Live data from Hacker News

Ask HN: Firefox connection problems after enabling DoH?

news.ycombinator.com

251–260 of 410 posts

Re: Ask HN: Firefox connection problems after enabling DoH?

#251
post #30

So what's strange here is that these hangs are weeks after Firefox 95.0.2 was released. That points to either DoH provider or some HTTP 3 server triggering the buggy behavior at scale. Either is fairly scary.

It looks like it probably was a client and server interaction. Somebody (Google, Cloudflare...) switching over more of there infrastructure to http3 triggered it in more clients.

Re: Ask HN: Firefox connection problems after enabling DoH?

#252
post #191
post #6

What worked for me was disabling HTTP3 support with the 'network.http.http3.enabled' key in about:config and then restarting Firefox. Seems like it's stuck in the 'SocketThread', repeatedly doing this: 2022-01-13 08:20:53.075936 UTC - [Parent 4106991: Socket Thread]: V/nsHttp Http3Stream::OnReadSegment count=333 state=4 [this=7f6e295623a0]

Interesting, it first hit me while I was browsing Youtube. I have been noticing aborted/stalled connections specifically on Youtube over the last week or so. I bet you they have http3 going. After upgrading to 96 today was the first time I got all new connections blocked.

Yes, I think it first hit me when I was updating gmail. I bet Google enabled something new on their services that Firefox didn't handle properly. (Without knowing any details, it could be that Google is actually doing something non-standards-compliant; but in any case FF should respond gracefully and not hang all connections, even those not going to Google.)

Re: Ask HN: Firefox connection problems after enabling DoH?

#253

Earlier quoted context omitted.

>It bypasses your hosts file It doesn't bypass my hosts file... I have a couple of locally hosted websites that I have rules in /etc/hosts for, and Firefox resolves them correctly even with DOH enabled.

It might be falling back to hosts for them or if they're ending with .local or .home, it's hitting hosts file first for them.

It's not, Firefox will still check your hosts file to see if it can resolve that way. DoH is used only if using a local-only resolver doesn't work to my knowledge. Otherwise stuff like SMBIOS, Avahi/ZC or mDNS would break too.

Re: Ask HN: Firefox connection problems after enabling DoH?

#254

It is time for Mozilla to stop messing around. They are losing user trust extremely fast. A silent FireFox update that cripples the browser? No active update was done since yesterday and this morning: a broken browser. Please stop non-browser development and let me pay a monthly fee for a decent browser! I don’t want a VPN service, bookmark readers or other crap. I want Mozilla to defend the open web and create an op…

> I don’t want a VPN service, bookmark readers or other crap.

Fortunately, you're just one person voicing your opinion in an unrelated corner of the Internet and you seem to be in the minority otherwise Mozilla would have made the changes you want already. Most other people either find those features useful or are indifferent about them. I, personally have no qualms with Mozilla doing what they do even if I might not use those features.

If you really want change, start contributing and bring it about yourself.

Re: Ask HN: Firefox connection problems after enabling DoH?

#255
post #184

Earlier quoted context omitted.

> What's going on at Mozilla is probably what's going to happen for Linux once Linus is out. > Both these pieces of open source software are way too big to be replicated now by a dude or a bunch of dudes and also way too big to be maintained by people on their free time. They require resources and organization which itself corrupt the original spirit. I doubt that one. There are a lot of big companies who employ the…

Having lots of corporations involved in something doesn't protect the direction it goes in. Corporate interests could easily, for example, try to start adding in closed source blobs or providing support for people doing so. In fact, when Linus is gone, they probably will. Software projects do seem to benefit from having firm voices empowered to say "no". Committees are incapable of doing that. Sooner or later they en…

Yep, this is what scares me too...

Commitees will be formed, instead of linux for the people, there will be corporate committees, then of course the diversity and quota ones, and in the end, "the one that pleases the sponsors"... The end results? Instead of Linus showing the middle finger to Nvidia (again), they will issue a statement, that "without contributers nvidia, we're unable to... yada yada", and binary blobs (or worse) will become part of the kernel.

Re: Ask HN: Firefox connection problems after enabling DoH?

#256
post #6

What worked for me was disabling HTTP3 support with the 'network.http.http3.enabled' key in about:config and then restarting Firefox. Seems like it's stuck in the 'SocketThread', repeatedly doing this: 2022-01-13 08:20:53.075936 UTC - [Parent 4106991: Socket Thread]: V/nsHttp Http3Stream::OnReadSegment count=333 state=4 [this=7f6e295623a0]

Not working for me.

closing all browser windows does not work. I had to `pkill firefox` and it works

Re: Ask HN: Firefox connection problems after enabling DoH?

#257

So, looking at the HTTP3 wikipedia page I see this: "HTTP/3 uses QUIC, a transport layer network protocol which uses user space congestion control over the User Datagram Protocol (UDP)." Ok. Is it still a thing with internet core routers that in case of congestion issues they drop datagram packets because they're not guaranteed to be delivered anyway?

That's correct, with HTTP3 active you are extremely vulnerable to your packets being dropped and other sorts of transport issues. The browser will ideally fall back to a different protocol if it identifies that your connection/routes/etc can't handle QUIC.

Re: Ask HN: Firefox connection problems after enabling DoH?

#258

I've found that AppArmor started to block Firefox: audit: type=1400 audit(1642063521.864:246): apparmor="DENIED" operation="ptrace" profile="snap.firefox.firefox" pid=9868 comm="Shutdow~minator" requested_mask="trace" denied_mask="trace" peer="snap.firefox.firefox" I really don't like it, but turning off Apparmor worked for me. Not sure what caused AppArmor to start complaining all of a sudden.

Your policy is blocking ptrace from processes that don't seem like they should need ptrace (very few processes need ptrace). So why would Firefox need ptrace? Some cursory googling suggests that ptrace is used for plugins and by the crash reporter.

There are apparmor profiles for Firefox, e.g. this one: https://github.com/nibags/apparmor-profiles/blob/master/appa... Maybe you could add it to your system and see if that fixes things.

Re: Ask HN: Firefox connection problems after enabling DoH?

#259

Earlier quoted context omitted.

Yes, but if it wasn't active then it might as well not have been. This is a great way to bypass continuity testing, I really pity all those people working the desks in hospitals right now using FireFox who are typically less savvy than your average HN'er in trying to get their work done. If you ship a browser with a time-bomb you are utterly irresponsible.

This isn't a time bomb, it's a symptom of the way modern browsers tend to have centralized I/O which means disk and network traffic goes through a single chokepoint. HTTP3 traffic appears to be able to cause one of Firefox's socket threads to hang, and since everything goes through it, all your network traffic is now dead. Chromium uses a similar model of routing all I/O through specific places, so it's vulnerable to…

It is because:

(1) I did not explicitly enable this

(2) The telemetry setting seems to have re-enabled itself on some update

(3) I don't want any services from Mozilla, I want a browser

(4) It worked until it blew up revealing that in fact, I suddenly did have service dependencies

And finally, the reason I use FireFox is exactly your last sentence, so to see that they are slipping this in under the radar is a pretty good reason to drop FF altogether, it looks as if they fail to understand the difference between shipping software and getting me hooked on some service that I am not even aware of existing. And on top of that re-enabling their telemetry when it was explicitly disabled. That really takes the cake.

Post reply on HN