Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS-over-HTTPS Policy Requirements for Resolvers

blog.mozilla.org

Post reply on HN
Print view View original

161–170 of 301 posts

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#161

Post by vetinari »

laHiesh1 wrote: post #120
MayeulC wrote: post #101

Earlier quoted context omitted.

That's not entierely true. If the domain doesn't resolve via DoH, Firefox will fallback to the system DNS server. network.trr.mode Needs to be set to 2 (fallback), 1 (pick faster), or 0 (dissable DoH) for this to happen. 3 disables the system resolver.

Do they bother resolving internal domain names such as example.lan? Otherwise that would be stupid and leaky.

Also intranet.mycompany.com. There's not a chance that a resolver would know, which domains are internal and which are not.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#162

Post by uep »

EvanAnderson wrote: post #136
selenamarie wrote: post #102

Earlier quoted context omitted.

I'm working on our DoH implementation. I'm guessing this is a split-horizon set up with a domain that resolves both internally and externally. If you are willing, we're very interested in these situations and coming up with heuristics to detect and disable DoH proactively. We're also looking into standards changes that could make these configurations more reliably detectable at the application level. I'm selena at mo…

As a sysadmin who rails against split-horizon DNS (usually around Active Directory implementations where brain-damaged people have named the AD domain the same as a public Internet domain name) I'm already getting a churning feeling in my stomach thinking about how software is going to mishandle this scenario in DNS-over-HTTPS. It's going to be particularly god-awful for devices that roam between networks where the "…

My organization does this (AD domain appears to be the same as the public domain name), and I also had problems when I opted into the HTTPS DNS trial. As in, no internal servers resolved.

I had thought that internal networks these days would favor multicast resolution (LLMNR/mDNS), but that doesn't appear to be the case here. Admin work is not my wheelhouse, so I have no idea what standard practice is. What is the recommended setup for AD and name resolution configuration?

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#163

Post by shawnz »

EvanAnderson wrote: post #156
shawnz wrote: post #151

Earlier quoted context omitted.

Then don't buy such a device which clearly doesn't meet your needs. Why should every personal computing device on the planet be tailored to your requirements, at the cost of safety for the majority of other users? Most people don't use PiHole, they use Adblock or uBlock which are not affected by this. It's not as though they are taking away your ability to use adblocking technology.

Macro-level view: The Mozilla Foundation may think that DNS-over-HTTPS is about "safety", but they're unwittingly furthering the agenda of those who would profit from the Internet not being decentralized. A decentralized Internet filled with devices that end users can control, should they choose, is a good thing for society, I'd argue. DNS-over-HTTPS is another piece of technology that can be used to eliminate that.…

Regarding your second point, this change will improve privacy for your clients and make it harder for bad actors to take advantage of your network. So what's not to like? Just because your old tooling won't work anymore doesn't mean that this change is a bad thing for clients.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#164

Post by techntoke »

EvanAnderson wrote: post #156
shawnz wrote: post #151

Earlier quoted context omitted.

Then don't buy such a device which clearly doesn't meet your needs. Why should every personal computing device on the planet be tailored to your requirements, at the cost of safety for the majority of other users? Most people don't use PiHole, they use Adblock or uBlock which are not affected by this. It's not as though they are taking away your ability to use adblocking technology.

Macro-level view: The Mozilla Foundation may think that DNS-over-HTTPS is about "safety", but they're unwittingly furthering the agenda of those who would profit from the Internet not being decentralized. A decentralized Internet filled with devices that end users can control, should they choose, is a good thing for society, I'd argue. DNS-over-HTTPS is another piece of technology that can be used to eliminate that.…

This is what Mozilla has been doing for a while. They enable advertisers and bad actors to profile you without any sane safeguards to prevent websites from running JavaScript code that is used in a nefarious way. If they were actually focused on protecting users, they would be working with IPFS and building other tools to help hide user identities through a permission-based system. Chrome is just as guilty, but it's not like Mozilla is trying to define new web standards to prevent this type of activity. They may as well be working together.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#165

Post by protomyth »

moosingin3space wrote: post #158
protomyth wrote: post #149

Earlier quoted context omitted.

What is the default?

Cloudflare 1.1.1.1 is the default.

So, when the user types in internal.mydomain.com, it gets sent to Cloudflare then they query my public domain server which doesn't have the entry so it falls back to checking the DNS the system has listed. Is Firefox going to cache the IP like the OS does?

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#166

Post by Avamander »

michaelt wrote: post #150
Avamander wrote: post #125

Earlier quoted context omitted.

The original commenter talked about BYOD though, maybe school-given devices are set-up so that they don't let kids do whatever they want. In the case of BYOD, if you're not okay with your kid having an Internet-connected device and that they're going to use it responsibly then don't give him/her one or only allow it under parental supervision. If we're carefully watching and teaching kids kids when they're handling k…

If your child is supervised on the internet and doesn't have a tablet, and mine isn't and does, and my child showed your child stuff you disapproved of while in school, would you complain to the school? Because some parents would.

> Because some parents would.

Some parents complain about sex ed and vaccination, satisfying the lowest common denominator doesn't really work.

If some kid showed actually NSF-School images, such as nudity, to other kids and it was a first time offense a warning should suffice. If it's a repeated offense then maybe the kid needs psychological help.

Just as a hypothetical scenario, there's the possibility that a kid shows others a picture of for example Michelangelo's David (or similar art piece), do you think that kid should be punished for showing nudity to other kids?

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#167

Post by vetinari »

CydeWeys wrote: post #82
Tushon wrote: post #65

Earlier quoted context omitted.

The OP talked about BYOB, which rarely includes "root access" (either via a root cert for decrypting traffic or admin level access to the machine)..

I was referring to the machines they were preventing the installation of Firefox on. For BYOD, I don't know what you're gonna do. Many students have smartphones too (some with tethering), and you can't control what they look at on those either. Plus, even if the school could somehow magically lock everything down 100% within the confines of the school building, the students can still get access to whatever at home, o…

> the students can still get access to whatever at home, or using coffeeshop WiFi, or whatever.

That's fine, these are not school responsibility. Once the parents complain, you can redirect them to their home or coffeeshop.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#168

Post by kylek »

(It's been a long time since I've actually set up a DNS server and am pretty fuzzy on some details - so I'm going to state this like a real nooby to hopefully get an ELI5 answer)

If I were to set up my own DoH server, would its queries to upstream (root??) servers (and subsequent recursed servers) be encrypted? (Simpler: does running a DNS server "on-premise", or even in the cloud, actually protect you from anything?)

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#169

Post by moosingin3space »

protomyth wrote: post #165
moosingin3space wrote: post #158

Earlier quoted context omitted.

Cloudflare 1.1.1.1 is the default.

So, when the user types in internal.mydomain.com, it gets sent to Cloudflare then they query my public domain server which doesn't have the entry so it falls back to checking the DNS the system has listed. Is Firefox going to cache the IP like the OS does?

The behaviour depends on a few preferences:

* network.trr.mode can be set to 0 (disabled), 1 (race native vs TRR), 2 (TRR first, OS DNS as fallback), 3 (TRR only), 4 (run native and TRR in parallel but use native results, save TRR timings for telemetry), or 5 (off by choice)

* network.trr.uri configures which DoH endpoint is queried

Firefox does maintain a DNS cache, even if you use the native DNS resolver. You can view the cache at about:networking#dns.

Re: DNS-over-HTTPS Policy Requirements for Resolvers

#170

Post by moosingin3space »

AnaniasAnanas wrote: post #45
pas wrote: post #18

Earlier quoted context omitted.

DNScrypt is easy to block, therefore it can't further the privacy-for-all cause.

This is certainly a valid argument, though two of the other solutions (plus dns over tls) avoid this issue as well.

How does DoT avoid this issue? IIRC, DoT runs over port 853, which is trivial to block.
Post reply on HN