Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NextDNS Joins Firefox’s Trusted Recursive Resolver

blog.mozilla.org

Post reply on HN
Print view View original

111–120 of 146 posts

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#111

Post by zzzcpan »

tptacek wrote: post #110
zzzcpan wrote: post #109

Earlier quoted context omitted.

Whether netflow is heavily sampled or not depends on where and how it is generated and for what purposes. It's just a format. > You started out saying that running your own local recurser is privacy-enhancing (it's the opposite) and that ISPs can see your DNS queries when you run DoH (they can't) and retreated to a position of "other things leak". Never said any of that, but your remarks are still wrong. What I said…

You didn't answer the question; you just wrote a wall of text evading it. Obviously, running a local cache server isn't privacy-enhancing, despite anything you may have said upthread. Obviously, a sampled feed of NetFlow records isn't the same thing as the full-fidelity feed of every DNS name you searched for. Obviously, you're better off not giving that information to your ISP if you don't have to, and with DOH, you…

> Obviously, you're better off not giving that information to your ISP if you don't have to, and with DOH, you don't have to:

This is incorrect. DoH doesn't take away that information, DoH only takes away one source of that information, other sources are still available to your ISP. So adding DoH to the mix simply forces you trust more parties with the same amount of information. There is just no way around it. DoH is simply not for privacy.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#112

Post by pvg »

zrm wrote: post #104
tptacek wrote: post #78

Earlier quoted context omitted.

Running your own non-DOH recursive server does absolutely nothing to protect your queries from snooping; in fact, it increases your exposure, because every single step in the recursive queries you run are now in plaintext on the wire and each attributable to your server. Running your own recursive DOH server is a fine idea, and easy to do, but then you have little to be angry at Mozilla about, because they're the one…

> The fact that no mainstream consumer OS runs a local recursive resolver should be a clear signal to you that people disagree with you about this; in particular, because doing so eliminates DNS caching, which is something most people want. Doesn't DoH eliminate caching as well? It means all your queries go out to some server on the internet with perhaps 20-50ms of latency, instead of a local cache potentially on you…

Doesn't DoH eliminate caching as well?

Why would it eliminate caching? If you resolve over DoH you can still cache. It's not like turning DoH on in FireFox forces it to stop caching.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#113

Post by alwillis »

dessant wrote: post #45
3xblah wrote: post #29

“For most users, it’s very hard to know where their DNS requests go and what the resolver is doing with them.” said Eric Rescorla, Firefox CTO. “Firefox’s Trusted Recursive Resolver program allows Mozilla to negotiate with providers on your behalf and require that they have strong privacy policies before handling your DNS data. We’re excited to have NextDNS partner with us in our work to put people back in control of…

I think the endgame is to route everything through Tor or a similar anonymizing layer, nothing else will suffice in the face of pervasive tracking. Incidentally, Mozilla is showing interest in embedding Tor in Firefox [1], but they haven't yet publicly commited to it [2]. [1] https://www.zdnet.com/article/mozilla-offers-research-grant-... [2] https://www.techradar.com/news/firefox-isnt-getting-a-tor-pr...

Brave has a better track record and Tor built-in: https://brave.com/

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#114

Post by ViViDboarder »

heavyset_go wrote: post #27

I'm a fan of DoH, but I'm also a Chromecast owner, so I get to experience the downsides of application-level DNS resolvers. Chromecasts will ignore the DNS servers set by DHCP, and will cease to function if they cannot communicate with Google's DNS servers[1]. That means my network-enforced DNS preferences that block ad and malware sources are ignored, and I see more ads than I want to. It also means that when Google…

What Chromecast devices did they drop support for? I have a Gen 1 Chromecast and it still works just fine.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#115

Post by zrm »

pvg wrote: post #112
zrm wrote: post #104

Earlier quoted context omitted.

> The fact that no mainstream consumer OS runs a local recursive resolver should be a clear signal to you that people disagree with you about this; in particular, because doing so eliminates DNS caching, which is something most people want. Doesn't DoH eliminate caching as well? It means all your queries go out to some server on the internet with perhaps 20-50ms of latency, instead of a local cache potentially on you…

Doesn't DoH eliminate caching as well? Why would it eliminate caching? If you resolve over DoH you can still cache. It's not like turning DoH on in FireFox forces it to stop caching.

In that sense neither would putting a recursive resolver in your OS.

DNS can have arbitrarily many levels of caching, because stub resolvers can be caches and can point to other stub resolvers.

For example, you might have a DNS cache in your OS so that if more than one process asks to resolve the same name (or the same process asks more than once because it doesn't have internal caching), only one query has to be made. That resolver may point to a DNS cache on your LAN (deduplicating queries between devices), which in turn may point to a recursive resolver on the internet, which may itself be caching data from the authoritative servers.

If you replace that with DoH between the application and the recursive resolver on the internet, all the intermediary caches are eliminated, even though they might have had significantly lower response times than the resolver on the internet.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#116

Post by pvg »

zrm wrote: post #115
pvg wrote: post #112

Earlier quoted context omitted.

Doesn't DoH eliminate caching as well? Why would it eliminate caching? If you resolve over DoH you can still cache. It's not like turning DoH on in FireFox forces it to stop caching.

In that sense neither would putting a recursive resolver in your OS. DNS can have arbitrarily many levels of caching, because stub resolvers can be caches and can point to other stub resolvers. For example, you might have a DNS cache in your OS so that if more than one process asks to resolve the same name (or the same process asks more than once because it doesn't have internal caching), only one query has to be mad…

I'm not quite following all of this but before I try to sort it out in detail, is the fundamental objection here 'a DOH-using app is not using the OS resolver'?

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#117

Post by zrm »

pvg wrote: post #116
zrm wrote: post #115

Earlier quoted context omitted.

In that sense neither would putting a recursive resolver in your OS. DNS can have arbitrarily many levels of caching, because stub resolvers can be caches and can point to other stub resolvers. For example, you might have a DNS cache in your OS so that if more than one process asks to resolve the same name (or the same process asks more than once because it doesn't have internal caching), only one query has to be mad…

I'm not quite following all of this but before I try to sort it out in detail, is the fundamental objection here 'a DOH-using app is not using the OS resolver'?

That is effectively what causes the issue. The local resolver in the OS or on the LAN may have the name cached (because some other application or device requested it previously) and is thereby able to respond in <1ms, but if the application doesn't use them it has to take a round trip to the internet.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#118

Post by pvg »

zrm wrote: post #117
pvg wrote: post #116

Earlier quoted context omitted.

I'm not quite following all of this but before I try to sort it out in detail, is the fundamental objection here 'a DOH-using app is not using the OS resolver'?

That is effectively what causes the issue. The local resolver in the OS or on the LAN may have the name cached (because some other application or device requested it previously) and is thereby able to respond in <1ms, but if the application doesn't use them it has to take a round trip to the internet.

Ah I see. I don't find it particularly convincing as a thing leveled at DoH specifically because apps have been doing this for years. Browsers, Electron apps, Unity apps, whatnot. All have lived happy and successful lives without lookup latencies or the internet-as-we-know-it suffering any obvious ill effects. It's not a meaningful critique of DoH because we know the problems the critique warns of haven't really been problems.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#119

Post by zrm »

pvg wrote: post #118
zrm wrote: post #117

Earlier quoted context omitted.

That is effectively what causes the issue. The local resolver in the OS or on the LAN may have the name cached (because some other application or device requested it previously) and is thereby able to respond in <1ms, but if the application doesn't use them it has to take a round trip to the internet.

Ah I see. I don't find it particularly convincing as a thing leveled at DoH specifically because apps have been doing this for years. Browsers, Electron apps, Unity apps, whatnot. All have lived happy and successful lives without lookup latencies or the internet-as-we-know-it suffering any obvious ill effects. It's not a meaningful critique of DoH because we know the problems the critique warns of haven't really been…

You're naming some things that have notoriously bad performance. Being slow doesn't guarantee failure but it sure isn't a feature.

And the problem isn't the protocol here, it's the choice of resolver. If the resolver on your LAN made queries using DoH instead of the application itself then your ISP still couldn't read them, but you would regain the benefits of local caching.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#120

Post by pvg »

zrm wrote: post #119
pvg wrote: post #118

Earlier quoted context omitted.

Ah I see. I don't find it particularly convincing as a thing leveled at DoH specifically because apps have been doing this for years. Browsers, Electron apps, Unity apps, whatnot. All have lived happy and successful lives without lookup latencies or the internet-as-we-know-it suffering any obvious ill effects. It's not a meaningful critique of DoH because we know the problems the critique warns of haven't really been…

You're naming some things that have notoriously bad performance. Being slow doesn't guarantee failure but it sure isn't a feature. And the problem isn't the protocol here, it's the choice of resolver. If the resolver on your LAN made queries using DoH instead of the application itself then your ISP still couldn't read them, but you would regain the benefits of local caching.

They don't have 'notoriously bad performance' because of DNS or lack of some sort of global DNS caching. That just isn't the case. Firefox also didn't honour systemwide proxy settings for a decade+, nobody really cared because it fundamentally didn't matter. If the DNS thing was that important, somebody would have complained about it before. Nobody (statistically) ever did, any more than they did about the proxy thing.
Post reply on HN