Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

51–60 of 777 posts

Re: Mozilla’s DNS over HTTPs

#51

Post by techdevangelist »

aduitsis wrote: post #43

If you are a network administrator and want none of this, look at that: https://support.mozilla.org/en-US/kb/canary-domain-use-appli... Basically, make use-application-dns.net. return an error (any kind will do). Filter it in your recursor for example. Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. If nothing else, it is the network administrator who should hav…

I wonder if we’ll start to see Comcast and other large snooping ISPs start to filter the resolution of this domain in the name of stability...

Re: Mozilla’s DNS over HTTPs

#52

Post by bepvte »

protomyth wrote: post #23
bepvte wrote: post #19

Earlier quoted context omitted.

AFAIK the ESR (business release) does not have this on by default

ESR is extended support and we use the regular Firefox. Firefox was never required by any vendor we use to remain compatible so we didn't have to be on the ESR branch.

https://support.mozilla.org/en-US/kb/canary-domain-use-appli... You can use this if you run a DNS server

Re: Mozilla’s DNS over HTTPs

#54

Post by jfk13 »

aduitsis wrote: post #43

If you are a network administrator and want none of this, look at that: https://support.mozilla.org/en-US/kb/canary-domain-use-appli... Basically, make use-application-dns.net. return an error (any kind will do). Filter it in your recursor for example. Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. If nothing else, it is the network administrator who should hav…

I'd guess that the overwhelming majority of Mozilla's users do not have a "network administrator" looking after issues like this for them. All they have is an ISP, and the ISP is not on the user's side.

Re: Mozilla’s DNS over HTTPs

#55

Post by Spivak »

aduitsis wrote: post #43

If you are a network administrator and want none of this, look at that: https://support.mozilla.org/en-US/kb/canary-domain-use-appli... Basically, make use-application-dns.net. return an error (any kind will do). Filter it in your recursor for example. Having the browser change a fundamental behaviour that used to stand for decades is highly problematic. If nothing else, it is the network administrator who should hav…

This logic makes no sense to me. Can you imagine if AT&T or Spectrum made a statement like this?

The “network administrator” is an untrusted 3rd party who should have basically 0 say in how my device operates.

The device administrator, ie the owner of the machine, is the one who should have the final say over when DoH is used. The use-application-dns record is for businesses that want an easy way to stop DoH on machines they administer. If random “network admins” start deploying it as you say then Mozilla will have no choice but to ignore the record entirely.

Re: Mozilla’s DNS over HTTPs

#56

Post by ComputerGuru »

Jonnax wrote: post #48
ComputerGuru wrote: post #45

Earlier quoted context omitted.

All that does is block DoH entirely, right? Not allow me to say “use this DoH server” or “don’t use DoH for this domain.”

I think if you want to get that detailed you'd be pushing a custom managed Firefox profile.

You have twenty different applications using DoH for “increased security” and you need a custom profile for each? Why not a single line in resolv_doh.conf?

Re: Mozilla’s DNS over HTTPs

#57

Post by bepvte »

larrysalibra wrote: post #44

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…

Yes, if you press the network and proxy settings in the preferences page, you will see a DNS over HTTPS setting. You can also use this to set your own resolver in case you dont trust cloudflare.

Re: Mozilla’s DNS over HTTPs

#58

Post by jedieaston »

ComputerGuru wrote: post #45
Jonnax wrote: post #37

Earlier quoted context omitted.

https://support.mozilla.org/en-US/kb/canary-domain-use-appli... There is. You configure your DNS resolve this "canary" domain to disable it.

All that does is block DoH entirely, right? Not allow me to say “use this DoH server” or “don’t use DoH for this domain.”

Here are the instructions to do it, straight from Mozilla: https://support.mozilla.org/en-US/kb/firefox-dns-over-https#...

Re: Mozilla’s DNS over HTTPs

#59

Post by gumby »

The overhead of setting up and using an https connection is massive compared to DNS which can fit in a UDP transaction.

Do they establish a connection and leave it open for a long period? Supporting that would be a big commitment on the part of the resolvers.

Re: Mozilla’s DNS over HTTPs

#60

Post by ekimekim »

im3w1l wrote: post #26
Vinnl wrote: post #2

I think this is generally a good thing. Two questions I've often seen surface on HN though weren't answered: 1. Isn't this better implemented at the OS level? 2. Isn't centralisation to two DoH providers more centralised than five large ISPs? Others are probably better suited to answer, but the answers I can think of: 1. Yes, but it is not, so this solution is second-best. If Operating Systems decide to tackle this p…

The ISP can just check which IP you contact, so I don't see this increasing privacy.

This is addressed in TFA: The fact that there are multiple problems and solving any one of them doesn't help much until they're all solved, should not be an excuse to refuse to solve any of them.
Post reply on HN