Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

131–140 of 777 posts

Re: Mozilla’s DNS over HTTPs

#131

Post by the_angry_angel »

rndgermandude wrote: post #66
aduitsis wrote: post #43

If you are a network administrator and want none of this, look at that: https://support.mozilla.org/en-US/kb/canary-domain-use-appli... Basically, make use-application-dns.net. return an error (any kind will do). Filter it in your recursor for example. Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. If nothing else, it is the network administrator who should hav…

>Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. No, this is far too broad of a statement. Browsers pushing for TLS, deprecating the old SSL versions and now the old TLS versions, deprecating SHA1 use in certificates, going from quirksmode to a living html standard (not without problems such as Google's over-influence), etc all have been a net positive, but ther…

> but rejecting any kind of innovation isn't something I am willing to do.

I don't think the post you're replying to is really saying "no innovation". I think it's more subtle.

The "problem" with DoH is that you need to look at it with several different hats, and I feel very few people make it clear how they're complaining about DoH.

* From a consumer perspective DoH is a good thing (mostly)

* From an traditional/enterprise/business-like environment perspective it's inserting itself in the middle of the stack and may cause headaches with a few things (not limited to leaking internal names to external resolvers), unless it's just blanket disabled/forced to a local server (which may not always be practical for different reasons) - currently

Ultimately who do we have to blame for this but ourselves? Organisations have tried to get encrypted DNS off the ground in traditional DNS infrastructure and clearly failed to meet the required timeline.

I personally feel like the problem, just like with IPv4, is that traditional DNS infrastructure is "fine" (i.e. it works). We don't have a great motivation but we do have fear of breaking the many many many boxes which are un-upgradeable/critical.

Re: Mozilla’s DNS over HTTPs

#132

Post by kibwen »

nicolaslem wrote: post #17
drenginian wrote: post #3

Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.

My main gripe is that before DoH, setting a custom DNS via DHCP was enough to get all devices on a network and all applications on these devices to use a custom DNS. Now we are headed to a future where each software vendor decides how to make DNS queries. I can predict that all of them will apply their own custom heuristics to detect things like split-horizon.

We are headed toward that future because the broader network has proven that it cannot be trusted; it should come as no surprise that user agents would develop defense mechanisms. If this is another step toward ensuring that ISPs are nothing but dumb pipes, I welcome it.

Re: Mozilla’s DNS over HTTPs

#133

Post by jsjddbbwj »

drenginian wrote: post #3

Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.

I am not down on doh, I'm down on the possibility of Mozilla sending my DNS queries (ie my entire browsing history) to a company I haven't signed a contract with.

And I say the possibility because I'm not American so that's not enabled here (yet). But I trust my ISP and my government much more than I trust Cloudflare (zero) and I will be very disappointed (even more than I already am) at Mozilla if they enable it in the rest of the world.

Re: Mozilla’s DNS over HTTPs

#134

Post by ru552 »

throw0101a wrote: post #129
mantap wrote: post #116

Earlier quoted context omitted.

That doesn't work anymore. ISPs are not going to block AWS IP ranges or Azure IP ranges, etc. The cloud killed IP blocking. The pirate bay is supposed to be blocked in UK by court order , but because they use cloudflare it's still accessible and only DNS blocked.

> ISPs are not going to block AWS IP ranges or Azure IP ranges, etc. Tell that to China, Iran, Turkey (?), etc.

Ok, authoritarian regimes not included

Re: Mozilla’s DNS over HTTPs

#135

Post by kibwen »

josteink wrote: post #21
drenginian wrote: post #3

Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.

DNS is something network operators (and not just governments and ISPs) has managed and controlled in their own networks for decades . It has been part of the network stack, with a clear hierarchy in how it is governed: - network operator - network default - operating system - application default - end-user override - when the defaults doesn't work When something has not worked, you could reliably assume this was the…

> end-user override - when the defaults doesn't work

To my mind, the lack of privacy of classic DNS does indeed count as the the defaults failing to work. Yes, it would be more ideal to solve this at the OS level, but until OS vendors start providing solutions I don't begrudge applications that care about privacy for taking matters into their own hands.

Re: Mozilla’s DNS over HTTPs

#136

Post by rndgermandude »

aduitsis wrote: post #130
rndgermandude wrote: post #66

Earlier quoted context omitted.

>Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. No, this is far too broad of a statement. Browsers pushing for TLS, deprecating the old SSL versions and now the old TLS versions, deprecating SHA1 use in certificates, going from quirksmode to a living html standard (not without problems such as Google's over-influence), etc all have been a net positive, but ther…

The elephant in the room is that many networks need to have content filtering, and you are proposing nothing useful. DoH torpedoes content filtering to its very core and, fortunately, the knob Mozilla provides can (hopefully) be utilized. That's all there's to it.

>The elephant in the room is that many networks need to have content filtering

First of all, we're talking about domain filtering, not content filtering.

And no, they want domain filtering, hardly anybody needs it, and there are better solutions than NXDOMAIN, such as actual content filters.

>and you are proposing nothing useful.

Why would I need to provide "something useful"? mozilla already described the many ways this can be disabled, from browser preferences, to automated checks for known disable-me domains, etc.

Re: Mozilla’s DNS over HTTPs

#137

Post by zeveb »

Spivak wrote: post #128
zeveb wrote: post #117

Earlier quoted context omitted.

AT&T and Spectrum do not administer your home network, you do. You have the freedom to configure whatever DNS settings you want; if you wish to use their DNS servers you may; if you wish not to, then you may not. DoH is a non-solution to a non-problem which makes privacy strictly worse by leaking information to Cloudflare in addition to one's ISP.

You are a client on AT&T and Spectrum's network. Just because you turn on a router and set up NAT doesn't make this fact any less true. At some point your internet traffic is going to flow AT&T's network where they are the administrators and are free to apply whatever network policy they see fit. DoH and DoT is a solution to the problem of sending your DNS requests unencrypted, leaking them to everyone in the process…

I agree with you: your local network is free to set up a resolver using DoH (or DoT, which is far more sane than an entire HTTPS connexion). That's the correct place for it to live, or possibly at the individual device level.

It is 100% not the place of an application to meddle with network services, particularly not by default.

Re: Mozilla’s DNS over HTTPs

#138

Post by zzzcpan »

hunter2_ wrote: post #94
im3w1l wrote: post #26

Earlier quoted context omitted.

The ISP can just check which IP you contact, so I don't see this increasing privacy.

For some (large, especially) sites, the IP address maps to the entity you're trying to contact. For others (small, especially) sites, the IP address is shared among many entities... not just shared origin hosts but also the massive reverse proxies of the world (Cloudflare, etc.).

There is an actual research on this. More than 90% of alexa's top 1 million websites (more like 95% or so) are uniquely identifiable just by IP addresses you connect to when you visit them. This is not a single IP address per website, but multiple, because websites include subresources with other IP addresses to connect to.

On top of that, there is a pressure on CDNs and clouds to make websites stick to specific IP addresses and make them blockable by IP addresses without affecting other customers. So far they have proven to not go against this pressure and even made technical solutions to aid governments to identify websites by IP addresses, in particular by fixing L7 routing layer to block domain fronting (which is important, because ESNI is basically domain fronting, but crappy, and the pressure didn't go anywhere, so there is the same pressure to make sure ESNI doesn't interfere with identification of websites you are visiting).

Re: Mozilla’s DNS over HTTPs

#139

Post by teekert »

larrysalibra wrote: post #44

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…

Huh? It works for me in the Netherlands, at least, it is in the settings. How to confirm if I'm using it?

Re: Mozilla’s DNS over HTTPs

#140

Post by throw0101a »

jedieaston wrote: post #58
ComputerGuru wrote: post #45

Earlier quoted context omitted.

All that does is block DoH entirely, right? Not allow me to say “use this DoH server” or “don’t use DoH for this domain.”

Here are the instructions to do it, straight from Mozilla: https://support.mozilla.org/en-US/kb/firefox-dns-over-https#...

On Windows, you can probably do this via GPOs. How does one configure a fleet of Mac or Linux machines? How does one do it with BYOD or on a campus of students' machines?

Perhaps some thought as to service discovery should have been done:

* https://tools.ietf.org/html/rfc6763

If Mozilla is going to re-invent the wheel (OSes already do DNS look ups), they perhaps should have asked the DNS folks (e.g., DNS-OARC) about some of the corner/use cases IMHO.

Post reply on HN