Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NextDNS Joins Firefox’s Trusted Recursive Resolver

blog.mozilla.org

Post reply on HN
Print view View original

71–80 of 146 posts

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#71

Post by core-questions »

icebraining wrote: post #51
core-questions wrote: post #19

Earlier quoted context omitted.

I assume every single DNS provider is logging and, if possible, selling my data. Why wouldn't I? This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. Still, if your goal is to block your kids' access to things, DNS is a good place to do it. Works across all your devices and doesn't require any install.

> This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. How do you prevent the ISP from logging those requests to the root?

Hey, good point. I guess there's not much I can do about that yet, without DNSSEC or whatever.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#72

Post by core-questions »

cookiecaper wrote: post #30
threatofrain wrote: post #20

Earlier quoted context omitted.

Further, any mention of homosexuality is often considered to be inherently and unmistakably morally obscene, such as by the One Million Moms group, or as described by various state GOP platforms. This would include the narratives on whether lesbian or gay parents exist.

One of the positives of DNS-level blocking is that it's relatively rough-grained. You can block pornhub.com, but you can't block out every mention of homosexuality at the DNS level without blocking any site that may potentially mention it, which would include any news site, discussion forum, social media, etc. We should be skeptical of aggresively-enforced DoH. In most cases, the vendor's interest in stopping ad bloc…

Technology should not be inserting itself into the private lives of people and determining the values they can raise their children with. This is something parents should have as a tool. If you don't like it, tough; go raise your kids the way you want to. There's no reason why someone with traditional values shouldn't be afforded the ability to selectively block things they find obscene.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#73

Post by kick »

stock_toaster wrote: post #62
Eiriksmal wrote: post #59

Earlier quoted context omitted.

I could never think of why Mozilla and friends are so aggressively pushing DoH, but I think you nailed it when you pointed out they can tie a specific device's DNS requests to its other data. I run Unbound and Pi-Hole to do my own recursive resolving. Like a normal wireless router doing all the DNS lookups for its DHCP clients, Mozilla has no idea which particular device on my network is accessing duckduckgo.com. Onc…

> For all the commenters here who think that Google and the other major tech companies are somehow less trustworthy than your ISP? Yeah, I just can't agree with those opinions. Additionally, at least my ISP is doing business in my state/country, so there may be _some_ legal recourse if they screw me too hard.

DoH is only available in the U.S. for Firefox users as far as I'm aware, so all of the people who might be "screwed too hard" have legal recourse.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#74

Post by kiwidrew »

This extreme focus on DoH is really concerning me.

If you're worried about your recursive DNS resolver spying on you, the correct solution is to run your own recursive resolver.

I've been running unbound(8) on my OpenBSD systems at home for most of 2019, and (except for the time that I experimented with turning on strict DNSSEC checking) there hasn't been even one time that it has caused me grief. It was as simple as "rcctl enable unbound".

And OpenBSD has recently introduced unwind(8), a dead-simple recursive resolver (using libunbound) that's suitable for any system (even laptops that sometimes use broken Wifi access points or networks that block outbound port 53).

It is simply unacceptable for a modern operating system to lack its own recursive resolver. By all means, allow the network administrator to configure the system to use a network-provided resolver if required, but the default ought to be an intelligent unwind(8)-style resolver provided by the OS itself.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#75

Post by 7786655 »

Karunamon wrote: post #56
icebraining wrote: post #49

Earlier quoted context omitted.

So disable DoH in Firefox, or change the provider? If you know enough to choose a DoH provider, the browser defaults are not very relevant, presumably.

That's great for the handful of people that read Hacker News and understand DNS, it's a trash solution for the rest of the world. Defaults matter because they are rarely changed.

Right now the defaults are unencrypted DNS handled by ISPs which in the US have explicit legal permission to sell your data.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#76

Post by catalogia »

icebraining wrote: post #50
josteink wrote: post #22

Earlier quoted context omitted.

> It's probably a good thing? US ISPs The world is hella lot bigger than the US. And Firefox runs in the rest of the world too.

> And Firefox runs in the rest of the world too. But Firefox only enabled DoH by default in the US.

Is it only enabled in the US, or is it only enabled in the en-US build? How does firefox actually know what country I'm in? If I downloaded firefox in Washington and then drive up into BC, does Firefox disable DoH? How does it know?

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#77

Post by tptacek »

core-questions wrote: post #71
icebraining wrote: post #51

Earlier quoted context omitted.

> This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. How do you prevent the ISP from logging those requests to the root?

Hey, good point. I guess there's not much I can do about that yet, without DNSSEC or whatever.

DNSSEC does nothing whatsoever to prevent your ISP from logging your requests.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#78

Post by tptacek »

kiwidrew wrote: post #74

This extreme focus on DoH is really concerning me. If you're worried about your recursive DNS resolver spying on you, the correct solution is to run your own recursive resolver. I've been running unbound(8) on my OpenBSD systems at home for most of 2019, and (except for the time that I experimented with turning on strict DNSSEC checking) there hasn't been even one time that it has caused me grief. It was as simple as…

Running your own non-DOH recursive server does absolutely nothing to protect your queries from snooping; in fact, it increases your exposure, because every single step in the recursive queries you run are now in plaintext on the wire and each attributable to your server.

Running your own recursive DOH server is a fine idea, and easy to do, but then you have little to be angry at Mozilla about, because they're the ones enabling you to do that.

The fact that no mainstream consumer OS runs a local recursive resolver should be a clear signal to you that people disagree with you about this; in particular, because doing so eliminates DNS caching, which is something most people want.

People are "extremely focused" on DOH because it works, and works without having to secure the cooperation of every DNS operator on the Internet, and with almost no configuration. It is a clean, easy win, unlike every other DNS security mechanism ever proposed.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#79

Post by hu3 »

kick wrote: post #73
stock_toaster wrote: post #62

Earlier quoted context omitted.

> For all the commenters here who think that Google and the other major tech companies are somehow less trustworthy than your ISP? Yeah, I just can't agree with those opinions. Additionally, at least my ISP is doing business in my state/country, so there may be _some_ legal recourse if they screw me too hard.

DoH is only available in the U.S. for Firefox users as far as I'm aware, so all of the people who might be "screwed too hard" have legal recourse.

For now.

Re: NextDNS Joins Firefox’s Trusted Recursive Resolver

#80

Post by e12e »

kiwidrew wrote: post #74

This extreme focus on DoH is really concerning me. If you're worried about your recursive DNS resolver spying on you, the correct solution is to run your own recursive resolver. I've been running unbound(8) on my OpenBSD systems at home for most of 2019, and (except for the time that I experimented with turning on strict DNSSEC checking) there hasn't been even one time that it has caused me grief. It was as simple as…

Hm, looks like unwind just falls back to letting the local recursive resolver spy on you in case port 53 is blocked, though? I guess it + local recursive resolver between them might have bit of a cache - but the browser could also cache dns more aggressively (not that I think that'd be a good idea).

Not saying it's bad to run unwind, just that if the scenario is that the router blocks access to root servers, and the local resolver spys on you - it (alone) won't help?

And with a spying local resolver, I'd assume the router logs plain text udp traffic anyway...

https://man.openbsd.org/unwind.8

Post reply on HN