7 ms·

And it's WONTFIX: https://bugzilla.mozilla.org/show_bug.cgi?id=1453207 https://bugzilla.mozilla.org/show_bug.cgi?id=1453207

vinay_ys 7y ago
Wow. Mozilla is breaking the standard working stuff like big bullies do.
- Karunamon 7y ago
  This is my main issue with DoH. The DNS resolver configuration is a system level setting and it is on applications to honor those settings, not do their own special snowflakey thing for whatever reason.
  - dngray 7y ago
    TBH mozilla is right about that though. There's better ways than using /etc/hosts. I run DNSCrypt and Unbound on my router: https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Unbound_DNS_forwarder_with_dnscrypt https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... then I simply point my DNS at my router IP. All DNS lookups are then done over DNSCrypt and over the VPN regardless of software, platform, or application. If I want to block a site I simply add it to filter.conf, ie https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Blocking_Microsoft_Telemetry_on_the_network_by_domain https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... local-zone: "example.com" redirect local-data: "example.com A 0.0.0.1"
    - Karunamon 7y ago
      I’m not clear on how this is “better”. I also run my own DNS server at home- sometimes I want to override resolution for a handful of addresses on a single client, and now (soon) I can’t do that anymore without some likely-convoluted workaround. It would be nice if Mozilla would stop breaking my shit and stop dishonoring my settings. This dread GNOME disease of knowing better than the user needs to stop.
      - o-__-o 7y ago
        Because DoH is meant to work on the application level, not OS level. You are trying to do something based on libc's resolver. If you use'd e.g. GoLang's resolver you would have similar behavior. This is "better" because it's following the spirit of domain separation. In fact, if Mozilla's application based resolver started mucking with /etc/hosts it would, in fact, be breaking your shit. Calm down.
        andrerm 7y ago
        How can someone defending DoH talk about the spirit of domain separation? This is so absurdv IMHO
        Karunamon 7y ago
        >Because DoH is meant to work on the application level, not OS level. And thus, we arrive at the crux of the issue, as stated in my original post. It is not the job of everyday applications to be making decisions about name resolution. >In fact, if Mozilla's application based resolver started mucking with /etc/hosts Mozilla's application doesn't even need to know about /etc/hosts. It needs to ask the system name resolution interface to resolve a name for it, and then run with what it is given, rather than Mozilla deciding that their baby is too important to use that interface and then proceed to implement one on their own.
        chmod775 7y ago
        You can have that. Don't turn DoH in FF on if you don't like it (or turn it off). You're acting like mozilla is deciding this for you without giving you a say. They're not. They're offering you something you don't even have to accept - because they care about your privacy online and they're not happy about little governments dabbling in the censorship game either. I'm pretty sure the TOR browser is using its own name resolution too - as a privacy feature. This isn't very different.
        Karunamon 7y ago
        Great, another obnoxious Firefox feature I have to disable - and that's assuming they deign to allow me to do this once it hits mainstream. I'd like it if there were less of those.
- Spivak 7y ago
  Mozilla is correct to do this and it would be a mistake for them to offer to parse the system hosts file in the name of compatibility as it goes against the very purpose of application-level DNS. There's really nothing special about /etc/hosts and I think people treat it as something far more mythical and fundamental than it actually is. On just about every *NIX system it's just the file that is parsed by one of the default modules that distros install for the hosts service. If you're not libc you shouldn't be reading /etc/hosts yourself and only accessing it via gethostname() and the like. But the whole point of application level DNS is to not do this. If I were to remove the files module from my NSS config I would be very surprised that Firefox was resolving names from it. You also can't parse /etc/nsswitch.conf to see if the files module is used because there's nothing special about that name -- my module blorp could read /etc/hosts and my files module could be pulling names from Redis.
  - cmroanirgo 7y ago
    I strongly disagree with this assessment. hosts (or lmhosts) has been with us for so long its ubiquitous and the resolvers (regardless of platform) have always checked this file first. If applications such as FFox are going to be sucesfully rolling out their own DoH, then reading the hosts is actually a requirement. As a coder, I completely understand mozilla's and your sentiment, but still, I am sure it's not the right direction to take.

vinay_ys 7y ago

Wow. Mozilla is breaking the standard working stuff like big bullies do.

Karunamon 7y ago
This is my main issue with DoH. The DNS resolver configuration is a system level setting and it is on applications to honor those settings, not do their own special snowflakey thing for whatever reason.
- dngray 7y ago
  TBH mozilla is right about that though. There's better ways than using /etc/hosts. I run DNSCrypt and Unbound on my router: https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Unbound_DNS_forwarder_with_dnscrypt https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... then I simply point my DNS at my router IP. All DNS lookups are then done over DNSCrypt and over the VPN regardless of software, platform, or application. If I want to block a site I simply add it to filter.conf, ie https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Blocking_Microsoft_Telemetry_on_the_network_by_domain https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... local-zone: "example.com" redirect local-data: "example.com A 0.0.0.1"
  - Karunamon 7y ago
    I’m not clear on how this is “better”. I also run my own DNS server at home- sometimes I want to override resolution for a handful of addresses on a single client, and now (soon) I can’t do that anymore without some likely-convoluted workaround. It would be nice if Mozilla would stop breaking my shit and stop dishonoring my settings. This dread GNOME disease of knowing better than the user needs to stop.
    - o-__-o 7y ago
      Because DoH is meant to work on the application level, not OS level. You are trying to do something based on libc's resolver. If you use'd e.g. GoLang's resolver you would have similar behavior. This is "better" because it's following the spirit of domain separation. In fact, if Mozilla's application based resolver started mucking with /etc/hosts it would, in fact, be breaking your shit. Calm down.
      - andrerm 7y ago
        How can someone defending DoH talk about the spirit of domain separation? This is so absurdv IMHO
      - Karunamon 7y ago
        >Because DoH is meant to work on the application level, not OS level. And thus, we arrive at the crux of the issue, as stated in my original post. It is not the job of everyday applications to be making decisions about name resolution. >In fact, if Mozilla's application based resolver started mucking with /etc/hosts Mozilla's application doesn't even need to know about /etc/hosts. It needs to ask the system name resolution interface to resolve a name for it, and then run with what it is given, rather than Mozilla deciding that their baby is too important to use that interface and then proceed to implement one on their own.
        chmod775 7y ago
        You can have that. Don't turn DoH in FF on if you don't like it (or turn it off). You're acting like mozilla is deciding this for you without giving you a say. They're not. They're offering you something you don't even have to accept - because they care about your privacy online and they're not happy about little governments dabbling in the censorship game either. I'm pretty sure the TOR browser is using its own name resolution too - as a privacy feature. This isn't very different.
        Karunamon 7y ago
        Great, another obnoxious Firefox feature I have to disable - and that's assuming they deign to allow me to do this once it hits mainstream. I'd like it if there were less of those.
Spivak 7y ago
Mozilla is correct to do this and it would be a mistake for them to offer to parse the system hosts file in the name of compatibility as it goes against the very purpose of application-level DNS. There's really nothing special about /etc/hosts and I think people treat it as something far more mythical and fundamental than it actually is. On just about every *NIX system it's just the file that is parsed by one of the default modules that distros install for the hosts service. If you're not libc you shouldn't be reading /etc/hosts yourself and only accessing it via gethostname() and the like. But the whole point of application level DNS is to not do this. If I were to remove the files module from my NSS config I would be very surprised that Firefox was resolving names from it. You also can't parse /etc/nsswitch.conf to see if the files module is used because there's nothing special about that name -- my module blorp could read /etc/hosts and my files module could be pulling names from Redis.
- cmroanirgo 7y ago
  I strongly disagree with this assessment. hosts (or lmhosts) has been with us for so long its ubiquitous and the resolvers (regardless of platform) have always checked this file first. If applications such as FFox are going to be sucesfully rolling out their own DoH, then reading the hosts is actually a requirement. As a coder, I completely understand mozilla's and your sentiment, but still, I am sure it's not the right direction to take.