5 ms·

An update is that on Reddit a Firefox employee has responded on my crosspost to reddit: https://www.reddit.com/r/firefox/comments/9cx8hk/on_firefox_moving_dns_t

An update is that on Reddit a Firefox employee has responded on my crosspost to reddit: https://www.reddit.com/r/firefox/comments/9cx8hk/on_firefox_moving_dns_to_a_third_party/ https://www.reddit.com/r/firefox/comments/9cx8hk/on_firefox_... Clarifying that this is just an A/B test and there are no plans to continue using CloudFlare for all users.

kodablah 8y ago
To clarify, only in nightly and previously disclosed [0] (results at [1]). The article is right to be fearful that FF is pondering a default change, but until that is even on the table, I'm not worried. Now if they wanted to make it really really easy for regular users to change from your default ISP DNS to CloudFlare, I'd actually be OK with that, but I'd expect it to be implemented like search engine providers where anyone could just as easily be the DNS provider chosen (ideally without any CloudFlare favoritism). And it would be clear who your DNS provider is maybe via an icon (if there is real estate for it). 0 - https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/ https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr... 1 - https://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-secure-dns-experimental-results/ https://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-...
- sp332 8y ago
  They have a contract with CloudFlare with stronger privacy protections for FF users. This goes beyond the normal CloudFlare privacy policy. https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... They're not just picking providers at random.
  - kodablah 8y ago
    I am a bit naive. Who is paying who in this contract? What is either side getting out of it? Why can it not just be a pluggable DNS provider situation and let CloudFlare compete with anyone else for opt-in (including extra privacy features if so desired)? Also curious, why would CloudFlare offer stronger privacy protections for one type of user and not another...what is CloudFlare getting out of the lesser-protected users since it is clear everyone is not given the same treatment?
    - sp332 8y ago
      It will almost certainly be configurable. My point is that you'd have to evaluate the privacy policy of each provider for yourself which is more work than just picking from a drop-down menu. And even if you put in the normal CF endpoint, you would only be covered by the normal CF ToS and not by Firefox's special deal. The "favoritism" has a material impact on privacy.
      - kodablah 8y ago
        Surely it can be seen why this comes off as shady. Browser vendor inks deal w/ third party company. Deal includes special provisions company will not otherwise provide users of its service. Browser vendor promises to give preference to third party company. Details of deal, at least to me, are not very transparent. In general I agree that using other DNS providers besides the ISPs has benefits. But not sure I think it should funnel to a single, preferred company. Nor do I think that they should collect anything at all, reduced compared to their original or not. I think some transparency is deserved here about the contract if/when a regular FF release is shipped encouraging users to use Cloudflare, specifically around the motives of wanting this data. Granted, I am a bit more paranoid than most.
    - detaro 8y ago
      This was a one-off experiment with a really new technology, it makes sense to go with one global provider for that. (If you want to use it already outside that, you can enable it and set a server of your own choice) If they intended to ship with DoH default-enabled, I'd hope Mozilla would not go with any single provider as a default.
      - kodablah 8y ago
        Agreed on all fronts. A single provider for tests makes plenty of sense. Time will tell whether the deal amongst the two companies has legs beyond this test.
    - majorae 8y ago
      What Cloudflare wants is the most people/consumers possible using their DNS. Doing so will make lookups and translations faster for their customers than anyone else as the content is basically on the same network as the DNS lookup. When they go sell Enterprise content delivery services to their big customers they can tout a huge base of users tied to their DNS and sell on the performance enhancement these people will see when accessing Cloudflare customers content. CDN is all about shaving milliseconds off of content delivery and having a huge base of consumers using Cloudflare for DNS differentiates them and provides a measurable performance increase.
  - Ahl4Gom6 8y ago
    CF is an american company. They are subject to NSLs. Why should anything they say be trusted?
ahubert 8y ago
According to the tweet linked from the post: "DoH might become enabled by default at some point, which is what has been said. But no-one has specified exactly how or with which operators (yes, plural). Because we don't know. That's not planned yet. And "might" is still "might [not]" as well." (the [not] was not there, but I think this is what Daniel meant). https://twitter.com/bagder/status/1036364374728953858 https://twitter.com/bagder/status/1036364374728953858

kodablah 8y ago

To clarify, only in nightly and previously disclosed [0] (results at [1]). The article is right to be fearful that FF is pondering a default change, but until that is even on the table, I'm not worried. Now if they wanted to make it really really easy for regular users to change from your default ISP DNS to CloudFlare, I'd actually be OK with that, but I'd expect it to be implemented like search engine providers where anyone could just as easily be the DNS provider chosen (ideally without any CloudFlare favoritism). And it would be clear who your DNS provider is maybe via an icon (if there is real estate for it). 0 - https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/ https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr... 1 - https://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-secure-dns-experimental-results/ https://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-...

sp332 8y ago
They have a contract with CloudFlare with stronger privacy protections for FF users. This goes beyond the normal CloudFlare privacy policy. https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... They're not just picking providers at random.
- kodablah 8y ago
  I am a bit naive. Who is paying who in this contract? What is either side getting out of it? Why can it not just be a pluggable DNS provider situation and let CloudFlare compete with anyone else for opt-in (including extra privacy features if so desired)? Also curious, why would CloudFlare offer stronger privacy protections for one type of user and not another...what is CloudFlare getting out of the lesser-protected users since it is clear everyone is not given the same treatment?
  - sp332 8y ago
    It will almost certainly be configurable. My point is that you'd have to evaluate the privacy policy of each provider for yourself which is more work than just picking from a drop-down menu. And even if you put in the normal CF endpoint, you would only be covered by the normal CF ToS and not by Firefox's special deal. The "favoritism" has a material impact on privacy.
    - kodablah 8y ago
      Surely it can be seen why this comes off as shady. Browser vendor inks deal w/ third party company. Deal includes special provisions company will not otherwise provide users of its service. Browser vendor promises to give preference to third party company. Details of deal, at least to me, are not very transparent. In general I agree that using other DNS providers besides the ISPs has benefits. But not sure I think it should funnel to a single, preferred company. Nor do I think that they should collect anything at all, reduced compared to their original or not. I think some transparency is deserved here about the contract if/when a regular FF release is shipped encouraging users to use Cloudflare, specifically around the motives of wanting this data. Granted, I am a bit more paranoid than most.
  - detaro 8y ago
    This was a one-off experiment with a really new technology, it makes sense to go with one global provider for that. (If you want to use it already outside that, you can enable it and set a server of your own choice) If they intended to ship with DoH default-enabled, I'd hope Mozilla would not go with any single provider as a default.
    - kodablah 8y ago
      Agreed on all fronts. A single provider for tests makes plenty of sense. Time will tell whether the deal amongst the two companies has legs beyond this test.
  - majorae 8y ago
    What Cloudflare wants is the most people/consumers possible using their DNS. Doing so will make lookups and translations faster for their customers than anyone else as the content is basically on the same network as the DNS lookup. When they go sell Enterprise content delivery services to their big customers they can tout a huge base of users tied to their DNS and sell on the performance enhancement these people will see when accessing Cloudflare customers content. CDN is all about shaving milliseconds off of content delivery and having a huge base of consumers using Cloudflare for DNS differentiates them and provides a measurable performance increase.
- Ahl4Gom6 8y ago
  CF is an american company. They are subject to NSLs. Why should anything they say be trusted?

ahubert 8y ago

According to the tweet linked from the post: "DoH might become enabled by default at some point, which is what has been said. But no-one has specified exactly how or with which operators (yes, plural). Because we don't know. That's not planned yet. And "might" is still "might [not]" as well." (the [not] was not there, but I think this is what Daniel meant). https://twitter.com/bagder/status/1036364374728953858 https://twitter.com/bagder/status/1036364374728953858