Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NextDNS Joins Firefox’s Trusted Recursive Resolver

blog.mozilla.org

Post reply on HN
Print view View original

131–140 of 146 posts

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#131

Post by vetinari »

morpheuskafka wrote: post #41
thayne wrote: post #18

I'm not sure how I feel about Firefox's strategy for DoH. On the one hand, moving DNS out of the hands of ISPs that (at least in the US) have no real incentive to respect user privacy is probably a good thing. On the other hand, circumventing the system DNS will cause problems for anyone who has explicitly configured DNS, such as corporate networks, schools, households that use DNS for security/adblocking/parental co…

Enterprise use cases can easily manage this through Group Policy. Households (keep in mind we are only talking about people who knew enough to change DNS settings in the first place) can just change the setting on each of their five or so computers. And if you are using DNS as parental controls, that's not a great solution as nothing stops someone from getting the IPs out of band (ex. a website that does DNS lookups)…

> Enterprise use cases can easily manage this through Group Policy.

That's Windows-only mechanism.

> Households (keep in mind we are only talking about people who knew enough to change DNS settings in the first place) can just change the setting on each of their five or so computers.

And not forget to do that for every new device they get. And after reinstalls. And occasionally just to be sure, as we know how software tends to "forget" user preferences sometimes. That's all only up until Mozillas' telemetry will show, that nobody changes the default anyway, so the preference will be removed entirely.

> And if you are using DNS as parental controls, that's not a great solution as nothing stops someone from getting the IPs out of band (ex. a website that does DNS lookups) and connecting directly to the blocked sites.

For the user, it's more complicated than that. He has to persuade the browser to send the right Host header when connecting to the obtained-out-of-band IP address. If you have rights to modify hosts file, you might change the DNS as well and spare the effort.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#132

Post by asveikau »

tptacek wrote: post #78
kiwidrew wrote: post #74

This extreme focus on DoH is really concerning me. If you're worried about your recursive DNS resolver spying on you, the correct solution is to run your own recursive resolver. I've been running unbound(8) on my OpenBSD systems at home for most of 2019, and (except for the time that I experimented with turning on strict DNSSEC checking) there hasn't been even one time that it has caused me grief. It was as simple as…

Running your own non-DOH recursive server does absolutely nothing to protect your queries from snooping; in fact, it increases your exposure, because every single step in the recursive queries you run are now in plaintext on the wire and each attributable to your server. Running your own recursive DOH server is a fine idea, and easy to do, but then you have little to be angry at Mozilla about, because they're the one…

> no mainstream consumer OS runs a local recursive resolver

I think Windows might do something close. DNS client requests are cached on a per-machine basis through the DnsCache NT service. But I do not think getaddrinfo() and friends talk to that service via DNS, so strictly speaking it is not a recursive DNS server, though the resulting behavior is largely the same as if it were.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#133

Post by akerl_ »

asveikau wrote: post #132
tptacek wrote: post #78

Earlier quoted context omitted.

Running your own non-DOH recursive server does absolutely nothing to protect your queries from snooping; in fact, it increases your exposure, because every single step in the recursive queries you run are now in plaintext on the wire and each attributable to your server. Running your own recursive DOH server is a fine idea, and easy to do, but then you have little to be angry at Mozilla about, because they're the one…

> no mainstream consumer OS runs a local recursive resolver I think Windows might do something close. DNS client requests are cached on a per-machine basis through the DnsCache NT service. But I do not think getaddrinfo() and friends talk to that service via DNS, so strictly speaking it is not a recursive DNS server, though the resulting behavior is largely the same as if it were.

I think there’s a differentiation here between a local DNS cache (which does exist on some consumer operating systems) and a local recursive resolver.

The former lets the system reach out to an upstream resolver and caches the results. By contrast, a recursive resolver is responsible for starting at the root zone and recursing downward from there to resolve the requested domain (so when processing a query for “foo.example.org”, the recursive resolver queries “org”, then uses the NS records returned to query “org.example”, then uses the returned NS records to query “org.example.foo”)

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#134

Post by tomatocracy »

kardos wrote: post #11
giancarlostoro wrote: post #6

Earlier quoted context omitted.

Or an option to randomize it per request with the ability to remove / blacklist specific partners. Now that would be great.

Not sure that randomizing is going to do anything useful. Randomizing over three providers will give each of them one third of your requests, but they would just need more time to get a (near) complete list of the domains you resolve. Eg, if you resolve hackernews once a day, they'll each have that information in approximately three days.

You could deal with this by splitting requests based on the domain to be looked up on a deterministic basis, so that the same lookups always go to the same server. You'd ideally do that in such a way that related lookups (eg everything under google.com and all of Google's other related domains) also go to the same server.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#135

Post by ignoramous »

Terretta wrote: post #105
ignoramous wrote: post #26

Congratulations NextDNS! You've been relentlessly executing on every front [0] with super-novel solutions [1] that a few, if any, incumbents have matched [2]. That said, I'm surprised Mozilla doesn't look at the uptime metrics before partnering with TRRs. I've been using NextDNS ever since it was announced here [3] and have been subject to a fair share of "outages" including once when everyone at home thought the int…

It’s not clear to me AdGuard’s uptime avoids the “is the internet down?” scenario either. I observe normals hitting same “WTFs/month” rate with AdGuard, NextDNS, Zscalar, Cleanbrowsing (built into Ubiquiti UniFi), as any other ad blocking DNS offering. I personally had to give up on Warp+ and even 1.1.1.1 — which to be clear does not block ads or trackers — due to instability with enterprise, airline, and hotel porta…

> By contrast, NextDNS shot up in reliability over past couple months across all kinds of connections

I'm sure they've improved but I was bit by downtime as recently as a week ago. Due to their custom proxy-layer that enables the blacklisting magic, on top what seems like a multi-tenant DNS resolver backed by unbound, their anycast setup, redundant network paths, multi-region server deployments are not going to mitigate downtime due to software bugs. Imo, DNS resolvers must be low latency and zero-downtime, by design.

Adguard, I'm speculating, do not have the complexity that NextDNS does (no multi-tenant smart proxy fronting the actual DNS resolver), and so do have a better chance at getting availability and latency fixed sooner?

> I personally had to give up on Warp+ and even 1.1.1.1 ... due to instability with enterprise, airline, and hotel portals.

I'm curious, what instability? I have faced issues with (free) Warp where it can't / won't bypass government imposed censorship. And streaming apps like Netflix refuse to work.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#136

Post by asveikau »

akerl_ wrote: post #133
asveikau wrote: post #132

Earlier quoted context omitted.

> no mainstream consumer OS runs a local recursive resolver I think Windows might do something close. DNS client requests are cached on a per-machine basis through the DnsCache NT service. But I do not think getaddrinfo() and friends talk to that service via DNS, so strictly speaking it is not a recursive DNS server, though the resulting behavior is largely the same as if it were.

I think there’s a differentiation here between a local DNS cache (which does exist on some consumer operating systems) and a local recursive resolver. The former lets the system reach out to an upstream resolver and caches the results. By contrast, a recursive resolver is responsible for starting at the root zone and recursing downward from there to resolve the requested domain (so when processing a query for “foo.ex…

Yeah ok, that's a difference I hadn't thought of. In most local caching servers the next hop is going to be the ISP or similar, rather than going to the root.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#137

Post by zrm »

pvg wrote: post #124
zrm wrote: post #121

Earlier quoted context omitted.

Sure, they had notoriously bad performance for a plurality of reasons. Which also explains the lack of specific complaints. People can tell you that it's slow, that doesn't mean they can tell you every reason why. Firefox historically being slower than Chrome was for a long time one of main reasons cited by people who switched from Firefox to Chrome. DNS/proxy defaults were certainly not the only reason it was slower…

I mean, we started with 'does DoH break caching' to which the answer I think is quite clearly 'no' and we're now on to 'do apps doing their own resolving break anything materially important' to which the answer I think is also 'no' and yours is a pretty unspecific 'maybe'. I don't think these are bad or unwarranted questions (a lot of the anti-DoH arguments are significantly worse) but I'm fairly confident they have…

We started with "does running your own recursive resolver break caching" to which the answer is yes, because it removes intermediary caches that can really improve query latency. It doesn't have to remove 100% of all caches to make caching much less effective. But having the browser bypass local caches and query directly to the internet (entirely regardless of DoH or not) does much the same. The last level cache on the local network is particularly significant because it should have the best hit rate of any cache before the query latency gets multiplied by a factor of 50 or more by going out to the internet.

Caching or not should never "break anything" unless you've seriously screwed up. It's always a matter of the performance impact. Which users will regularly gripe about without being able to articulate what's causing it.

The practical impact of this depends on the context. If your browser is running in a data center across the street from the DoH server with a 3ms round trip latency and you're making a single query, it'll be imperceptible. When your internet link has a 50+ms latency and you're making multiple queries (which may have serial dependencies), it quickly adds up to hundreds of milliseconds. And some people are on satellite links with 500+ms latencies where this matters a lot.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#138

Post by nerdponx »

asveikau wrote: post #106
Eiriksmal wrote: post #59

Earlier quoted context omitted.

I could never think of why Mozilla and friends are so aggressively pushing DoH, but I think you nailed it when you pointed out they can tie a specific device's DNS requests to its other data. I run Unbound and Pi-Hole to do my own recursive resolving. Like a normal wireless router doing all the DNS lookups for its DHCP clients, Mozilla has no idea which particular device on my network is accessing duckduckgo.com. Onc…

> I run Unbound and Pi-Hole to do my own recursive resolving. As documented by Mozilla, I made my network's DNS have use-application-dns.net return NXDOMAIN to opt out. https://support.mozilla.org/en-US/kb/canary-domain-use-appli... My unbound config line is: local-zone: "use-application-dns.net." static

If Mozilla were actually serious about giving users control, they'd make this easier to configure.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#139

Post by asveikau »

nerdponx wrote: post #138
asveikau wrote: post #106

Earlier quoted context omitted.

> I run Unbound and Pi-Hole to do my own recursive resolving. As documented by Mozilla, I made my network's DNS have use-application-dns.net return NXDOMAIN to opt out. https://support.mozilla.org/en-US/kb/canary-domain-use-appli... My unbound config line is: local-zone: "use-application-dns.net." static

If Mozilla were actually serious about giving users control, they'd make this easier to configure.

I think this is pretty easy and appropriate for what it does. (Since my home DNS server is offered via DHCP to the LAN, it disables for the entire network without having to configure each client.)

Disabling on a per-client basis probably has an about:config setting, and I just checked and saw a UI setting under Preferences -> Connection Settings -> Enable DNS over HTTPS.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#140

Post by core-questions »

newscracker wrote: post #40
core-questions wrote: post #19

Earlier quoted context omitted.

I assume every single DNS provider is logging and, if possible, selling my data. Why wouldn't I? This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. Still, if your goal is to block your kids' access to things, DNS is a good place to do it. Works across all your devices and doesn't require any install.

I’d be interested to get to any links/descriptions on how you run your own DNS server and the monetary and time costs of it.

You should look into setting up a Pi-Hole.

https://pi-hole.net/

Good jumping off point for this.

Post reply on HN