For those who are uneasy to use CF DoH, here's a list of alternative DoH Resolvers
https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-av...
Turn off DoH, Firefox
161–170 of 422 posts
Re: Turn off DoH, Firefox
#162We are having zero problems with the current decentralized DNS architecture.
Evidently, Mozilla plays the role of a Google's darling once again. Those financial "donations" have some interesting effects, aren't they? Aside from an official "Google Search Bar in Firefox" line.
What's even more interesting is that Hacker News moderator deranked the topic.
Probably all the actors represent the same mafia ring, as they painfully in need to defend those interests to stay commercially relevant in changing world (hello IPFS).
Re: Turn off DoH, Firefox
#163Earlier quoted context omitted.
And? Those same people are likely using their ISP or Google for DNS right now. How is this worse?
It's worse, because the local ISP is more trustworthy and additionally you enable cloudflare for large scale profiling. And don't claim they won't do it, it's just a matter of time
I scoff at the idea that Comcast is more trustworthy than Cloudflare.
Re: Turn off DoH, Firefox
#164How decisions are made in Mozilla? By whom? Is there public discussion beforehand?
This has been tested and debated for months. Initial support for Firefox rolled out 9 months ago or so: https://miketabor.com/enable-dns-over-https-and-encrypted-sn... The conclusion of the debate was that it vastly improves the privacy for most users. Which is why it shipped in Firefox. Take that into account when you read (misleading, factually wrong) push-back like the original article.
First announcements were even longer ago: https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-ove...
Re: Turn off DoH, Firefox
#165Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! If you don't like CF just switch to different provider https://github.com/curl/curl/wiki/DNS-over-HTTPS
> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! I trust my ISP and government more than a US company I have no formal contract with and the US government. Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Fi…
> applications should not override system level settings
I wish Windows 10 and other operating systems natively supported DNS-over-HTTPS, but many don't. So they have to work around that lack of support.
Re: Turn off DoH, Firefox
#166This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…
> DNS requests are routinely ... monitored by ISPs
DoH doesn't prevent ISP monitoring. Even if they cannot see the DNS request, the browser sends the ISP the returned A/AAAA record in the header of a TCP SYN packet. The ISP necessarily sees the hosts you are connecting to; they don't need to see the DNS traffic. DoH to Cloudflare allows both Cloudflare and the ISP to monitor your pattern-of-life.
> DoH is vital to protect users around the world from censorship and worse.
Yes, it would be a useful tool to fight censorship, but don't conflate that with monitoring traffic. The ISP still sees the addresses and ports in the IP+TCP headers.
Re: Turn off DoH, Firefox
#167Earlier quoted context omitted.
There aren't many intermediaries if you use your ISP's internal resolvers.
And there are intermediaries between Cloudflare/other DoH providers and the respective authoritative nameservers anyway.
But unless they have the private key for CloudFlare certs, they can't snoop in so it doesn't matter if there are intermediaries in between.
Re: Turn off DoH, Firefox
#168Earlier quoted context omitted.
> the article deliberately buries that it's trivial to change your DoH provider While true for you or me, the vast majority of people will have this enabled by default - probably not even realising it's on
And? Those same people are likely using their ISP or Google for DNS right now. How is this worse?
Well there is whole article linked explaining just that.
But basically, i know my ISP, and they don't log dns queries.
Most ISP's (the ones i have worked with) don't save DNS requests. They usually save netflow.
I also use vpn (my own), with its own dns resolver, for when i don't trust middle man.
Re: Turn off DoH, Firefox
#169The only thing that annoys me slightly about this, is that I currently have a couple of pi-holes running at home (one for us, and one for the kids) and I have the Mikrotik setup to redirect any request for DNS to the correct pi (So even if they change the DNS on the device it still hits the pi) This is going to make that a pain - especially if they introduce it in the mobile version?
You should be able to disable the Firefox default-on DoH across your network by returning NXDOMAIN for use-application-dns.net [1] I don't know how to configure pi-hole, but at the dnsmasq level you can do that with this directive: address=/use-application-dns.net/ [1] https://support.mozilla.org/en-US/kb/configuring-networks-di...
Interesting, thanks.
I guess if these use normal DNS requests first to determine if it should be allowed, then it will work.
> If a user has chosen to manually enable DoH, the signal from the network will be ignored and the user’s preference will be honored
Well, that kinda puts a dampner on it all!
Re: Turn off DoH, Firefox
#170How decisions are made in Mozilla? By whom? Is there public discussion beforehand?
This has been tested and debated for months. Initial support for Firefox rolled out 9 months ago or so: https://miketabor.com/enable-dns-over-https-and-encrypted-sn... The conclusion of the debate was that it vastly improves the privacy for most users. Which is why it shipped in Firefox. Take that into account when you read (misleading, factually wrong) push-back like the original article.
> The conclusion of the debate
Obviously debate is still on, as we see in here and in [0], and it looks like HN folks are not in favour of these integrations, including me. So question stands, how/why the debate was concluded, did all developers had a vote? Is there a link to discussion?