5 ms·

I enabled DNS over HTTPs in the recent past, and was very happy with it. Until I came to test a staging-version of a website and discovered that updating `/etc

I enabled DNS over HTTPs in the recent past, and was very happy with it. Until I came to test a staging-version of a website and discovered that updating `/etc/hosts` to change the IP of the given name no longer worked. It took me an embarassingly long time to realise I was still visiting the production site.

ShinTakuya 7y ago
Using the hosts file to visit a staging environment is a gross practice anyway. Just make the domain configurable in your code and either but the IP directly or make some subdomain (or better yet, separate domain) redirect to it.
- chousuke 7y ago
  That doesn't always work. There are migration scenarios where you have to use the correct domain to be able to test everything properly.
  - ShinTakuya 7y ago
    I'm not convinced that's the same situation or if what you're describing is necessary in the majority of cases. Using the "correct" domain shouldn't be the norm - it should be an exceptional circumstance. As demonstrated in the above comment, it's easy to accidentally hit the production environment at which point you may be convinced that everything is alright and ship a broken change to production.
    - bpizzi 7y ago
      In theory I agree with your stance. OTOH, in the real world, almost all websites that I've got to migrate are somewhat hardcoded for one domain (I've got this side project were I do websites hosting, good recurring money, little work). Going for /etc/hosts is the only pragmatic choice here.
      - ShinTakuya 7y ago
        Yeah, you're right, I'm all for pragmatism when it's just a small site not in active development. I just didn't want people getting the idea that this is a good practice. It's a hack, and a dangerous one at that, but hacks can be okay depending on the circumstance.
- jbverschoor 7y ago
  It's actually really nice to be able to specify a hostname without having to rely on a zillion other services to b available and work. Heck.. maybe there's something wrong with the loadbalancing dns. Keep - things - separated - isolated - small
- stevekemp 7y ago
  On the one hand yes, what you say makes a lot of sense. In an ideal world you'd have dev, staging, production, all using different configs. Of course then they might different pushes to production might fail. But one of the things that I'm testing is that SSL, HST-pinning, etc, is working. So I could fuck around with adding "--header" arguments to curl, etc. But really I want to test in a browser and if the name doesn't match I'll have issues.
- drenvuk 7y ago
  It's a quick way to get around iframe requests when the site in question has something like frame-ancestors set and you're doing local development against it. Ignoring the hosts file makes development more difficult. I like firefox and I develop for it first before chrome and safari but I don't agree with your assessment or theirs.
buckminster 7y ago
And it's WONTFIX: https://bugzilla.mozilla.org/show_bug.cgi?id=1453207 https://bugzilla.mozilla.org/show_bug.cgi?id=1453207
- vinay_ys 7y ago
  Wow. Mozilla is breaking the standard working stuff like big bullies do.
  - Karunamon 7y ago
    This is my main issue with DoH. The DNS resolver configuration is a system level setting and it is on applications to honor those settings, not do their own special snowflakey thing for whatever reason.
    - dngray 7y ago
      TBH mozilla is right about that though. There's better ways than using /etc/hosts. I run DNSCrypt and Unbound on my router: https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Unbound_DNS_forwarder_with_dnscrypt https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... then I simply point my DNS at my router IP. All DNS lookups are then done over DNSCrypt and over the VPN regardless of software, platform, or application. If I want to block a site I simply add it to filter.conf, ie https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Blocking_Microsoft_Telemetry_on_the_network_by_domain https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... local-zone: "example.com" redirect local-data: "example.com A 0.0.0.1"
      - Karunamon 7y ago
        I’m not clear on how this is “better”. I also run my own DNS server at home- sometimes I want to override resolution for a handful of addresses on a single client, and now (soon) I can’t do that anymore without some likely-convoluted workaround. It would be nice if Mozilla would stop breaking my shit and stop dishonoring my settings. This dread GNOME disease of knowing better than the user needs to stop.

ShinTakuya 7y ago

Using the hosts file to visit a staging environment is a gross practice anyway. Just make the domain configurable in your code and either but the IP directly or make some subdomain (or better yet, separate domain) redirect to it.

chousuke 7y ago
That doesn't always work. There are migration scenarios where you have to use the correct domain to be able to test everything properly.
- ShinTakuya 7y ago
  I'm not convinced that's the same situation or if what you're describing is necessary in the majority of cases. Using the "correct" domain shouldn't be the norm - it should be an exceptional circumstance. As demonstrated in the above comment, it's easy to accidentally hit the production environment at which point you may be convinced that everything is alright and ship a broken change to production.
  - bpizzi 7y ago
    In theory I agree with your stance. OTOH, in the real world, almost all websites that I've got to migrate are somewhat hardcoded for one domain (I've got this side project were I do websites hosting, good recurring money, little work). Going for /etc/hosts is the only pragmatic choice here.
    - ShinTakuya 7y ago
      Yeah, you're right, I'm all for pragmatism when it's just a small site not in active development. I just didn't want people getting the idea that this is a good practice. It's a hack, and a dangerous one at that, but hacks can be okay depending on the circumstance.
jbverschoor 7y ago
It's actually really nice to be able to specify a hostname without having to rely on a zillion other services to b available and work. Heck.. maybe there's something wrong with the loadbalancing dns. Keep - things - separated - isolated - small
stevekemp 7y ago
On the one hand yes, what you say makes a lot of sense. In an ideal world you'd have dev, staging, production, all using different configs. Of course then they might different pushes to production might fail. But one of the things that I'm testing is that SSL, HST-pinning, etc, is working. So I could fuck around with adding "--header" arguments to curl, etc. But really I want to test in a browser and if the name doesn't match I'll have issues.
drenvuk 7y ago
It's a quick way to get around iframe requests when the site in question has something like frame-ancestors set and you're doing local development against it. Ignoring the hosts file makes development more difficult. I like firefox and I develop for it first before chrome and safari but I don't agree with your assessment or theirs.

buckminster 7y ago

And it's WONTFIX: https://bugzilla.mozilla.org/show_bug.cgi?id=1453207 https://bugzilla.mozilla.org/show_bug.cgi?id=1453207

vinay_ys 7y ago
Wow. Mozilla is breaking the standard working stuff like big bullies do.
- Karunamon 7y ago
  This is my main issue with DoH. The DNS resolver configuration is a system level setting and it is on applications to honor those settings, not do their own special snowflakey thing for whatever reason.
  - dngray 7y ago
    TBH mozilla is right about that though. There's better ways than using /etc/hosts. I run DNSCrypt and Unbound on my router: https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Unbound_DNS_forwarder_with_dnscrypt https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... then I simply point my DNS at my router IP. All DNS lookups are then done over DNSCrypt and over the VPN regardless of software, platform, or application. If I want to block a site I simply add it to filter.conf, ie https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Blocking_Microsoft_Telemetry_on_the_network_by_domain https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... local-zone: "example.com" redirect local-data: "example.com A 0.0.0.1"
    - Karunamon 7y ago
      I’m not clear on how this is “better”. I also run my own DNS server at home- sometimes I want to override resolution for a handful of addresses on a single client, and now (soon) I can’t do that anymore without some likely-convoluted workaround. It would be nice if Mozilla would stop breaking my shit and stop dishonoring my settings. This dread GNOME disease of knowing better than the user needs to stop.