Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

21–30 of 777 posts

Re: Mozilla’s DNS over HTTPs

#21

Post by josteink »

drenginian wrote: post #3

Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.

DNS is something network operators (and not just governments and ISPs) has managed and controlled in their own networks for decades.

It has been part of the network stack, with a clear hierarchy in how it is governed:

- network operator - network default

- operating system - application default

- end-user override - when the defaults doesn't work

When something has not worked, you could reliably assume this was the stack used. And you could rely on it being used consistently across all applications.

Needed to deploy internal applications? Great: Just override the (local, internal) DNS. Need to access servers or machines on internal servers? Use DNS!

Now if you make some random applications and decide to flat out ignore the established stack and just ask the internet about DNS...

You're effectively breaking the network and the conventions which has been established to build them.

Ofcourse people are going to hate you. That's a given.

Re: Mozilla’s DNS over HTTPs

#22

Post by bepvte »

teddyh wrote: post #16
drenginian wrote: post #9

Earlier quoted context omitted.

Well it’s absolutely happening right now to every unencrypted DNS server, so what’s your point? DNS is the most openly insecure aspect of the entire internet. It’s wide open.

So you’re arguing that everybody should switch to DNS over TLS (DoT), then? Sounds great!

DNS over TLS is just DoH but with an easily blocked separate port

Re: Mozilla’s DNS over HTTPs

#23

Post by protomyth »

bepvte wrote: post #19
protomyth wrote: post #14

Does the disable code still work in the about:config? I would rather not have the trusted providers see all our internal server names (which is wasted bandwidth and time) and our controls in the library work. DNS resolution is the OS's job. This hijacking of function is a pain. Has no one at Mozilla ever had to deal with the realities of using their browser in an organization?

AFAIK the ESR (business release) does not have this on by default

ESR is extended support and we use the regular Firefox. Firefox was never required by any vendor we use to remain compatible so we didn't have to be on the ESR branch.

Re: Mozilla’s DNS over HTTPs

#25

Post by Legogris »

bepvte wrote: post #22
teddyh wrote: post #16

Earlier quoted context omitted.

So you’re arguing that everybody should switch to DNS over TLS (DoT), then? Sounds great!

DNS over TLS is just DoH but with an easily blocked separate port

Which is great from a local sysadmin perspective. With DoH I have no control of what various apps on devices on my devices are querying.

Re: Mozilla’s DNS over HTTPs

#26

Post by im3w1l »

Vinnl wrote: post #2

I think this is generally a good thing. Two questions I've often seen surface on HN though weren't answered: 1. Isn't this better implemented at the OS level? 2. Isn't centralisation to two DoH providers more centralised than five large ISPs? Others are probably better suited to answer, but the answers I can think of: 1. Yes, but it is not, so this solution is second-best. If Operating Systems decide to tackle this p…

The ISP can just check which IP you contact, so I don't see this increasing privacy.

Re: Mozilla’s DNS over HTTPs

#27

Post by rciorba »

andridk wrote: post #20

Why isn't this being solved on an operating system level instead?

It could be.

Since Mozilla makes a browser it was natural they'd try to solve it at the application level and not wait until M$ and other privacy loving OS vendors solve the problem.

Re: Mozilla’s DNS over HTTPs

#28

Post by Jonnax »

drenginian wrote: post #3

Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.

I think part of the negativity you see is network admins working in businesses.

Their opinion is that it's a way for people to get around corporate firewalls. Kinda blind to the idea that if a browser can implement DNS over HTTPS then anything can.

Especially since there's some of ways that Mozilla have implemented for a local area DNS server to override its settings.

There's also another camp, if you remember the "internet villain of the year" award that Mozilla got for DNS over HTTPS from an ISP industry group.

Of course their argument was parental controls being made ineffective.

But of course it's transparent that this was a gambit to change public opinion so they can keep collecting browsing data to sell.

Interesting to note they went after Mozilla not Google who are also implementing it.

But really the messed up thing is that this improves privacy for the vast majority of users. Especially those people around the world where searching the wrong thing up online can lead to imprisonment or worse.

This kind of thing is a privacy improvement for millions.

And I find it shocking that people in Business IT care more about managing their corporate devices than the good of the majority of internet users.

Re: Mozilla’s DNS over HTTPs

#29

Post by ocdtrekkie »

drenginian wrote: post #3

Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.

For one, it’s ironically first being deployed in countries where DNS manipulation by the government isn’t happening (US first generally), but Google has competitive concerns with ISPs getting ad targeting data. I feel like defending against oppressive governments is being used more as an excuse than a driving motivation. The primary concern seems to be that Google really wants to protect its monopoly, and Firefox, as a major benefactor of Google money, has fallen in line.

And second, as an IT admin, I’m annoyed web browsers keep trying to develop new ways to bypass my network security.

Post reply on HN