5 ms·

Think of this more like which CA roots browsers include by default instead of a nefarious plan to stop you from doing whatever you want.

EvanAnderson 8y ago
It's not a nefarious plan to stop me from doing what I want in a FOSS browser on a PC where I can compile and run what I want. It will be used that way, however, on locked-down devices users pay for but don't actually own.
- shawnz 8y ago
  Then don't buy such a device which clearly doesn't meet your needs. Why should every personal computing device on the planet be tailored to your requirements, at the cost of safety for the majority of other users? Most people don't use PiHole, they use Adblock or uBlock which are not affected by this. It's not as though they are taking away your ability to use adblocking technology.
  - EvanAnderson 8y ago
    Macro-level view: The Mozilla Foundation may think that DNS-over-HTTPS is about "safety", but they're unwittingly furthering the agenda of those who would profit from the Internet not being decentralized. A decentralized Internet filled with devices that end users can control, should they choose, is a good thing for society, I'd argue. DNS-over-HTTPS is another piece of technology that can be used to eliminate that. It is not necessary to hand over freedom in exchange for "safety" or "security". Micro-level view: I'm a sysadmin for my Customers, my family, and some of my friends. Inevitably I will have to deal with these awful devices. So will countless other sysadmins. I'm dreading having to deal with devices that invade my users' privacy, thwart my attempts at detecting bad actors on the network, and that just generally act like the person who paid for them doesn't actually own them.
    - shawnz 8y ago
      Regarding your second point, this change will improve privacy for your clients and make it harder for bad actors to take advantage of your network. So what's not to like? Just because your old tooling won't work anymore doesn't mean that this change is a bad thing for clients.
      - vetinari 8y ago
        If it improves privacy for the clients, it also improves privacy for the malware, and you won't be able to monitor or be alerted of it.
        deleted 8y ago
        [deleted]
        stirfrykitty 8y ago
        Most modern firewalls can decrypt/re-encrypt all traffic on the fly. The end user doesn't even notice. I've done this at my last two jobs. More here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0 https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?...
        Murrawhip 8y ago
        What? The end user does notice if you haven't added the CA to the end user's PC.
        syshum 8y ago
        That works by Man in the middle attacks of SSL and Only works on Enterprise Networks for devices owned by the enterprise because the Enterprise Installs their own Root Certs on all devices that "tricks" the browsers into believing they are "google.com" not the real google.com
        shawnz 8y ago
        Right, which is exactly how it should be. If you want to perform a purposeful man in the middle attack on your clients, then you SHOULD be required to install your root cert on their workstations. With unencrypted DNS, it just means that you can perform the same attack with NO specific approval by the client workstation. How is that better?
  - swiley 8y ago
    > Then don't buy such a device which clearly doesn't meet your needs. That would be nice in an ideal world, unfortunately most of us live in reality.
    - shawnz 8y ago
      I don't know about you, but in the reality in which I live, privacy of the domain names I visit is a much bigger concern than being able to do access control with a technology that's not even made for access control.
  - apostacy 8y ago
    Then Mozilla should make a crippled "safe" version of their browser that has a hard coded list of trusted servers then. Because by making this the default, they are helping centralize the internet and greatly benefiting the entrenched powers while putting barriers to entry for the rest of us.
mike-cardwell 8y ago
It's not really equivalent. Our DNS servers know every single website we visit, and when we visit them. There's no way we should take that information and centralise it into the hands of a few big providers. No matter how many pinky promises they make to not look at it.

EvanAnderson 8y ago

It's not a nefarious plan to stop me from doing what I want in a FOSS browser on a PC where I can compile and run what I want. It will be used that way, however, on locked-down devices users pay for but don't actually own.

shawnz 8y ago
Then don't buy such a device which clearly doesn't meet your needs. Why should every personal computing device on the planet be tailored to your requirements, at the cost of safety for the majority of other users? Most people don't use PiHole, they use Adblock or uBlock which are not affected by this. It's not as though they are taking away your ability to use adblocking technology.
- EvanAnderson 8y ago
  Macro-level view: The Mozilla Foundation may think that DNS-over-HTTPS is about "safety", but they're unwittingly furthering the agenda of those who would profit from the Internet not being decentralized. A decentralized Internet filled with devices that end users can control, should they choose, is a good thing for society, I'd argue. DNS-over-HTTPS is another piece of technology that can be used to eliminate that. It is not necessary to hand over freedom in exchange for "safety" or "security". Micro-level view: I'm a sysadmin for my Customers, my family, and some of my friends. Inevitably I will have to deal with these awful devices. So will countless other sysadmins. I'm dreading having to deal with devices that invade my users' privacy, thwart my attempts at detecting bad actors on the network, and that just generally act like the person who paid for them doesn't actually own them.
  - shawnz 8y ago
    Regarding your second point, this change will improve privacy for your clients and make it harder for bad actors to take advantage of your network. So what's not to like? Just because your old tooling won't work anymore doesn't mean that this change is a bad thing for clients.
    - vetinari 8y ago
      If it improves privacy for the clients, it also improves privacy for the malware, and you won't be able to monitor or be alerted of it.
      - deleted 8y ago
        [deleted]
      - stirfrykitty 8y ago
        Most modern firewalls can decrypt/re-encrypt all traffic on the fly. The end user doesn't even notice. I've done this at my last two jobs. More here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0 https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?...
        Murrawhip 8y ago
        What? The end user does notice if you haven't added the CA to the end user's PC.
        syshum 8y ago
        That works by Man in the middle attacks of SSL and Only works on Enterprise Networks for devices owned by the enterprise because the Enterprise Installs their own Root Certs on all devices that "tricks" the browsers into believing they are "google.com" not the real google.com
        shawnz 8y ago
        Right, which is exactly how it should be. If you want to perform a purposeful man in the middle attack on your clients, then you SHOULD be required to install your root cert on their workstations. With unencrypted DNS, it just means that you can perform the same attack with NO specific approval by the client workstation. How is that better?
- swiley 8y ago
  > Then don't buy such a device which clearly doesn't meet your needs. That would be nice in an ideal world, unfortunately most of us live in reality.
  - shawnz 8y ago
    I don't know about you, but in the reality in which I live, privacy of the domain names I visit is a much bigger concern than being able to do access control with a technology that's not even made for access control.
- apostacy 8y ago
  Then Mozilla should make a crippled "safe" version of their browser that has a hard coded list of trusted servers then. Because by making this the default, they are helping centralize the internet and greatly benefiting the entrenched powers while putting barriers to entry for the rest of us.

mike-cardwell 8y ago

It's not really equivalent. Our DNS servers know every single website we visit, and when we visit them. There's no way we should take that information and centralise it into the hands of a few big providers. No matter how many pinky promises they make to not look at it.