it's named "Final-DNS-over-HTTPS-05-1.png".

Re: Mozilla’s DNS over HTTPs

#89

Post by hunter2_ »

nothrabannosir wrote: post #6
Vinnl wrote: post #2

I think this is generally a good thing. Two questions I've often seen surface on HN though weren't answered: 1. Isn't this better implemented at the OS level? 2. Isn't centralisation to two DoH providers more centralised than five large ISPs? Others are probably better suited to answer, but the answers I can think of: 1. Yes, but it is not, so this solution is second-best. If Operating Systems decide to tackle this p…

FWIW, wrt 1: you can use dnscrypt and a bitbar plugin to have this at the OS level on Mac. It’s a faff to setup but once it works it really does work. https://www.dnscrypt.org/ Optional for menu icon: https://getbitbar.com/ and https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher

I think 1 is about OS defaults, not stuff users must know to do. People knowledgeable about privacy could always bolt things on, and that's quite orthogonal to this discussion. Rather, this is all about the people who do no installation/configuration beyond an OS and a browser.

Re: Mozilla’s DNS over HTTPs

#90

Post by im3w1l »

ekimekim wrote: post #60
im3w1l wrote: post #26

Earlier quoted context omitted.

The ISP can just check which IP you contact, so I don't see this increasing privacy.

This is addressed in TFA: The fact that there are multiple problems and solving any one of them doesn't help much until they're all solved, should not be an excuse to refuse to solve any of them.

So you have a "solution" that doesn't really solve the problem, and also create a new privacy problem (now cloudflare has your data too). Hence it's actually a privacy loss.
Post reply on HN