5 ms·

Totally agree re: implementation details. And, like you said, this is a bad idea. Is there something wrong with efforts like DNSCrypt + DNSSec? That's supposed

Totally agree re: implementation details. And, like you said, this is a bad idea. Is there something wrong with efforts like DNSCrypt + DNSSec? That's supposed to provide authentication and encryption to DNS without sending everything over HTTP. Did Mozilla just totally ignore the work that's already been done in this area?

HurrdurrHodor 8y ago
Just a guess but maybe they wanted to build this in a way that it would actually get used.
- mike-cardwell 8y ago
  There's no reason that Firefox couldn't check for the existence of a local DOH resolver, and if it doesn't see one, pop up a one time message offering to install one for you. Every operating system has a system wide way of resolving names to IP addresses, and every application uses it. This new architecture of building custom name resolution into individual applications might be easier for them to build, but it's crap.
- madmax96 8y ago
  That doesn't address my concerns, actually. Mozilla is doing two things: 1. Bundling DNS with the browser (e.g. ignoring system DNS) 2. Using DNS over HTTPS Mozilla could still do (1) and then use DNSCrypt + DNSSEC internally. Then, it would actually be used, but they'd be relying on existing technology that actually fits the use-case, rather than DNS-over-HTTPS. For the record, I don't think you should ignore the system's DNS, either.
tptacek 8y ago
DNSSEC doesn't do any of what DoH does. It doesn't provide query privacy. It doesn't even typically protect the last mile between end-user resolvers and servers; it's a server-to-server protocol. I'm deeply skeptical (to put it nicely) about DNSSEC, but you don't even have to share that perspective to see why DoH is useful --- it covers a set of problems DNSSEC simply doesn't address. DNSCrypt is a niche protocol that basically does do what DoH does. Very few people use it. You can use it instead of DoH, if you like; just disable DoH in Firefox and set up DNSCrypt with your system resolver.

HurrdurrHodor 8y ago

Just a guess but maybe they wanted to build this in a way that it would actually get used.

mike-cardwell 8y ago
There's no reason that Firefox couldn't check for the existence of a local DOH resolver, and if it doesn't see one, pop up a one time message offering to install one for you. Every operating system has a system wide way of resolving names to IP addresses, and every application uses it. This new architecture of building custom name resolution into individual applications might be easier for them to build, but it's crap.
madmax96 8y ago
That doesn't address my concerns, actually. Mozilla is doing two things: 1. Bundling DNS with the browser (e.g. ignoring system DNS) 2. Using DNS over HTTPS Mozilla could still do (1) and then use DNSCrypt + DNSSEC internally. Then, it would actually be used, but they'd be relying on existing technology that actually fits the use-case, rather than DNS-over-HTTPS. For the record, I don't think you should ignore the system's DNS, either.

tptacek 8y ago

DNSSEC doesn't do any of what DoH does. It doesn't provide query privacy. It doesn't even typically protect the last mile between end-user resolvers and servers; it's a server-to-server protocol. I'm deeply skeptical (to put it nicely) about DNSSEC, but you don't even have to share that perspective to see why DoH is useful --- it covers a set of problems DNSSEC simply doesn't address. DNSCrypt is a niche protocol that basically does do what DoH does. Very few people use it. You can use it instead of DoH, if you like; just disable DoH in Firefox and set up DNSCrypt with your system resolver.