I do not trust Cloudflare.
Mozilla’s DNS over HTTPs
241–250 of 777 posts
Re: Mozilla’s DNS over HTTPs
#242Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…
> What’s in it for the Cloudflare & NextDNS? It gives them a competitive advantage in DNS industry against other B2B providers, such as NS1.
curious, can see the case for the capability giving advantage, but how do you think running the public service would? or do you mean competitive advantage in marketing their products?
Re: Mozilla’s DNS over HTTPs
#243If you are a network administrator and want none of this, look at that: https://support.mozilla.org/en-US/kb/canary-domain-use-appli... Basically, make use-application-dns.net. return an error (any kind will do). Filter it in your recursor for example. Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. If nothing else, it is the network administrator who should hav…
Has anyone verified that this actually works? My company's DNS administrators have already made this change. use-application-dns.net returns SERVFAIL when I run "dig" on my machine on the corporate network.
But if I enable DNS over HTTPS in Firefox, it very clearly still uses the Cloudflare resolvers. We have some split-horizon zones set up (resolve to 10.x IP's internally, and public IP's externally). When I tick the DoH box, Firefox starts resolving the public IP, verified in the Dev Tools network pane.
Curious if the issue lies with us or Mozilla.
Re: Mozilla’s DNS over HTTPs
#244Earlier quoted context omitted.
>Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. No, this is far too broad of a statement. Browsers pushing for TLS, deprecating the old SSL versions and now the old TLS versions, deprecating SHA1 use in certificates, going from quirksmode to a living html standard (not without problems such as Google's over-influence), etc all have been a net positive, but ther…
The elephant in the room is that many networks need to have content filtering, and you are proposing nothing useful. DoH torpedoes content filtering to its very core and, fortunately, the knob Mozilla provides can (hopefully) be utilized. That's all there's to it.
This is quite a radical position, but there are no legitimate use cases for content filtering.
What use cases do people have in mind?
* State censorship. Totalitarian.
* "Parental controls". Child abuse. Learn how to build trust in your children instead.
* Corporate filtering. Find other ways to motivate your employees than blocking Facebook.
The problem with this implementation is that it doesn't go far enough. I want software to actively fight against the idea of content filtering.
Re: Mozilla’s DNS over HTTPs
#245Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…
> having “no plans” to enable this outside the USA seems a bit disingenuous. Other countries have censorship (China, UK, New Zealand, etc) whereas there is none in the US. I wonder if that’s why?
Mozilla was founded in USA, which may be of relevance for why USA was selected as the country of launch. I don’t know anything specific about their decision, though.
Re: Mozilla’s DNS over HTTPs
#246I don’t know why DNS over HTTPS breaks my brain.
I understand how DNS, HTTP, and most of HTTPS work at the wire level (a little fuzzy on how the decisions are made, though). It’s just using a different transport strategy to acquire an IP address from a FQDN. Every step of that process has a logic to it, and none are mutually incompatible.
And yet... my brain keeps alerting, asking what kind of madman does the HTTP before the DNS. Maybe it’s the “to make an HTTP connection, first you must make an HTTP connection” part that gets me. I can’t say. But it just feels wrong, despite being more sustainable.
Re: Mozilla’s DNS over HTTPs
#247Seems very marginal for privacy when people in the middle can still see the IP you're connecting to, just not which DNS record you may have retrieved the IP with.
Re: Mozilla’s DNS over HTTPs
#248Earlier quoted context omitted.
Ok, authoritarian regimes not included
> Ok, authoritarian regimes not included And yet this was/is one of the justifications for implementing this. They're not doing it in the EU because (a) there are decent privacy laws, and (b) IP addresses are (IIRC) considered personal information and so Cloudflare DoH would be responsible for keep a whole bunch of data safe. They may not want that responsibility. This seems to (currently) be US-only because of the s…
No the justification is to make it harder for non-authoritarian countries to block websites. If China or North Korea want to block the IP range of AWS+Azure+Google that's up to their respective autocrats.
Most democratic or even hybrid regimes are not prepared for that level of absolute chaos and consequent protest if half the Internet is shut down. You can only pull that shit in a dictatorship.
Re: Mozilla’s DNS over HTTPs
#249I may be late to this, but here [1] is some commentary on why DoH (DNS over HTTPS) may not be as affective as it is perceived. The article also talks about DoT (DNS over TLS) mechanism which is apparently less disruptive for network monitoring tools compared to DoH.
Can some security minded folks from the community chime in about the claims made in the linked article?
(Disclaimer: English is my second language)
[1]: https://www.zdnet.com/article/dns-over-https-causes-more-pro...
Re: Mozilla’s DNS over HTTPs
#250Can you disable this?
What are some reasons why someone would prefer to or need to disable it. Just curious.