3 ms·

The article lacks instructions about disabling it or using some other DOH resolvers. about:config -> search for network.trr -> set network.trr.mode = 5 to comp

by rendx 8y ago

The article lacks instructions about disabling it or using some other DOH resolvers. about:config -> search for network.trr -> set network.trr.mode = 5 to completely disable it (I do not recommend this) The curl wiki has a list of DOH servers: https://github.com/curl/curl/wiki/DNS-over-HTTPS https://github.com/curl/curl/wiki/DNS-over-HTTPS It should also point to "the other side of the story", the benefits of DOH over classic DNS resolving, for example https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-ove...

telmich 8y ago
Thanks for the hint! We added that to our blog entry - please let us know if it sounds right to you.
- opencl 8y ago
  The default is already off[1] though... Mozilla has stated plans to eventually turn it on by default[2] but I have yet to see any timeline or details of what the default config will actually be. Your article seems to assert that it will be on by default in FF62, where did Mozilla ever say this? Everything I have read seems to indicate that FF62 is just adding support, which is off by default, and requires a change to about:config to enable in the first place. [1] https://gist.github.com/bagder/5e29101079e9ac78920ba2fc718aceec https://gist.github.com/bagder/5e29101079e9ac78920ba2fc718ac... [2] https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/ https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...
- dblohm7 8y ago
  You're operating under the assumption that if this is turned on by default in the future, everything will go to CloudFlare. While CloudFlare is being used for the opt-in study, you have no evidence that they will be used in any on-by-default scenario. Nor do you have any evidence that only a single DoH provider will be used globally. Perhaps you should monitor Mozilla mailing lists.
vetinari 8y ago
Manually setting static resolvers is not adequate in many scenarios. For example, when the user roams among several networks, and each of them has split-horizon DNS, the user is not going to re-set their setting after connecting to each specific network. Throw in VPN connections and their DNS settings, and you have quite a problem at hand. There's a reason why DNS settings are traditionally set system-wide via DHCP, not statically. This is a step backwards.
rendx 8y ago
Correction: .mode = 0 disables it!
teddyfrozevelt 8y ago
Considering the default is off, anyone that goes out of their way to turn this on should remember how to turn it back off.

by rendx 8y ago

telmich 8y ago

Thanks for the hint! We added that to our blog entry - please let us know if it sounds right to you.

opencl 8y ago
The default is already off[1] though... Mozilla has stated plans to eventually turn it on by default[2] but I have yet to see any timeline or details of what the default config will actually be. Your article seems to assert that it will be on by default in FF62, where did Mozilla ever say this? Everything I have read seems to indicate that FF62 is just adding support, which is off by default, and requires a change to about:config to enable in the first place. [1] https://gist.github.com/bagder/5e29101079e9ac78920ba2fc718aceec https://gist.github.com/bagder/5e29101079e9ac78920ba2fc718ac... [2] https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/ https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...
dblohm7 8y ago
You're operating under the assumption that if this is turned on by default in the future, everything will go to CloudFlare. While CloudFlare is being used for the opt-in study, you have no evidence that they will be used in any on-by-default scenario. Nor do you have any evidence that only a single DoH provider will be used globally. Perhaps you should monitor Mozilla mailing lists.

vetinari 8y ago

Manually setting static resolvers is not adequate in many scenarios. For example, when the user roams among several networks, and each of them has split-horizon DNS, the user is not going to re-set their setting after connecting to each specific network. Throw in VPN connections and their DNS settings, and you have quite a problem at hand. There's a reason why DNS settings are traditionally set system-wide via DHCP, not statically. This is a step backwards.

rendx 8y ago

Correction: .mode = 0 disables it!

teddyfrozevelt 8y ago

Considering the default is off, anyone that goes out of their way to turn this on should remember how to turn it back off.