Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

401–410 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#401

Post by cpeterso »

Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

Firefox HTTPS-Only Mode is not enabled by default. The mode just shows the user an interstitial warning when navigating to non-HTTPS sites; the user is not blocked from visiting non-HTTPS sites.

Re: Firefox 83 introduces HTTPS-Only Mode

#402

Post by Sodman »

jorl17 wrote: post #188
Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

I would love to see a version of www.paulgraham.com covered in FB ads for jobs at megacorps...

Re: Firefox 83 introduces HTTPS-Only Mode

#403

Post by ajyey »

"When Firefox autocompletes the URL of one of your search engines, you can now search with that engine directly in the address bar by selecting the shortcut in the address bar results."

This is what I've been missing from chrome!

Re: Firefox 83 introduces HTTPS-Only Mode

#404

Post by josephcsible »

cptskippy wrote: post #297
kd913 wrote: post #161

Earlier quoted context omitted.

Firefox DoH easily works with DNSCryptProxy. https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH You can easily set it up to contact that, but enable some exclusions for specific domains if you wish to fallback to pihole. It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway.

> It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway. Pihole operates at the network level. It can block Windows Telemetry, ads on your Roku, smart devices trying to phone home, etc. Any guest devices that connect to your network also benefit without you having to install blockers on them. It's not a replacement for ublock, it's used in conjunctio…

Your Pi-hole working on other people's devices is a bad thing. After all, there's nothing stopping you from configuring your Pi-hole to filter political content you disagree with instead of just ads, trackers, and malware.

Re: Firefox 83 introduces HTTPS-Only Mode

#405

Post by chrismorgan »

doublerabbit wrote: post #226
chrismorgan wrote: post #111

Earlier quoted context omitted.

“Mode” means “a way that it can operate”.

"optional mode" problem solved.

“HTTPS-Only Optional Mode” reads terribly and is much more subject to confusion than “HTTPS-Only Mode” was.

Re: Firefox 83 introduces HTTPS-Only Mode

#406

Post by manquer »

bscphil wrote: post #300
manquer wrote: post #135

Earlier quoted context omitted.

You are able to run own network and have the know how to do so, typical physical Firefox users cannot. Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox. Also many…

> Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox. I have mixed feelings about the issue, but it's not that simple. I run a variety of services on my LAN for my u…

If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered

From Mozilla documentation.

   "localhost" and names in the ".local" TLD will never be resolved via DOH. [1]
Lan based services are pretty common use case. Mozilla is hardly going to release this feature without considering this.

The Cloudflare / Archive.is point is esoteric debate and not a common occurence, DoH does support other providers than Cloudflare so not sure if this really a major concern

[1] https://wiki.mozilla.org/Trusted_Recursive_Resolver

Re: Firefox 83 introduces HTTPS-Only Mode

#407

Post by strifey »

ajyey wrote: post #403

"When Firefox autocompletes the URL of one of your search engines, you can now search with that engine directly in the address bar by selecting the shortcut in the address bar results." This is what I've been missing from chrome!

Oh wow, this is huge! Ever since switching back to FF, I constantly forget what my "shorthand" shortcut is for my custom search engines.

Re: Firefox 83 introduces HTTPS-Only Mode

#408

Post by manquer »

iso1631 wrote: post #231
judge2020 wrote: post #212

Earlier quoted context omitted.

A lot of networks block VPNs via port number + DPI, but can't really block DNS over HTTPS if it looks like a connection to any other HTTPS website.

Yes, which is why my VPNs are available on port 443 and 53, including a TLS based VPN. Now port 53 can and often is intercepted (but sometimes it gets through when 443 doesnt)

it does not matter under what port including 443 you are running the service, deep packet inspection (DPI) can sniff out VPN traffic, perhaps you may not encountered this type of firewall as it somewhat more expensive to run both computationally and licensing wise.

It is not possible to sniff out DoH traffic via DPI as looks exactly the same as regular traffic

While running flash servers for media use in corporate environment (when flash was still a thing) back I used to run into similar problems with RTMP/ RTMPS constantly.

Re: Firefox 83 introduces HTTPS-Only Mode

#409

Post by bscphil »

manquer wrote: post #406
bscphil wrote: post #300

Earlier quoted context omitted.

> Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox. I have mixed feelings about the issue, but it's not that simple. I run a variety of services on my LAN for my u…

If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered From Mozilla documentation. "localhost" and names in the ".local" TLD will never be resolved via DOH. [1] Lan based services are pretty common use case. Mozilla is hardly going to release this feature without considering this. The Cloudflare / Archive.is point is esoteric debate and not a common…

> If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered

I don't think PFsense + Unbound supports appending .local to every hostname automatically, so I'd have to change every last one of my hostnames to whatever.local and that seems like a real pain. (Surely most people are not using whatever.local in their /etc/hostname, right?)

> The Cloudflare / Archive.is point is esoteric debate and not a common occurence, DoH does support other providers than Cloudflare so not sure if this really a major concern

Sure, but my general point is that there's all sorts of different reasons why it can be useful for a LAN administrator to override the remote DNS response in certain specific cases. Given that Firefox is using Cloudflare by default, the fact that you can change it also doesn't really help anything, since after all the thing I'm specifically complaining about is that stuff randomly breaks for any of your guests using Firefox.

Re: Firefox 83 introduces HTTPS-Only Mode

#410

Post by eikenberry »

josephcsible wrote: post #351
iso1631 wrote: post #346

Earlier quoted context omitted.

So you are suggesting we further centralising the web to avoid censorship and surveilance?

How is this further centralising the Web? You can still use whatever DoH provider you want (and there's plenty of them); the choice just shouldn't be tied to the network you're on.

But you don't want it tied to a specific application either. It should be an OS level setting that lets you configure what DNS to use based on circumstance. This is possible today for power users (on Linux at least) and wouldn't be hard to implement for normal users.
Post reply on HN