451–460 of 777 posts
Earlier quoted context omitted.
I'd guess that the overwhelming majority of Mozilla's users do not have a "network administrator" looking after issues like this for them. All they have is an ISP, and the ISP is not on the user's side.
Everyone who uses DNS-based content filtering (OpenDNS, a "Pi Hole", etc) to do filtering on a home network is a "network administrator".
Earlier quoted context omitted.
tcpdump -i any -s 1500 '(tcp[((tcp[12:1] & 0xf0) >> 2)+5:1] = 0x01) and (tcp[((tcp[12:1] & 0xf0) >> 2):1] = 0x16)' -nnXSs0 -ttt Is it though? This one liner works just fine for me on my gateway and is capturing quite a huge number of raw SNI names. 0x0110: c008 0016 0013 0010 000d c00d c003 000a ................ 0x0120: 00ff 0100 0113 0000 001d 001b 0000 186c ...............l 0x0130: 6f67 7369 6e6b 2e64 6576 6963 657…
It's not complicated, but that's also going to take more time , cpu power, and memory bandwidth to do so than just recording dns packets. When you need to do that to millions or billions of connections per second the costs start to really add up.
Earlier quoted context omitted.
Yes I think they will. Their positioning in the VPN, DNS, CDN and (soon) enterprise networking space will give them enormous visibility into a large fraction of what is happening on the Internet, and I simply cannot believe that a profit-oriented company will turn away from such a market opportunity. Cloudflare isn’t really known as a privacy champion, they always put more emphasis on security, speed and reliability.…
Mozilla has previously noted that Cloudfare is contractually obligated to keep the traffic private and not monetize or share it. That's not perfect, but without a law requiring it that's about the best you can get in the U.S. (assuming the contract has teeth in the penalties it imposes).
There are many things that could be done. The problem is that the promises they make sound grand but aren't real, they wouldn't put the value of their homes at risk (nor would I encourage them to, I'd encourage them to not put themselves in a position where they could be forced to compromise the privacy of the public like this) ---- yet some user's lives can be put at risk by privacy-failures of their service.
Earlier quoted context omitted.
> If you use the nextdns DoH provider in Firefox you can actually configure your own adblocking domains even when you're moving around across networks. Uh. Doesn't this prove that Firefox's DOH implementation is sending strong per-user identifying information to the server?
That’s what nextDNS offers (basically pihole in the cloud). And that only works by hitting a specific subdomain or endpoint on nextdns.io. If you’re hitting cloudflare, it’s just hitting the regular endpoint so no user identifying information.
I'm so sad to see Mozilla move forward with this massive attack on user privacy. Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens o…
Unfortunately it's not so easy to black hole `use-application-dns.net` for parental control. (people don't run their own DNS server).
Earlier quoted context omitted.
> ...it is a PITA, especially when roamining and you want to resolve hostnames available only in local networks. Not really. If you're not blackholing traffic at the dns-layer via DoH, set Firefox's trr.mode to 2 . Per documentation, at the cost of additional latency incurred, system-level / network-level resolvers should pick up the slack, provided they've been set as appropriate via DHCP or otherwise. Ref: https://…
If I sit any family member down in front of this comment, their eyes would glaze over. Not only is what you mention a PITA, it's impossible for most people.
Earlier quoted context omitted.
Is there an indication they are moving in that direction already? (Genuine non-sarcastic question) They've built up a considerable amount of good-will in developer communities. Is there some historical indicator with cloudfare that suggests they are going to blow it all on their path to monetization, or are we extrapolating from other VC backed companies (which may be an understandable position to take, but why?)
It's interesting how bubbles work. In my world, everyone has a story about how an obscure but interesting to surveil service that they were involved with was DDOS attacked and immediately cloudflare sales was showing up offering to mitigate the attack for free by MITMing their traffic. ... Even showing up on the IRC channels of open source projects. I've personally witnessed it three times. Even if it weren't for the…
You profess not to believe these theories, or at least not the first one. So why then repeat? It's just more untruths poisoning this debate, like any other going on these days.
And how does Cloudflare get the blame in your telling of this story, when it's your unnamed sources "you've heard" believing paranoid stories? DDOS were a thing before Cloudflare, and the incident numbers haven't much changed. So if it's Cloudflare doing it all now, they must have simultaneously convinced everyone else to stop.
The idea that their salespeople showing up when you're under attack is similarly strange: While I might agree that it feels somewhat creepy, is there any doubt that these things are easy to notice with some saved twitter searches and a google alert? It also strikes me as a potentially quite useful sales tactic. And yet, even though it's feasible and effective, they are supposed to forgo that channel to stop others from engaging in obviously flawed reasoning?
I wish they wouldn't do this. I trust my ISP more than I trust Firefox and whatever company they chose for DNS over HTTP. This "We know better than you" attitude is why I stopped using Firefox so many years ago. I switched back recently, to stop using Chromium, but I have a growing list of annoyances, and it might be time to give NeXt Browser a chance again, or see what else is out there.
I’m wondering, is the US a phased roll out or is this in light of government mandated censorship in the UK, Australia, New Zealand, India, China, etc.?
The last entry at their FAQ posted today indicates that they’re focusing on US-only and does not commit to worldwide plans. (But it’s also buried in an image where I can’t copy-paste, ugh.) Link to that FAQ: https://blog.mozilla.org/netpolicy/2020/02/25/the-facts-mozi...
The only reason I can think of (or I can understand) is regulation and laws, but it doesn't seem to be the case.
Earlier quoted context omitted.
> We continue to explore enabling DoH in other regions, and are working to add more providers as trusted resolvers to our program. DoH is just one of the many privacy protections you can expect to see from us in 2020. Cloudflare is just one of the initial providers and they indicate that they are adding more. Also, I'm assuming you can add your own custom provider based on the screenshot in the article. You can just…
99 % of users won’t touch default values, so it’s not a valid excuse. I really have come to the conclusion that privacy is just a marketing feature for Mozilla. They e.g. also do nothing against data exfiltration by popular extensions although they have known that issue for years. If they’re really serious about privacy they should have waited to implement DoH as an open standard and allow more DNS providers to suppo…
This kind of sentiment compels mozilla into becoming an apple-like gatekeeper to a walled garden because people conflate the trustworthiness of extension authors with mozilla's trustworthiness, which leads to less software freedom, a single point of failure and a less diverse ecosystem.