4 ms·

Is this by design/intention, or just because DoH hasn't caught on yet so Mozilla is setting a sane default here? I can see how it would be a drawback if the ne

Is this by design/intention, or just because DoH hasn't caught on yet so Mozilla is setting a sane default here? I can see how it would be a drawback if the network administrator had no way to configure the setting for all clients.

Spivak 7y ago
The network administrator shouldn’t be able to change any setting at all on client devices. That’s the point! If you can just direct clients to a malicious DoH server then the project has largely failed. The device administrator should be the one making the choice about what resolvers to use.
- saurik 7y ago
  I agree: the device administrator should be in charge. Essentially, I see this conversation as having spun into an awkward regime where there is an implicit and entirely incorrect assumption here that the options are 1) the network configures the DNS setup and 2) individual apps configure their DNS setup; what happened to 3) the owner of the computer (the device administrator) configures their DNS setup? The status quo implementation has been that the operating system handled DNS, which actually did put the power in the hands of the device administrator: I don't think I have ever seen a device that wasn't clearly owned under some crazy MDM scheme where you couldn't choose your own DNS servers. Sure: recently, it happened to have a default to trust the network... but that was just a convenience, and is a "new phenomenon" brought on by DHCP being widely deployed. All of the software wasn't designed with that as an assumption. So, if I want DoH, why am I not just setting up a custom resolver on my computer, that all of my apps use, including Firefox? The "power struggle" alluded to up-thread is actually much deeper: it is using network operators as an excuse to take power away from users, by moving what used to be an operating system feature into individual applications in a world where DRM via code signature is being deployed to lock users into curated application domains to prevent them from modifying that software to do what they want. (That said, I mean... the way Firefox implemented this totally still gives the network administrator control, due to the opt-out provision? So in some sense a lot of this conversation is useless... for now.)
  - zzzcpan 7y ago
    Network administrators don't have power over device administrators, so the premise is a bit false. Device administrators are the network administrators on their own devices.
    - throw0101a 7y ago
      > Network administrators don't have power over device administrators ... They (possibly) do when they're both under the same Director of IT. Security is everyone's responsibility in an organization, and the folks in Helpdesk (ideally) want to prevent intrusions just as much as the NetOps folks.
- throw0101a 7y ago
  > The device administrator should be the one making the choice about what resolvers to use. No, the device owner should be the one. Which could the company/organization that bought the device in the first place, in which case that is delegated to the IT team. And if the IT team does not want DoH, it is the IT team that gets the final word. Mozilla has been nice enough to give options to disable that, and that can easily be done with GPOs on Windows, but not all the world is Windows, and if you have a large Mac or Linux use base that uses Firefox, how will disabling DoH be automated there? And just because Mozilla has been nice enough, does not mean that other developers will be.

Spivak 7y ago

The network administrator shouldn’t be able to change any setting at all on client devices. That’s the point! If you can just direct clients to a malicious DoH server then the project has largely failed. The device administrator should be the one making the choice about what resolvers to use.

saurik 7y ago
I agree: the device administrator should be in charge. Essentially, I see this conversation as having spun into an awkward regime where there is an implicit and entirely incorrect assumption here that the options are 1) the network configures the DNS setup and 2) individual apps configure their DNS setup; what happened to 3) the owner of the computer (the device administrator) configures their DNS setup? The status quo implementation has been that the operating system handled DNS, which actually did put the power in the hands of the device administrator: I don't think I have ever seen a device that wasn't clearly owned under some crazy MDM scheme where you couldn't choose your own DNS servers. Sure: recently, it happened to have a default to trust the network... but that was just a convenience, and is a "new phenomenon" brought on by DHCP being widely deployed. All of the software wasn't designed with that as an assumption. So, if I want DoH, why am I not just setting up a custom resolver on my computer, that all of my apps use, including Firefox? The "power struggle" alluded to up-thread is actually much deeper: it is using network operators as an excuse to take power away from users, by moving what used to be an operating system feature into individual applications in a world where DRM via code signature is being deployed to lock users into curated application domains to prevent them from modifying that software to do what they want. (That said, I mean... the way Firefox implemented this totally still gives the network administrator control, due to the opt-out provision? So in some sense a lot of this conversation is useless... for now.)
- zzzcpan 7y ago
  Network administrators don't have power over device administrators, so the premise is a bit false. Device administrators are the network administrators on their own devices.
  - throw0101a 7y ago
    > Network administrators don't have power over device administrators ... They (possibly) do when they're both under the same Director of IT. Security is everyone's responsibility in an organization, and the folks in Helpdesk (ideally) want to prevent intrusions just as much as the NetOps folks.
throw0101a 7y ago
> The device administrator should be the one making the choice about what resolvers to use. No, the device owner should be the one. Which could the company/organization that bought the device in the first place, in which case that is delegated to the IT team. And if the IT team does not want DoH, it is the IT team that gets the final word. Mozilla has been nice enough to give options to disable that, and that can easily be done with GPOs on Windows, but not all the world is Windows, and if you have a large Mac or Linux use base that uses Firefox, how will disabling DoH be automated there? And just because Mozilla has been nice enough, does not mean that other developers will be.