Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Turn off DoH, Firefox

ungleich.ch

Post reply on HN
Print view View original

31–40 of 422 posts

Re: Turn off DoH, Firefox

#31

Post by seszett »

roblabla wrote: post #18
Aaargh20318 wrote: post #14

Earlier quoted context omitted.

> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! I trust my ISP and government more than a US company I have no formal contract with and the US government. Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Fi…

> I trust my ISP and government more than a US company I have no formal contract with and the US government. And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something b…

If you use your ISP's DNS servers, there is no intermediary between you and them.

Re: Turn off DoH, Firefox

#33

Post by jfindley »

Chirael wrote: post #16

It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?

Out of the box? Yep! I realise that will annoy people but honestly it's a good thing - any solution that would not bypass a pi-hole would allow governments and ISPs to do the same.

To retain your pi-hole, you'll need to run a DoH proxy on your pi-hole device, configure your browser to use that as the DoH provider, and this will allow your pi-hole to inspect and modify DNS results. Your pi-hole can then use any upstream DoH provider that you want.

Re: Turn off DoH, Firefox

#34

Post by taneq »

jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

> There has to be SOME default chosen

It seems trivial to select a half a dozen likely candidates and let the user choose between them on install.

Honestly I'd like them to do the same with the search engine. Yes, it's simple enough to change the default, but it'd be nice to choose up-front.

Re: Turn off DoH, Firefox

#35

Post by userbinator »

It's very disturbing to see the overreach that Mozilla has resorted to and the "privacy" argument (it was "security" before that...) being used to justify essentially ignoring system configuration. My ISP has more accountability than a company in another country.

The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems.

Exactly. If Mozilla wants to, it's more than welcome to reach into the VPN area with its own products, but I don't believe this functionality should be part of a browser. They're already reaching into the VPN area[1], should they also investigate bypassing Chinese censorship with their own "firewall-busting" obfuscating VPN? That's not something most users want nor need in their browsers, and such functionality is really a cat-and-mouse game that I think is best left to smaller and less-well-known entities.

It's unfortunate that browsers are already beyond "neutral", when IMHO the only thing they should do is fetch exactly the page URL that was entered and display it.

Edit: yes, apparently people disagree and want Mozilla to control what the Internet (and every user, ignoring his/her default configuration) does. This is really really disturbing.

[1] https://news.ycombinator.com/item?id=20927832

Re: Turn off DoH, Firefox

#36

Post by askmike »

jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

> if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP).

I don't think anyone believes CF will start selling data, that's not what the article argues.

Regardless, it's opt-out not opt-in. Which is against newer consumer protection laws such as GDPR.

> DoH is vital to protect users around the world from censorship and worse.

This isn't black and white. Yes there is upside (as both you and the article agree), but the downside of how DoH is implemented here is that you have to point all your DNS queries to a US company. Historically we've seen how this is a bad idea for global internet privacy (eg. PRISM, etc).

Re: Turn off DoH, Firefox

#37

Post by radlad »

taneq wrote: post #34
jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

> There has to be SOME default chosen It seems trivial to select a half a dozen likely candidates and let the user choose between them on install. Honestly I'd like them to do the same with the search engine. Yes, it's simple enough to change the default, but it'd be nice to choose up-front.

Every question you make a potential user/customer answer is a potential loss of conversion.

Most Firefox users do not care. Those that do can figure out how to change it easily enough.

Re: Turn off DoH, Firefox

#38

Post by miohtama »

Aaargh20318 wrote: post #14
akerro wrote: post #3

Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! If you don't like CF just switch to different provider https://github.com/curl/curl/wiki/DNS-over-HTTPS

> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! I trust my ISP and government more than a US company I have no formal contract with and the US government. Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Fi…

This is exactly why DoH is enabled by default in the US only.

Re: Turn off DoH, Firefox

#39

Post by taneq »

Chirael wrote: post #16

It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?

Would it be hard to make pi-hole into a DoH provider so you could just point your browser at it? Or does that defeat the "just works" factor of the pi-hole?

Re: Turn off DoH, Firefox

#40

Post by [deleted] »

taneq wrote: post #34
jfindley wrote: post #22

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what yo…

> There has to be SOME default chosen It seems trivial to select a half a dozen likely candidates and let the user choose between them on install. Honestly I'd like them to do the same with the search engine. Yes, it's simple enough to change the default, but it'd be nice to choose up-front.

[deleted]
Post reply on HN