Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

161–170 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#161

Post by kd913 »

3np wrote: post #133
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I have mixed feelings about what you wrote. 100% with you that by itself, browser HTTPS-only mode (even by default) is A Good Thing. In isolation, this is a no-brainer and Mozilla's doing the right call. I'm not happy with DoH though, at all. I fall in the crowd who wants to control my own DNS on my own devices (and I do realize that for those less technically knowledgeable, the status quo is putting that in the hand…

Firefox DoH easily works with DNSCryptProxy. https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH

You can easily set it up to contact that, but enable some exclusions for specific domains if you wish to fallback to pihole.

It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway.

Re: Firefox 83 introduces HTTPS-Only Mode

#162

Post by iso1631 »

manquer wrote: post #135
iso1631 wrote: post #113

Earlier quoted context omitted.

I run my own networks and my own devices, I choose what options go in my DHCP server If I were on a hostile network (say a hotel), then sure, I'll ignore their DNS server and use my own (or indeed just punch my way out via a VPN), but most of the time I use friendly networks, and I don't want to have to configure 20 different applications on a dozen different boxes to use a DNS provider of my choice. There's a reason…

You are able to run own network and have the know how to do so, typical physical Firefox users cannot. Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox. Also many…

If your network allows TLS to an arbitary DOH server it allows VPN over TLS to an arbitrary server

Re: Firefox 83 introduces HTTPS-Only Mode

#163

Post by 2ion »

ignoramous wrote: post #151
iso1631 wrote: post #87

Earlier quoted context omitted.

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

> I want my OS to do DNS - including DOH, not my browser. The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).

> The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions.

But tunnelling X in Y is not new at all and has a long tradition (even in regular protocol design). Is this really a shift waiting to happen in malware? As I would think, this has been available all along. Except for browser-based malware.

Re: Firefox 83 introduces HTTPS-Only Mode

#165

Post by pabs3 »

jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

HTTPS Everywhere already supports a HTTPS-only mode called EASE, it is opt-in though.

Re: Firefox 83 introduces HTTPS-Only Mode

#166

Post by pabs3 »

abraxaz wrote: post #34

Great to see this built into firefox, I have been using HTTPS Everywhere https://www.eff.org/https-everywhere to achieve similar results, it won't warn you if it is not https (i think) but it will try and upgrade to https if it can. It is available for chrome and firefox. What particularly annoyed me was using http to sites which supported https.

HTTPS Everywhere already supports a HTTPS-only mode called EASE, it is opt-in though.

Re: Firefox 83 introduces HTTPS-Only Mode

#167

Post by jacquesm »

afiori wrote: post #145
jacquesm wrote: post #125

Earlier quoted context omitted.

Tables are better as well in the sense that they are a higher level representation than divs. The problem was that people were then using tables as a way to layout pages rather than to use them to display tabular data.

I think it is deeper, the problem is that HTML tables are serialized in row and columns separately, so for example if you wanted a cell to be 2 rows tall and 2 columns wide there wasn't a local change that could allow it. To my understanding CSS Grid is meant to solve this

Yes there was: colspan.

Re: Firefox 83 introduces HTTPS-Only Mode

#168

Post by GuB-42 »

m_eiman wrote: post #53

It's obvious I need to spend more time researching Gemini and similar things. The "web" is going to be a true monoculture very, very soon.

Gemini is a monoculture. They almost say it in the FAQ:

> 2.5 Why not just use a subset of HTTP and HTML?

> [...] The problem is that deciding upon a strictly limited subset of HTTP and HTML, slapping a label on it and calling it a day would do almost nothing to create a clearly demarcated space where people can go to consume only that kind of content in only that kind of way. [...]

The protocol itself has very strong opinions on what is allowed and what is not. It is simple but mandates TLS (so, not simple), because authors think encryption is important but other things are not. It is also deliberately non-extensible.

Not saying it is a bad thing, I mean, they didn't hurt anyone. But that protocol is clearly intended as a rallying point for like-minded individuals rather than something for everyone to use.

Re: Firefox 83 introduces HTTPS-Only Mode

#169

Post by crazypython »

Not every web service is easy to set up with HTTPS as a simple Let's Encrypt service. Take a game. It dynamically balances between servers rented and destroyed on the fly. It needs a wildcard DNS certificate. Then all the sub-servers need to have that wildcard certificate.

In conclusion, deprecating HTTP makes it harder for people to get started on the web. How are you going to get certificates for IP address' control dashboard, after all?

Re: Firefox 83 introduces HTTPS-Only Mode

#170

Post by nine_k »

iso1631 wrote: post #160
ignoramous wrote: post #151

Earlier quoted context omitted.

> I want my OS to do DNS - including DOH, not my browser. The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).

I've always assumed any device or program I don't control will bypass anything I tell it to use and tunnel all it's evil traffic. It does feel the world is moving away from a multi-level network to run everything over TLS/TCP (and probably eventually mainly TLS/UDP), taking away the power from me as a network and device owner, and giving it to the developers

If only the OS could terminate TLS and allow to filter decrypted traffic locally.
Post reply on HN