8 ms·

The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should no

The article is not clear about one issue: are all applications expected to disregard the OS DNS? Is there an option to tell all applications that they should not bypass it? I will be pretty pissed if I wake up one day and find that Firefox decided to stop using my DNS server and instead started sending my requests to a third-party.

jlgaddis 7y ago
That's exactly what their plan is -- and if you have experiments enabled, they may have already started sending your DNS queries to Cloudflare.
- z3t4 7y ago
  I guess thats Mozillas new monetizing strategy, sell user data to cloudflare, and market it as privacy. If you want privacy you better firewall everything your computer want to send to Cloudflare, Akamai, et.al.
  - tinus_hn 7y ago
    Good luck with blocking Cloudflare and Akamai and still using the internet.
    - throw0101a 7y ago
      Which is why some people, like Paul Vixie (no DNS dummy, he), think that this is an absolutely terrible idea. Mozilla is now basically dictating policy to organizations.
    - badrabbit 7y ago
      It's not that bad. Done it before. It's as if some sites are more like other paywalled sites.maybe noscript trained me well for it.
  - wipseabusbus 7y ago
    >...sell user data to cloudflare... Cloudflare claims they "will never sell your data or use it to target ads." You can read their 1.1.1.1 privacy policies here: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/privacy-policy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
    - zajio1am 7y ago
      That does not say they cannot use it for other purposes.
      - wipseabusbus 7y ago
        It says what they use, how they use it, how they won’t use it, who can use what (APNIC or if required by law), and how long they retain what. Your comment is misleading.
        throw0101a 7y ago
        And policies never change. There is never a change of management, especially after a company goes public (which CF is planning to do). /s
      - scrollaway 7y ago
        Like what? Fixing bugs in their service?
    - z3t4 7y ago
      Mozilla have a special deal with Cloudflare. According to Mozilla it will give even more privacy. It also seem that there is no money involved? So hopefully Mozilla is not selling DNS like they sell search. But I still think its a bad idea to centralize DNS and send all dns request to one actor, then it becomes very easy for anyone like the US gov to collect the data.
      - 7y ago
modeless 7y ago
The article explicitly mentions the way to tell applications including Firefox not to disregard the OS DNS: blocking a canary domain. It even links to detailed instructions. Frankly, given how much trouble I've had with systemd's DNS meddling, I look forward to applications taking DNS under their own control.
- Dont_panic 7y ago
  It's a bad idea what it end up starting a cycle where every big application uses their own DNS. Some of them might not wven do it right
- nicolaslem 7y ago
  > blocking a canary domain And how long will it take for most ISPs to block this domain when they realize that their DNS servers are not being used anymore? Some of them sell this data so they see it as a source of revenue. At this point this canary domain will have the same fate as Do Not Track. > I look forward to applications taking DNS under their own control. I am sure I can find a hundred applications/programs resolving domains on my machine. It is unrealistic to configure all of them separately. At this point we are back to the OS providing the configuration for all of them.
  - GTP 7y ago
    They already stated in the article that if the canary domain will be abused they will disable that check.
    - josteink 7y ago
      Yeah. Sounds like another do-not-track then. I’ll keep my firewall-rules banning all DoH-traffic to Cloudflare, just in case.
      - mtsr 7y ago
        Not a bad call, I guess.
Santosh83 7y ago
Mozilla can only speak for their applications and they seem to eventually intend Firefox to use DoH as default and fallback to OS DNS under various failure conditions some of which are mentioned in the post. They also say: "When DoH is enabled, users will be notified and given the opportunity to opt out."
s_tec 7y ago
> Firefox decided to stop using my DNS server In an ideal world, your probably want some sort of encrypted connection to your own DNS server (unless your LAN is 100% trusted). Maybe something like HTTPS would work... oh wait. Most people don't have their own DNS server, so their DNS traffic is already who-knows-what server with who-knows-what monetization in place (plus its in plaintext, so the rest of the internet gets it too). DNS over HTTPS seems like a net win for both types of users. Power users like you get way to encrypt your DNS traffic, and non-technical users get an encrypted connection to a potentially less-hostile DNS server. It sucks that there is now a second place to configure things, but hopefully seeing this work well will put pressure on the OS to adopt DNS over HTTPS natively, bringing the experiment to its final goal (at least, I assume this is the endgame).
- throw0101a 7y ago
  And how the hell is split-horizon DNS supposed to work if resolve.conf is ignored? This may be "fine" for (some) home users, but most organizations have a whole bunch of internal-only records. And even a lot of residences have things like printers and such that live under .local: how is the browser supposed to connect to those? Who the fsck is Mozilla that they get to dictate policy in my IT organization about how DNS "should" work?
  - s_tec 7y ago
    This attitude always amazes me. You have obviously mastered a set of system administration skills over several years, and you are comfortable with a particular way of doing things. When somebody points out a weakness with the status quo and tries to offer something better, though, you react with hostility. Why do you think that is? I understand that their solution is not perfect (nothing ever starts out that way), but the amount of aggression in your comment suggests that something deeper is going on. Do you feel threatened? I suspect it's fear of change. As people realize that plain-text DNS is a gaping security hole, they are going to start demanding encryption. This means you, the administrator, will have to learn more skills and do more work to keep things running. Things like `.local:` printers may break, and you may have to upgrade your internal DNS servers to RFC8484 so you can keep your split-horizon stuff working. Security is never free. Or not. None of this is mandatory, and you can just switch it off (and Mozilla will automatically switch it off if they detect an environment like yours, as it says in TFA). The threat isn't Mozilla "deciding policy" for you (they aren't), the threat is that they are calling the industry out for running old & vulnerable DNS standards, and we all know deep inside that they are right.
darkhorn 7y ago
>Are all applications expected to disregard the OS DNS? I hope so if OS continues to use plaintext (none secure) DNS queries.
throw0101a 7y ago
> Is there an option to tell all applications that they should not bypass it? Yes there is. If your internal recursive DNS servers return an NXDOMAIN for "use-application-dns.net", then Firefox will stick with gethostbyname(3) (or whatever). See: * https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di... If you’re using NLnet’s unbound(8) as a recursive DNS server, it’s possible to use the “local-zone” directive to force an NXDOMAIN: * https://serverfault.com/questions/625170/ https://serverfault.com/questions/625170/ For ISC’s BIND, the response policy zone (RPZ) mechanism does something similar on BIND 9.8+ (it’s more flexible, so more complicated to configure): * https://jpmens.net/2011/04/26/how-to-configure-your-bind-resolvers-to-lie-using-response-policy-zones-rpz/ https://jpmens.net/2011/04/26/how-to-configure-your-bind-res... * https://downloads.isc.org/isc/bind9/9.9.5/doc/arm/Bv9ARM.ch06.html#id2588394 https://downloads.isc.org/isc/bind9/9.9.5/doc/arm/Bv9ARM.ch0... * https://dnsrpz.info https://dnsrpz.info * https://tools.ietf.org/html/draft-vixie-dnsop-dns-rpz https://tools.ietf.org/html/draft-vixie-dnsop-dns-rpz * http://www.zytrax.com/books/dns/ch7/rpz.html http://www.zytrax.com/books/dns/ch7/rpz.html * https://serverfault.com/questions/618106/set-up-bind9-as-dns-firewall https://serverfault.com/questions/618106/set-up-bind9-as-dns...

jlgaddis 7y ago

That's exactly what their plan is -- and if you have experiments enabled, they may have already started sending your DNS queries to Cloudflare.

z3t4 7y ago
I guess thats Mozillas new monetizing strategy, sell user data to cloudflare, and market it as privacy. If you want privacy you better firewall everything your computer want to send to Cloudflare, Akamai, et.al.
- tinus_hn 7y ago
  Good luck with blocking Cloudflare and Akamai and still using the internet.
  - throw0101a 7y ago
    Which is why some people, like Paul Vixie (no DNS dummy, he), think that this is an absolutely terrible idea. Mozilla is now basically dictating policy to organizations.
  - badrabbit 7y ago
    It's not that bad. Done it before. It's as if some sites are more like other paywalled sites.maybe noscript trained me well for it.
- wipseabusbus 7y ago
  >...sell user data to cloudflare... Cloudflare claims they "will never sell your data or use it to target ads." You can read their 1.1.1.1 privacy policies here: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/privacy-policy/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...
  - zajio1am 7y ago
    That does not say they cannot use it for other purposes.
    - wipseabusbus 7y ago
      It says what they use, how they use it, how they won’t use it, who can use what (APNIC or if required by law), and how long they retain what. Your comment is misleading.
      - throw0101a 7y ago
        And policies never change. There is never a change of management, especially after a company goes public (which CF is planning to do). /s
    - scrollaway 7y ago
      Like what? Fixing bugs in their service?
  - z3t4 7y ago
    Mozilla have a special deal with Cloudflare. According to Mozilla it will give even more privacy. It also seem that there is no money involved? So hopefully Mozilla is not selling DNS like they sell search. But I still think its a bad idea to centralize DNS and send all dns request to one actor, then it becomes very easy for anyone like the US gov to collect the data.
    - 7y ago

modeless 7y ago

The article explicitly mentions the way to tell applications including Firefox not to disregard the OS DNS: blocking a canary domain. It even links to detailed instructions. Frankly, given how much trouble I've had with systemd's DNS meddling, I look forward to applications taking DNS under their own control.

Dont_panic 7y ago
It's a bad idea what it end up starting a cycle where every big application uses their own DNS. Some of them might not wven do it right
nicolaslem 7y ago
> blocking a canary domain And how long will it take for most ISPs to block this domain when they realize that their DNS servers are not being used anymore? Some of them sell this data so they see it as a source of revenue. At this point this canary domain will have the same fate as Do Not Track. > I look forward to applications taking DNS under their own control. I am sure I can find a hundred applications/programs resolving domains on my machine. It is unrealistic to configure all of them separately. At this point we are back to the OS providing the configuration for all of them.
- GTP 7y ago
  They already stated in the article that if the canary domain will be abused they will disable that check.
  - josteink 7y ago
    Yeah. Sounds like another do-not-track then. I’ll keep my firewall-rules banning all DoH-traffic to Cloudflare, just in case.
    - mtsr 7y ago
      Not a bad call, I guess.

Santosh83 7y ago

Mozilla can only speak for their applications and they seem to eventually intend Firefox to use DoH as default and fallback to OS DNS under various failure conditions some of which are mentioned in the post. They also say: "When DoH is enabled, users will be notified and given the opportunity to opt out."

s_tec 7y ago

> Firefox decided to stop using my DNS server In an ideal world, your probably want some sort of encrypted connection to your own DNS server (unless your LAN is 100% trusted). Maybe something like HTTPS would work... oh wait. Most people don't have their own DNS server, so their DNS traffic is already who-knows-what server with who-knows-what monetization in place (plus its in plaintext, so the rest of the internet gets it too). DNS over HTTPS seems like a net win for both types of users. Power users like you get way to encrypt your DNS traffic, and non-technical users get an encrypted connection to a potentially less-hostile DNS server. It sucks that there is now a second place to configure things, but hopefully seeing this work well will put pressure on the OS to adopt DNS over HTTPS natively, bringing the experiment to its final goal (at least, I assume this is the endgame).

throw0101a 7y ago
And how the hell is split-horizon DNS supposed to work if resolve.conf is ignored? This may be "fine" for (some) home users, but most organizations have a whole bunch of internal-only records. And even a lot of residences have things like printers and such that live under .local: how is the browser supposed to connect to those? Who the fsck is Mozilla that they get to dictate policy in my IT organization about how DNS "should" work?
- s_tec 7y ago
  This attitude always amazes me. You have obviously mastered a set of system administration skills over several years, and you are comfortable with a particular way of doing things. When somebody points out a weakness with the status quo and tries to offer something better, though, you react with hostility. Why do you think that is? I understand that their solution is not perfect (nothing ever starts out that way), but the amount of aggression in your comment suggests that something deeper is going on. Do you feel threatened? I suspect it's fear of change. As people realize that plain-text DNS is a gaping security hole, they are going to start demanding encryption. This means you, the administrator, will have to learn more skills and do more work to keep things running. Things like `.local:` printers may break, and you may have to upgrade your internal DNS servers to RFC8484 so you can keep your split-horizon stuff working. Security is never free. Or not. None of this is mandatory, and you can just switch it off (and Mozilla will automatically switch it off if they detect an environment like yours, as it says in TFA). The threat isn't Mozilla "deciding policy" for you (they aren't), the threat is that they are calling the industry out for running old & vulnerable DNS standards, and we all know deep inside that they are right.

darkhorn 7y ago

>Are all applications expected to disregard the OS DNS? I hope so if OS continues to use plaintext (none secure) DNS queries.

throw0101a 7y ago

> Is there an option to tell all applications that they should not bypass it? Yes there is. If your internal recursive DNS servers return an NXDOMAIN for "use-application-dns.net", then Firefox will stick with gethostbyname(3) (or whatever). See: * https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di... If you’re using NLnet’s unbound(8) as a recursive DNS server, it’s possible to use the “local-zone” directive to force an NXDOMAIN: * https://serverfault.com/questions/625170/ https://serverfault.com/questions/625170/ For ISC’s BIND, the response policy zone (RPZ) mechanism does something similar on BIND 9.8+ (it’s more flexible, so more complicated to configure): * https://jpmens.net/2011/04/26/how-to-configure-your-bind-resolvers-to-lie-using-response-policy-zones-rpz/ https://jpmens.net/2011/04/26/how-to-configure-your-bind-res... * https://downloads.isc.org/isc/bind9/9.9.5/doc/arm/Bv9ARM.ch06.html#id2588394 https://downloads.isc.org/isc/bind9/9.9.5/doc/arm/Bv9ARM.ch0... * https://dnsrpz.info https://dnsrpz.info * https://tools.ietf.org/html/draft-vixie-dnsop-dns-rpz https://tools.ietf.org/html/draft-vixie-dnsop-dns-rpz * http://www.zytrax.com/books/dns/ch7/rpz.html http://www.zytrax.com/books/dns/ch7/rpz.html * https://serverfault.com/questions/618106/set-up-bind9-as-dns-firewall https://serverfault.com/questions/618106/set-up-bind9-as-dns...