"For more than 30 years, DNS has served as a key mechanism for accessing sites and services on the web."
I value dry jokes such as this.
NextDNS Joins Firefox’s Trusted Recursive Resolver
101–110 of 146 posts
Re: NextDNS Joins Firefox’s Trusted Recursive Resolver
#102Earlier quoted context omitted.
You have a contract with your ISP not to collect and monetize your DNS queries to their DNS servers? Are you in the US on a mainstream ISP? If so, you surely do not, unlike with the Mozilla TRR program, where you in fact do.
> You have a contract with your ISP not to collect and monetize your DNS queries to their DNS servers? You don’t ? Why would you sign up with such an ISP ? My ISP has a very clear privacy policy, and they obviously have to comply with the GDPR as well.
"My ISP has a very clear privacy policy"
I have to wonder: is anyone actually regularly auditing these companies to make sure they abide by their privacy policy?
I see lots of privacy policies all over the internet, but absolutely zero oversight.
Re: NextDNS Joins Firefox’s Trusted Recursive Resolver
#103“For most users, it’s very hard to know where their DNS requests go and what the resolver is doing with them.” said Eric Rescorla, Firefox CTO. “Firefox’s Trusted Recursive Resolver program allows Mozilla to negotiate with providers on your behalf and require that they have strong privacy policies before handling your DNS data. We’re excited to have NextDNS partner with us in our work to put people back in control of…
Also, the "back in control" language is interesting. It implies the author believes users were "in control" in the past. The "putting users in control" phrasing is classic Mozilla doublespeak marketing; Mozilla wants you to think Firefox is the only web browser under your complete control, when a look at their bug tracker and their reaction to all the changes that users have vehemently opposed shows the complete oppo…
[deleted]
Re: NextDNS Joins Firefox’s Trusted Recursive Resolver
#104This extreme focus on DoH is really concerning me. If you're worried about your recursive DNS resolver spying on you, the correct solution is to run your own recursive resolver. I've been running unbound(8) on my OpenBSD systems at home for most of 2019, and (except for the time that I experimented with turning on strict DNSSEC checking) there hasn't been even one time that it has caused me grief. It was as simple as…
Running your own non-DOH recursive server does absolutely nothing to protect your queries from snooping; in fact, it increases your exposure, because every single step in the recursive queries you run are now in plaintext on the wire and each attributable to your server. Running your own recursive DOH server is a fine idea, and easy to do, but then you have little to be angry at Mozilla about, because they're the one…
> The fact that no mainstream consumer OS runs a local recursive resolver should be a clear signal to you that people disagree with you about this; in particular, because doing so eliminates DNS caching, which is something most people want.
Doesn't DoH eliminate caching as well? It means all your queries go out to some server on the internet with perhaps 20-50ms of latency, instead of a local cache potentially on your LAN with The best thing might be to have internet gateways run a DNS stub that itself makes queries via DoH/DoT/whatever and then caches them for every device on the LAN. The gateway is typically the DHCP server so it can hand itself out as the DNS and requires no configuration as well. And then it works across all devices and applications.
Re: NextDNS Joins Firefox’s Trusted Recursive Resolver
#105Congratulations NextDNS! You've been relentlessly executing on every front [0] with super-novel solutions [1] that a few, if any, incumbents have matched [2]. That said, I'm surprised Mozilla doesn't look at the uptime metrics before partnering with TRRs. I've been using NextDNS ever since it was announced here [3] and have been subject to a fair share of "outages" including once when everyone at home thought the int…
It’s not clear to me AdGuard’s uptime avoids the “is the internet down?” scenario either.
I observe normals hitting same “WTFs/month” rate with AdGuard, NextDNS, Zscalar, Cleanbrowsing (built into Ubiquiti UniFi), as any other ad blocking DNS offering.
I personally had to give up on Warp+ and even 1.1.1.1 — which to be clear does not block ads or trackers — due to instability with enterprise, airline, and hotel portals.
By contrast, NextDNS shot up in reliability over past couple months across all kinds of connections, to where I’ve begun recommending that option to tech friends (not yet to normals).
I have had no issues with OpenDNS Umbrella now Cisco once I turned off their typo-squatting, but it also is a “security” product not anti-tracking.
Re: NextDNS Joins Firefox’s Trusted Recursive Resolver
#106“For most users, it’s very hard to know where their DNS requests go and what the resolver is doing with them.” said Eric Rescorla, Firefox CTO. “Firefox’s Trusted Recursive Resolver program allows Mozilla to negotiate with providers on your behalf and require that they have strong privacy policies before handling your DNS data. We’re excited to have NextDNS partner with us in our work to put people back in control of…
I could never think of why Mozilla and friends are so aggressively pushing DoH, but I think you nailed it when you pointed out they can tie a specific device's DNS requests to its other data. I run Unbound and Pi-Hole to do my own recursive resolving. Like a normal wireless router doing all the DNS lookups for its DHCP clients, Mozilla has no idea which particular device on my network is accessing duckduckgo.com. Onc…
> I run Unbound and Pi-Hole to do my own recursive resolving.
As documented by Mozilla, I made my network's DNS have use-application-dns.net return NXDOMAIN to opt out.
https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
My unbound config line is:
local-zone: "use-application-dns.net." staticRe: NextDNS Joins Firefox’s Trusted Recursive Resolver
#107Earlier quoted context omitted.
Running your own non-DOH recursive server does absolutely nothing to protect your queries from snooping; in fact, it increases your exposure, because every single step in the recursive queries you run are now in plaintext on the wire and each attributable to your server. Running your own recursive DOH server is a fine idea, and easy to do, but then you have little to be angry at Mozilla about, because they're the one…
> The fact that no mainstream consumer OS runs a local recursive resolver should be a clear signal to you that people disagree with you about this; in particular, because doing so eliminates DNS caching, which is something most people want. Doesn't DoH eliminate caching as well? It means all your queries go out to some server on the internet with perhaps 20-50ms of latency, instead of a local cache potentially on you…
[deleted]
Re: NextDNS Joins Firefox’s Trusted Recursive Resolver
#108Earlier quoted context omitted.
Probably the ISP, since it already has a working business model unrelated to selling your DNS query data and doing so is probably illegal in several countries.
The terms of the Trusted Recursive Resolver program explicitly disallow selling your DNS query data. > Your DNS data can reveal a lot of sensitive information about you, and currently DNS providers aren’t subject to any limits on what they can do with that data; we want to change that. Our policy requires that your data will only be used for the purpose of operating the service, must not be retained for longer than 2…
NextDNS purports to be a DNS provider that will use public blocklists and filter queries and block ads and tracking like a PiHole.
The Mozilla TRR policy states that the DNS provider must not filter any queries unless the user explicitly opts-in.
How would a user selecting NextDNS as a TRR indicate that she wants NextDNS to filter queries in order to block ads and tracking.
The TRR policy also states that the provider must not use the EDNS Client Subnet extension. It looks like NextDNS does use some modified version of ECS, at least in its plaintext DNS service.
The FAQ states users can submit a query with class CHAOS instead of IN to get some diagnostics, e.g.,
drill -t example.com @45.90.28.0 a chaos
Re: NextDNS Joins Firefox’s Trusted Recursive Resolver
#109Earlier quoted context omitted.
Luckily, I do believe that DNS query data has value, that's the reason I'm arguing against anti-privacy crap like DoH and have been since the beginning. If my arguments don't make sense to you, it's either because you lack understanding or have an agenda to push DoH. > I'm not sure what you think NetFlow records contain. I don't need to think what they contain, I implemented a netflow collector or two in the past.
Same! I was the product lead on Arbor Networks DOS product. How exactly is it that you think that a heavily sampled collection of IP addresses is equivalent to the exact names you type into a URL bar? The rest of your argument is just motte-and-bailey message board stuff. You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when yo…
Whether netflow is heavily sampled or not depends on where and how it is generated and for what purposes. It's just a format.
> You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak".
Never said any of that, but your remarks are still wrong. What I said is basically that at ISP level there is much more information about what you are doing than DNS queries, including information that allows to identify the websites you are visited. Again, just IP addresses alone identify more than 90% of websites (can't remember the exact number from the research, it's like 95% from alexa top 1 million).
Now with regards to privacy. First it's important to understand what privacy is actually about. Within your traffic there is a lot of meta and side channel-like information, some of the sources of that information overlap a lot or are even identical, a lot of redundant information. Like we can look at a packet with a DNS query and see domain name identifying a website. Or we can look at IP address of a packet initiating new connection, it won't identify every website uniquely, but it will most of them, to get to 95% we would need to also look at IP addresses of new connections following that connection, i.e. sub resources, making sort of an IP set fingerprint, either way single IP addresses or a fingerprint can be mapped to unique domains or a set of potential domains. To complete this example there is also SNI in plain text in packets and domain names in Host: headers, which also uniquely identify websites. So there is at least 3 sources of the same or almost the same information. What kind of privacy level is that? Well, we have a single party with access to the same relatively easily extractable information from multiple redundant sources, it's a lot to trust with. Would it change anything if remove any of the sources? Not really, it would have very insignificant effect on privacy since other sources are still available. And if we have to send that information to another party, now that would make things much worse, because now we would have to trust two parties with the same information, rather than one. Ok, so, how can we actually improve it? We can try to remove all three sources of information and send all of them through another party. This changes the party we have to trust, but we still have to trust it with just as much. What if we can't trust any party that much? Then the next choice is to shard (partition) that information to as many parties as we can. Trusting even just with half of that information to one party and half to another is already much better and is where we finally start scratching the surface of privacy. I hope it's clear that DoH is not helping with privacy, it just steals one of the sources of this information.
As for running local recursive DNS server instead of the one provided by an ISP, it isn't leaking significantly more information to anyone. Packets likely go through the same route and there is a bit more of them for queries that didn't hit the cache for few popular domains. IP address is also exposed in such DNS packets, but ISP's DNS server would be coming from an IP address that belongs to the same AS and this leaks almost the same amount of identifying information.
Re: NextDNS Joins Firefox’s Trusted Recursive Resolver
#110Earlier quoted context omitted.
Same! I was the product lead on Arbor Networks DOS product. How exactly is it that you think that a heavily sampled collection of IP addresses is equivalent to the exact names you type into a URL bar? The rest of your argument is just motte-and-bailey message board stuff. You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when yo…
Whether netflow is heavily sampled or not depends on where and how it is generated and for what purposes. It's just a format. > You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak". Never said any of that, but your remarks are still wrong. What I said…
You didn't answer the question; you just wrote a wall of text evading it. Obviously, running a local cache server isn't privacy-enhancing, despite anything you may have said upthread. Obviously, a sampled feed of NetFlow records isn't the same thing as the full-fidelity feed of every DNS name you searched for. Obviously, you're better off not giving that information to your ISP if you don't have to, and with DOH, you don't have to: you can pick the network from which your DNS queries will originate, most of which (if you don't run your own) will have contractual obligations not to log that no US ISP has.