Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla’s DNS over HTTPs

blog.mozilla.org

Post reply on HN
Print view View original

71–80 of 777 posts

Re: Mozilla’s DNS over HTTPs

#71

Post by stiray »

larrysalibra wrote: post #44

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…

Will they roll it out in Canada? Raising eyebrow and thinking if it has anything to do with GDPR

Re: Mozilla’s DNS over HTTPs

#72

Post by ComputerGuru »

ekimekim wrote: post #63
ComputerGuru wrote: post #31

Can someone please explain why there can’t be a DHCP or RA option for which DoH server to use? Why are we going out of our way to make sure the sysadmin has to configure each and every piece of software on each and every single PC rather than just set it one in a centralized location, like every other networking option? DoH will leave my machines unable to resolve all my internal domain names, right?

I'm not sure how firefox could implement this entirely on their end. There would need to be cooperation on the OS (or dhcp client) side to expose that option somehow. We're in this mess because OSes haven't acted and Mozilla has had to take matters into their own hands. Unfortunately any solution that requires cooperation from other software is going to take a lot longer to land. I do hope it happens eventually, and…

I don't think so. Someone like Mozilla can "claim" a DHCP option code and say "this is what we are going to use, operating systems can climb aboard if they want."

Re: Mozilla’s DNS over HTTPs

#73

Post by WanderPanda »

nemothekid wrote: post #33
davidu wrote: post #11

Earlier quoted context omitted.

Not sure what any of your reply means. Adding OS support isn’t required. People just run a local resolver that supports these things. No different than any other application. Nothing arcane. Certainly no more than HTTP and SSL. I think you have some reading to do.

>* People just run a local resolver that supports these things.* How many people do you know that running local resolvers? How would this even work on Windows? The world doesn’t need another encrypted dns solution that only works on Linux

How would this even work on iOS?

Re: Mozilla’s DNS over HTTPs

#74

Post by Jonnax »

userbinator wrote: post #64
Jonnax wrote: post #28

Earlier quoted context omitted.

I think part of the negativity you see is network admins working in businesses. Their opinion is that it's a way for people to get around corporate firewalls. Kinda blind to the idea that if a browser can implement DNS over HTTPS then anything can. Especially since there's some of ways that Mozilla have implemented for a local area DNS server to override its settings. There's also another camp, if you remember the "i…

I'm not a network admin working in a business, but I am the network admin of my home network, and I really do not want applications starting to effectively contain their own VPN clients and subverting my control.

DNS isn't a VPN nor really a security product. It's just a look up table.

The job blocking domains should be the job of a firewall. Of course this becomes more complex. But any application can implement DNS over HTTPS.

Malware could even just get a list of IPs from another IP.

An application can even just hard code IPs rather than using DNS and then they're in the same position.

Re: Mozilla’s DNS over HTTPs

#75

Post by zaarn »

drenginian wrote: post #15
davidu wrote: post #11

Earlier quoted context omitted.

Not sure what any of your reply means. Adding OS support isn’t required. People just run a local resolver that supports these things. No different than any other application. Nothing arcane. Certainly no more than HTTP and SSL. I think you have some reading to do.

>> People just run a local resolver that’s support’s these things. Nowhere do “people just run a local resolver”. Grandma and aunty Beryl certainly don’t, nor does any other ordinary person. If you want secure DNS you have to build it in to the browser. Only systems people think that this is the sort of thing that ordinary people do.

I think the better solution is "build it into the browser and wait for systems to support it natively".

Re: Mozilla’s DNS over HTTPs

#76

Post by userbinator »

ocdtrekkie wrote: post #29
drenginian wrote: post #3

Why are people so down on DNS over HTTPS? DNS is the primary way governments control and spy on web access.

For one, it’s ironically first being deployed in countries where DNS manipulation by the government isn’t happening (US first generally), but Google has competitive concerns with ISPs getting ad targeting data. I feel like defending against oppressive governments is being used more as an excuse than a driving motivation. The primary concern seems to be that Google really wants to protect its monopoly, and Firefox, as…

Decades of experience have told me that whenever some big organisation wants to do something in the name of "security", it's almost always an excuse to remove freedom and force their control over everyone.

Yes, that includes oppressive governments too... but I hardly think that even more centralisation is the solution.

The old security vs freedom quote is surprisingly relevant in so many situations today.

Re: Mozilla’s DNS over HTTPs

#77

Post by krn »

larrysalibra wrote: post #44

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature a…

> What’s in it for the Cloudflare & NextDNS?

It gives them a competitive advantage in DNS industry against other B2B providers, such as NS1.

Re: Mozilla’s DNS over HTTPs

#78

Post by jedieaston »

ComputerGuru wrote: post #31

Can someone please explain why there can’t be a DHCP or RA option for which DoH server to use? Why are we going out of our way to make sure the sysadmin has to configure each and every piece of software on each and every single PC rather than just set it one in a centralized location, like every other networking option? DoH will leave my machines unable to resolve all my internal domain names, right?

Firefox is still falling back to local DNS settings if it can't resolve stuff using the currently set DoH provider, as I can access resources in Firefox on my university's network that cannot be resolved outside it.

Re: Mozilla’s DNS over HTTPs

#79

Post by maxwellito »

I'm really looking forward to enable the feature on my personal computer. But as long as Firefox DoH ignores my /etc/hosts configuration, I won't use it.

I hope it's just a matter of time before they fix this :)

Re: Mozilla’s DNS over HTTPs

#80

Post by jeroenhd »

ekimekim wrote: post #63
ComputerGuru wrote: post #31

Can someone please explain why there can’t be a DHCP or RA option for which DoH server to use? Why are we going out of our way to make sure the sysadmin has to configure each and every piece of software on each and every single PC rather than just set it one in a centralized location, like every other networking option? DoH will leave my machines unable to resolve all my internal domain names, right?

I'm not sure how firefox could implement this entirely on their end. There would need to be cooperation on the OS (or dhcp client) side to expose that option somehow. We're in this mess because OSes haven't acted and Mozilla has had to take matters into their own hands. Unfortunately any solution that requires cooperation from other software is going to take a lot longer to land. I do hope it happens eventually, and…

It can get even more complicated when you have multiple connections on your machine, each with a different DNS server. You'd need to match the DNS server determination algorithm of the operating system to remain consistent, which is one hell of a task.

There's also the fact that there's no DHCP option reserved for DoH/DoT/DNScrypt (yet) which requires some standardisation work.

There's various APIs to read the current DHCP configuration for a network interface so technically it shouldn't be too hard (at least not when it comes to Windows or macOS where there's standard APIs, as opposed to Linux whose modular layout makes finding a standard location for DHCP config difficult).

Post reply on HN