6 ms·
Internet group brands Mozilla “internet villain” for supporting DNS privacy
- lol768 7y agoTells me everything I ever wanted to know about ISPA. Did they even notice the juxtaposition of recognising Sir Tim Berners-Lee with an award for a campaign to "protect the open and free nature of the Internet" and simultaneously branding Mozilla a "villain" for their work on DoH? Was glad to see my ISP (Netcalibre) is not a member and sponsors the Open Rights Group instead: https://twitter.com/lchost/status/1147090360226783233 https://twitter.com/lchost/status/1147090360226783233 AAISP should also be commended for donating an amount equal to the ISPA membership fees directly to Mozilla: https://twitter.com/aaisp/status/1146803916853645314 https://twitter.com/aaisp/status/1146803916853645314
- philjohn 7y agoAAISP's twitter post on it was amazing ... snark personified, and why they are one of the best ISP's in the UK - technically brilliant management of their network and all around decent people.
- chmod775 7y agoThere may be independent factions within that organization that each came up with their own nominations. That's how you end up with that kind of apparent outward cognitive dissonance.
- dijit 7y agorevk has written a little about this as well. He's the chief geek at AAISP. https://www.revk.uk/2019/07/doh-and-vpns-and-trust.html https://www.revk.uk/2019/07/doh-and-vpns-and-trust.html
- CommieBobDole 7y agoSo they built a content-blocking feature based on a design flaw that can be trivially bypassed? And now the people who are bypassing the flaw are villains? That's some top-notch work there, ISPA.
- jchw 7y agoI’ve been gleefully watching DNS over HTTPS break all kinds of things that are terrible practices, including ISPs that hijack NXDOMAIN responses for SPAM search pages even when using other DNS providers. Here’s to hoping someone comes up with better solutions for captive portal redirects, though.
- lol768 7y agoI believe there's been a better solution to captive portal redirects for quite some time now, via the medium of DHCP and/or RAs - https://tools.ietf.org/html/rfc7710 https://tools.ietf.org/html/rfc7710. Unsure why we've not yet seen much adoption.
- marcosdumay 7y agoI've seen almost universal adoption of it (at hotels, airports, etc). Since around 2 years ago nearly all the networks I connect anounce their portals through DHCP.
- lol768 7y agoInteresting to hear! Do you mind sharing your rough location?
- marcosdumay 7y agoI live in Brazil, on those last years I've also traveled to Mexico and Cabo Verde, visiting airports also on Panama and Portugal. I've notice the DHCP announcements on all those places.
- morpheuskafka 7y agoIt's almost like the purpose of an ISP is to transmit internet traffic to the internet for you--not to filter traffic, block certain ports, lie about DNS responses, or otherwise have anything to do with the actual content of your communications. Imagine if the telephone company listened to you calls to block prohibited topics, replaced the other person's responses with ads, and opposed people who tried to talk in code. It's definitely a Good Thing that technical measures are rendering this garbage unworkable.
- nathan-io 7y agoUnderstandable. How are ISPs supposed to keep mining and monetizing browsing history if everyone starts using DoH?
- feanaro 7y agoBy looking at SNI, sadly.
- yegortimoshenko 7y agohttps://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/
- a012 7y agoWe're still far from seeing eSNI in mainstream.
- zzzcpan 7y agoDoH doesn't bring any privacy or censorship circumvention, it still allows ISPs to mine and monetize browsing history all they want, only creating temporary inconvenience. It lets more parties to get your data though and is more friendly to state mass surveillance.
- xref 7y agoLots of claims here but no descriptions of how DoH is worse for end users
- zzzcpan 7y agoTry to search DoH on HN, these issues were discussed many times before. Essentially DoH leaks more data to more third parties, without being able to withhold that data from those who already can get it, hence violating privacy, not improving it.
- vorticalbox 7y agoMost vpns also contain DNS query so ISPs can't see them how is this any different?
- criddell 7y agoVPN usage is very much a fringe activity compared to just browsing with Firefox.
- DavideNL 7y agoI suppose because only a small percentage of the population (techies) uses a Vpn. Now, everyone (who uses Firefox) gets this feature and apparently soon it will also be enabled by default: "...the goal of deploying DoH by default for our users" : https://blog.mozilla.org/security/2019/04/09/dns-over-https-policy-requirements-for-resolvers/ https://blog.mozilla.org/security/2019/04/09/dns-over-https-...
- detaro 7y agodupe: https://news.ycombinator.com/item?id=20362548 https://news.ycombinator.com/item?id=20362548 https://news.ycombinator.com/item?id=20358300 https://news.ycombinator.com/item?id=20358300
- kreetx 7y agoThere are other ways to protect the users. The people deciding on these awards should inform themselvs better on the whys of it. Instead of labeling perhaps ISPA should look into collaboration with Mozilla instead?
- syshum 7y agoMy biggest problem with Mozilla's DNS over HTTPS is their partnership with CloudFlare Cloudflare is not a supporter for Free and Open Internet, and is just as much a danger to online privacy as the rest of the Large Technology Companies like Google and Facebook Edit: The Undying Support for CloudFlare is amusing, reminds me of all the defenders of Google years ago until they turned evil... Power Corrupts, the key is to not give these companies the power. The amount of data the flows through CloudFlare's various products should be alarming to anyone that understand Computer Science, history, etc. Sad that many here are willfully ignorant to the threat CloudFlare poses
- user17843 7y ago> and is just as much a danger to online privacy as the rest of the Large Technology Companies like Google and Facebook how so?
- mfatica 7y ago[citation needed]
- zzzcpan 7y agoCloudflare doesn't welcome you if you don't let it track you and run arbitrary code it injects. You can verify that by disabling javascript and/or using proxies, vpns, tor.
- skywhopper 7y agoBad headline by TechCrunch. This is not an "internet group" (which in context implies something like ICANN). It's a UK-specific business association of ISPs who have an interest in preventing browsers from assisting user privacy.
- hedora 7y agoI cannot imagine a stronger endorsement of DNS-over-HTTPS than the content of this article. How do I set my router to proxy all outgoing DNS to HTTPS?
- mfatica 7y agoIt varies depending on your router and what it's running. Cloudflare has instructions for OpenWRT
- anaphor 7y agoYour router is going to have to support it somehow. It's much easier to just run a local resolver like stubby + dnsmasq. Apparently Cloudflare also has some kind of daemon you can run on Windows, but I don't know if I would recommend that route.
- saltyshake 7y agoThis is bad news for a lot of users in countries with censorship. The censors would end up blocking entire IP ranges if they can't block domains.
- ptaipale 7y agoAnd then the censors' regimes fall back in technical and economical development, while they really can't stop true adversaries anyway.
- anaphor 7y agoHere are some great instructions on how to get set up with Stubby, which is a DNS over HTTPS resolver you can run on Linux. I was able to get it working fairly quickly. The instructions apply to pretty much any distro (I got it working on both Arch and Ubuntu). You can also easily set it up to work with dnsmasq to do caching. https://wiki.archlinux.org/index.php/Stubby https://wiki.archlinux.org/index.php/Stubby After setting up dnsmasq I did not notice any performance hit, and in fact it worked more reliably than my previous DNS settings.
- snvzz 7y agoIt's also possible (and I recommend) to set up the dns resolver for the LAN to be unbound (openbsd's recursive dns server, supports DNS over HTTPS), thus allowing all devices in the lan to transparently use DNS over HTTPS. Alternatively, there's dnscrypt-proxy, but it's somewhat slow and eats way too much ram.
- verisimilitudes 7y agoOh yes, use DNS over HTTPS for your privacy. Just look at these organizations that oppose it. While I'm at it, you totally can't break into an Apple iPhone™ and all the cool pedophiles should be using that, for safety. DNS over HTTPS does nothing for privacy and merely takes control from the DNS providers or user. Companies want to be able to run everything over HTTPS so you can't block any of it without blocking all of it. They can go to Hell.