28 ms·

Turn off DoH, Firefox

408 points by telmich 7y ago

m-p-3 7y ago
What they should do is offer several alternatives when enabling DoH (Cloudflare isn't the only DoH provider out there), and anto-detect if your ISP or local network supports it at the enterprise level. At least you can change the provider in about:config. I don't remember if you can do it through the settings page.
- akerro 7y ago
  Many ISPs won't offer such thing https://www.zdnet.com/article/uk-isp-group-names-mozilla-internet-villain-for-supporting-dns-over-https/ https://www.zdnet.com/article/uk-isp-group-names-mozilla-int...
  - raverbashing 7y ago
    > claimed that Mozilla plans to support DNS-over-HTTPS "in such a way as to bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK." > By planning to support DNS-over-HTTPS, Mozilla is throwing a monkey wrench in many ISPs' ability to sniff on customers' traffic and filter traffic for government-mandated "bad sites." But I don't see why they can't offer their DoH, it seems their issue is with Cloudflare not with DoH per se
    - chii 7y ago
      because most people don't know they can easily bypass the DNS based filters that is used to block "bad sites". DoH by default uses cloudflare's DNS, and so won't (need to) comply with the UK's filter laws.
      - profmonocle 7y ago
        > DoH by default uses cloudflare's DNS, and so won't (need to) comply with the UK's filter laws. I'm assuming the DoH servers used by British users are physically in the UK. (I believe they anycast the service from all of their edge locations, and they have several in the UK.) So the fact that Cloudflare doesn't have to comply with this law is precarious. Is it because only ISPs are required to comply? If so, it seems like a matter of time before Parliament amends the law to require any public DNS operator to implement the filters as well.
  - lysp 7y ago
    Also certain countries (eg. Australia), have a metadata retention law. That means that the ISP dns will 100% be logging all requests made. The risk of Cloudflare doing it is far outweighed by ISPs legally being required to do it, at least in Australia.
    - profmonocle 7y ago
      What if the user just doesn't make any DNS queries, because all their host lookups are going over DoH? They can log all the user's DNS queries, but all of them will just be for the DoH server whenever the user starts Firefox.
      - lysp 7y ago
        I assume DoH will not be logged at all. Or just many connections logged to "one.one.one.one". Difference being if I connected to ISP ABC's DoH server - communication between will be encrypted, but the actual requests will be logged after they receive the request.
  - ripdog 7y ago
    Note that Mozilla has added a way for network operators to disable DoH for their entire network, by NXDOMAINing a specific fake address. UK ISPs will presumably do that, and DoH won't happen in the UK for a while.
- dsr_ 7y ago
  I can't see any way in which that could be abused. Kazakhstan, China, Russia and the NSA all agree with me.
- bennyp101 7y ago
  Yea, Preferences > Network Settings > Enable DNS over HTTPS Can currently choose "Cloudfare (default)" or "Custom" But I agree, a few more options on there would be good, and if they are turning it on by default, then there should be a setup page that appears to let you choose the provider or something
akerro 7y ago
Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! If you don't like CF just switch to different provider https://github.com/curl/curl/wiki/DNS-over-HTTPS https://github.com/curl/curl/wiki/DNS-over-HTTPS
- ndidi 7y ago
  I do trust my ISP and my government more than I trust CloudFlare.
  - dao- 7y ago
    Is your ISP in the US and your government the US government? The DoH rollout w/ Cloudflare is only planned for the US.
    - vetinari 7y ago
      > The DoH rollout w/ Cloudflare is only planned for the US. For now.
  - seszett 7y ago
    It seems very American to me to trust a private actor such as CouldFlare more than your own government. I feel like at least in Europe, a large majority of people would trust their government and local ISP much more than some company halfway over the world with basically no accountancy in your own country, especially an American one since it means your data is basically at the mercy of the US government.
    - buildzr 7y ago
      Aren't there a bunch of European ISPs applying government enforced DNS blocking? Seems like this is a very good move for them.
      - q3k 7y ago
        The ISP I run is applying [1] such blocks on our DNS recursors (blocking illegal online gambling domains, as per legal requirements [2]). I still trust my DNS servers (or those of most ISPs, for that matter) more than I trust Cloudflare. I'd rather have intelligence services go through the effort of infiltrating every single ISP separately to get any useful dragnet intelligence, instead of just one large entity that can illegally collect all traffic from all users of a web browser. [1] - https://github.com/q3k/rsh-unbound https://github.com/q3k/rsh-unbound [2] - https://hazard.mf.gov.pl/Ustawa https://hazard.mf.gov.pl/Ustawa
fimdomeio 7y ago
Does anyone knows why does mozilla think this is a good idea? Between each user sharing dns queries with their isps and everyone sharing dns queries with cloudflare it appears that it's obviously more secure the first approach even if none of them is really that great.
- Avamander 7y ago
  ISPs have proven themselves untrustworthy repeatedly, CloudFlare yet really hasn't. Not that I like the control they have, but it's honestly the fault of ISP's this has happened.
  - userbinator 7y ago
    some ISPs. The problem is that Mozilla is taking a very US-centric view of a product that is used worldwide.
    - gsnedders 7y ago
      …and DNS over HTTPS, using CloudFlare, is only being enabled in the US. A US-centric view for a US-only decision seems fair to me?
    - magashna 7y ago
      The change is only being rolled out to the US.
    - Avamander 7y ago
      True, I don't think it's ideal, but non-US entities are in slumber, there's still basically no deployment of more secure standards by ISPs. I'd send my ISP an e-mail about providing DoH but they can't even give me IPv6.
  - falcolas 7y ago
    Cloudflare has taken sites offline before, in response to legal requests (CP) and social pressure (8ch). Whether it’s right to do it or not, Cloudflare has proven that it is not a neutral party.
netfl0 7y ago
Firefox, wth. Cloudflare is not the internet.
- m-p-3 7y ago
  It's currently proxying 10.2% of all known websites (by the surveyor) on the entire Internet. https://w3techs.com/technologies/details/cn-cloudflare/all/all https://w3techs.com/technologies/details/cn-cloudflare/all/a... Not big, but not insignificant.
  - deleted 7y ago
    [deleted]
ros65536 7y ago
I think this article would benefit from not shoehorning politics into the issue. Couldn't take this seriously after the irrelevant slight at Trump.
Crinus 7y ago
If the single DoH 'server' is the issue, wouldn't having a list of several 'servers' around the globe (hopefully in places where there isn't any form of censorship and preferably though non-commercial institutions) that the browser selects randomly solve this?
- vetinari 7y ago
  No. The browser has no business in selecting DNS servers; it is a system-wide setting and it should ask the operating system to resolve names. How the operating system resolves names, is up to it. It could use tcp-over-pigeons, if the sysadmin configured it so, and no application should be working around that. If you want to use DoH with Cloudflare, you are free to configure your system to do so. You will also get consistency, all your apps will use the same system, not just the browser. Let the others to have their systems configured as it suits them.
  - yuft 7y ago
    Maybe if the OS providers were more proactive about DNS over TLS/HTTPS, Mozilla wouldn't have needed to do this to keep users secure.
    - vetinari 7y ago
      Android does support DNS-over-TLS, and it does it in a way that does not break networks - whatever it gets from DHCP, it tries the same server with DoT first. Users can also configure their preferred DoT server. Linux, or at least the glibc-based distributions, have a concept of nss_modules; you can configure whatever mechanism you want, some people are using DNSCrypt or nss-tls, for example. Systemd-resolved, with all the hate it gets, does support DoT. So do other local caching resolvers, like Knot. With other systems, you would have to discuss that with the respective vendors. Vendors also discuss these issues with customers, and very few customers are fond of breaking their systems. Activism, as Mozilla has shown, is a good way to irritate a good chunk of your user base. The change would have to be gradual, and allow the local admins to be in control (like Android and Linux distributions do).
Chirael 7y ago
It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?
- Johnnynator 7y ago
  Yes, a DoH request would never hit your Pi Hole
- m-p-3 7y ago
  Yes, unless you configure Firefox to not use Cloudflare DoH.
- jfindley 7y ago
  Out of the box? Yep! I realise that will annoy people but honestly it's a good thing - any solution that would not bypass a pi-hole would allow governments and ISPs to do the same. To retain your pi-hole, you'll need to run a DoH proxy on your pi-hole device, configure your browser to use that as the DoH provider, and this will allow your pi-hole to inspect and modify DNS results. Your pi-hole can then use any upstream DoH provider that you want.
- taneq 7y ago
  Would it be hard to make pi-hole into a DoH provider so you could just point your browser at it? Or does that defeat the "just works" factor of the pi-hole?
  - kadoban 7y ago
    Probably easier to just turn off DoH in Firefox. In a home LAN configuration, which I'd expect is the vast majority of Pi-hole setups, I don't think you'd really be gaining anything from DoH. And even if Pi-hole does support being a DoH server, you'd have to configure that in Firefox anyway.
    - ocdtrekkie 7y ago
      Presumably you'd want DoH on the Pi-hole in the other direction, so that it's encrypting your DNS requests forwarded out to the Internet. But yeah, there'd be no reason to want to deal with certificates for your local network machines to do DoH from Pi-hole to PC.
bennyp101 7y ago
The only thing that annoys me slightly about this, is that I currently have a couple of pi-holes running at home (one for us, and one for the kids) and I have the Mikrotik setup to redirect any request for DNS to the correct pi (So even if they change the DNS on the device it still hits the pi) This is going to make that a pain - especially if they introduce it in the mobile version?
- sjagoe 7y ago
  You should be able to disable the Firefox default-on DoH across your network by returning NXDOMAIN for use-application-dns.net [1] I don't know how to configure pi-hole, but at the dnsmasq level you can do that with this directive: address=/use-application-dns.net/ [1] https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...
  - bennyp101 7y ago
    Interesting, thanks. I guess if these use normal DNS requests first to determine if it should be allowed, then it will work. > If a user has chosen to manually enable DoH, the signal from the network will be ignored and the user’s preference will be honored Well, that kinda puts a dampner on it all!
- ripdog 7y ago
  Only firefox does this, and Firefox has uBlock Origin. Why is this an issue?
jfindley 7y ago
This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what you worry about is the government spying on your traffic then complaining about DoH is even more silly - DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany). DoH is vital to protect users around the world from censorship and worse. Enabling it by default is a good thing - protecting users from abuse shouldn't only be opt-in. There has to be SOME default chosen, and the default needs to be a site large and well run enough to a) handle the load, and b) be in the firefox HSTS preload list. There aren't a lot of good DoH providers that fit these criteria - CF is one of the few.
- taneq 7y ago
  > There has to be SOME default chosen It seems trivial to select a half a dozen likely candidates and let the user choose between them on install. Honestly I'd like them to do the same with the search engine. Yes, it's simple enough to change the default, but it'd be nice to choose up-front.
  - johnmaguire2013 7y ago
    Every question you make a potential user/customer answer is a potential loss of conversion. Most Firefox users do not care. Those that do can figure out how to change it easily enough.
  - deleted 7y ago
    [deleted]
  - matharmin 7y ago
    Yes, it's trivial. It's also very annoying to the probably 99% of users who don't care about it at all, especially if this becomes just one of many settings that needs to be configured on startup.
mantap 7y ago
This misses the forest for the trees. In the UK ISPs are already legally mandated to log your web requests and provide them to the government. Those who live under free regimes should not deny those of us who live under oppressive governments the right to privacy of our communications. The fact that cloudflare is a US entity and thus not subject to UK law is the whole point.
- chopin 7y ago
  As far as I understood the OP is that it shouldn't be the default. If you worry for your government, you should use a VPN anyway (where possible which is the case for UK afaik).
  - mantap 7y ago
    Why shouldn't it be the default? Switzerland has a population 8 million. Why should the default be geared towards a small minority when there are billions of people not just in the UK but in Asia and Africa who would benefit from this feature. If they OP thinks that their country's laws are strong enough to make the feature unnecessary then they can turn it off.
- tadzik_ 7y ago
  > Those who live under free regimes should not deny those of us who live under oppressive governments the right to privacy of our communications And those who live under oppresive governments should not be an excuse to force those who don't to have their traffic routed through a property of an oppressive government. Yes, I know it's not about to be a default for non-US users yet. But "The UK people are getting screwed" is not a very good argument for "everyone should be getting screwed by the US".
  - mantap 7y ago
    It's not just the UK people. Most people in the world live in countries that have oppressive internet laws. Swiss people are a tiny privileged minority. The author should travel the world and see exactly how the internet is outside of their bubble. DoH is an important privacy feature and important for protecting people's fundamental rights.
paulcarroty 7y ago
DoH and DoT are very interested technologies, disabling them 'cause Cloudflare is ... strange. From another side, DoH/DoT prevents ISPs/government from DNS modifying/rerouting.
- antientropic 7y ago
  Why is that strange? It seems rather obvious to me why people are reluctant to route all their DNS queries through a for-profit company in a country with no real privacy laws (and one that you have to assume is backdoored by the NSA).
  - paulcarroty 7y ago
    'Cause it not vendor-locked to Cloudflare, you can use your own server.
coleifer 7y ago
There are two points: 1. centralization of all dns lookups is worrisome 2. Dns should not be handled by applications. It should be handled by the operating system. I see a lot of people conflating the two in the comments.
- kbumsik 7y ago
  > 2. Dns should not be handled by applications. It should be handled by the operating system. I agree with #1 but why it should be managed by the OS?
  - userbinator 7y ago
    No one wants a proliferation of different applications which all have different settings to access the network, especially when the OS provides centralised functionality to do so.
  - rocqua 7y ago
    Because the OS gets provisioned with DNS by DHCP. Because the OS incorporates the hosts file. Any internal domains or local domain edits are not covered by this.
  - vezycash 7y ago
    It's annoying. I've already experienced this with chrome as chrome ignores my hosts file settings. Example: Say you use hosts file to block porn and other shady sites for your kid, all they have to do is use chrome.
    - Someone1234 7y ago
      This has nothing to do with the topic. Chrome isn't replacing the OS's DNS resolver, and that bug is just that: a bug. A bug that I cannot reproduce. Chrome follows my HOSTS file fine on Windows 10. But even if it didn't it would still be off-topic.
  - deadbunny 7y ago
    Because I don't want to have to manage 400 configs when I can manage 1.
aazaa 7y ago
> DoH means that Firefox will concentrate all DNS traffic on Cloudflare, and they send traffic from all their users to one entity. Why does DoH necessarily mean that Cloudflare will be handling the traffic? The article barrels right to that conclusion without explaining why.
- bennyp101 7y ago
  The default setting in Firefox is to use Cloudfare as the DOH provider
  - aazaa 7y ago
    Thanks for pointing this out. > It is clear what Mozilla needs to do: Mozilla can and should revert the change and allow users to easily opt-in. And to select or enter the DoH provider instead of defaulting to Cloudflare. Buried lede is buried.
userbinator 7y ago
It's very disturbing to see the overreach that Mozilla has resorted to and the "privacy" argument (it was "security" before that...) being used to justify essentially ignoring system configuration. My ISP has more accountability than a company in another country. The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems. Exactly. If Mozilla wants to, it's more than welcome to reach into the VPN area with its own products, but I don't believe this functionality should be part of a browser. They're already reaching into the VPN area[1], should they also investigate bypassing Chinese censorship with their own "firewall-busting" obfuscating VPN? That's not something most users want nor need in their browsers, and such functionality is really a cat-and-mouse game that I think is best left to smaller and less-well-known entities. It's unfortunate that browsers are already beyond "neutral", when IMHO the only thing they should do is fetch exactly the page URL that was entered and display it. Edit: yes, apparently people disagree and want Mozilla to control what the Internet (and every user, ignoring his/her default configuration) does. This is really really disturbing. [1] https://news.ycombinator.com/item?id=20927832 https://news.ycombinator.com/item?id=20927832
- seanhunter 7y ago
  > The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems. This is beside the point. Mozilla make a browser. They don't make the address resolution code for the underlying operating system. Operating system vendors are of course going to start to support DNS-over-https. You can disable dns-over-https if you don't want it enabled. Just go to about:config and set network.trr.mode. to 5
  - throw0101a 7y ago
    > You can disable dns-over-https if you don't want it enabled. It was also possible to disable Ubuntu from sending your desktop searches to online retailers: * https://www.pcworld.com/article/2889895/how-to-stop-ubuntu-from-sending-your-desktop-searches-to-online-retailers.html https://www.pcworld.com/article/2889895/how-to-stop-ubuntu-f... Just because something can be disabled does not necessarily mean it should be enabled by default in the first place.
wwright 7y ago
How will this affect using Firefox on an intranet, where there are often services and websites on a local-only DNS server? Will Firefox be unable to reach those sites by default?
treggle 7y ago
I strongly support DoH as it prevents government snooping on the public. It’s really unhelpful that people like this attack Firefox over this issue. Stand strong Firefox against this.
- notyourday 7y ago
  One goes fishing where the fish is. There are dozens of large and hundreds of medium to small ISPs in the US. There's only one Cloudflare. That's where the resources to get the data would be concentrated. It has been demonstrated with PRISM. If Mozilla wants to play this game, it really should make DoH a visible top level choice for a user.
  - magashna 7y ago
    Most users don't understand DNS, HTTPS, or DoH. I think this decision overall is good, and for those who see and understand the possible issues, it's trivial to remedy.
booblik 7y ago
My understanding is that the DNS query goes to the closest of the more than 180 Cloudflare servers, not specifically to the US servers. Complete FUD.
- userbinator 7y ago
  The point is that Cloudflare is a US company. From that perspective, where their servers are located is irrelevant.
  - booblik 7y ago
    Of course it is relevant. They claim US government has access to all the logs, this is simply not true.
    - falcolas 7y ago
      Please provide some proof that a US company would not have to respond to US government requests. The location of the servers doesn’t matter.
throw0101a 7y ago
In other news, bots have now started using DoH (one via Google's DoH service): * https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module https://www.proofpoint.com/us/threat-insight/post/psixbot-no... * https://news.ycombinator.com/item?id=20934680 https://news.ycombinator.com/item?id=20934680
riccardogiorato 7y ago
I hope to see a solution from Mozilla, is it known why they choose DoH with Cloudflare? It seems a bit strange from a company always focused on OSS.
- mikl 7y ago
  There aren’t a whole bunch of companies that are able to provide a good DNS service world-wide. You’ll need high-reliability DNS servers co-located all over the world. Probably a multi-million dollar investment to get such a thing going, saying nothing of the running costs.
isostatic 7y ago
> The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems. Not in applications! You're right. But so are Mozilla. Here we are 30 years into the web, and we're still using plain old DNS. DNS over TLS should have caught on, but it didn't. Apple and Microsoft had years to ensure it's implemented as standard, but they didn't. The points this article makes - about DHCP options, about multiple providers, are very valid. But they're also just talking shops. The biggest problems here seems to be 1) DHCP can't give internal DOH servers. When I'm at home I want it landing on my own DOH server, but when I'm away I want to use a different one. 2) Internal DNS resolving falls to bits
- throw0101a 7y ago
  > DNS over TLS should have caught on, but it didn't. So enable DoT instead.
- m-p-3 7y ago
  Agreed, I'd prefer setting up the DNS-over-HTTPS config at the gateway level (and either push the config over DHCP, or have the gateway act as a local resolver, which forwards the new requests over DoH), but we're not there yet.
  - isostatic 7y ago
    In theory isn't it "just" a matter of agreeing a DHCP option number, then having the DHCP client (or vpn client or whatever) be responsible for passing it to applications that want it (including the system resolver, be that mDNSResponder, systemd, glibc, whatever windows uses) Anyone who wants to can configure their dhcp client to ignore it, or use a different service, you could even have applications doing that too, but this would allow a network operator to tell people where the recommended resource is. Likewise if you want to change your DNS provider yourself you would have a single location on your machine to do it for the entire OS, rather than having to change 50 different applications.
  - bscphil 7y ago
    > have the gateway act as a local resolver, which forwards the new requests over DoH This is what I would like to see as a default (and included in routers). In fact, it's what I already do myself. I think (as others here have said) that the privacy concerns the article raises are mostly FUD. But I do agree with the article when it says handling DNS at the application level is kind of a terrible idea (even though it might seem justified in this case). If the end result is that every application has its own built in network stack, that's going to be terrible for security, usability, and make it much harder to debug third-party apps.
auslander 7y ago
OpenBSD folks removed it, and they are always right about security, as they were with disabling Intel hyperthreading.
tedk-42 7y ago
I think it's good Firefox are leading the way on DoH. The ability to chose which DNS provider you query will be next on the feature list for Firefox I imagine. Cloudflare have the same mindset to do something about the vulnerability of DNS to snooping (see their 1.1.1.1 app). Two companies with the same mindset. I'm hoping others follow them. The article itself sounds paranoid and divides those that would rather trust private companies (with good intentions) against those that would rather trust their ISP/Government (also with good intentions).
lousken 7y ago
As a sysadmin and a user i dont see any problems with DoH, i can easily set a DNS entry[0] so that FF respects my company configuration. And as a user I've been using DoH for months, just not from cloudflare but from CZ NIC because the latency was slightly better. You can easily set your custom DoH provider with 2 clicks in the Options menu. Also for most users I see benefits, because most of them don't use VPNs on free wifis. edit: I also think OS maintainers are the main problem here, none of this would've happened if they supported DoT or DoH themselves. [0] https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...
mikl 7y ago
Disagree. Most users haven’t chosen their DNS server, so replacing one unchosen DNS server with another makes no practical difference. And DoH means that people snooping on your network can no longer spy on you. Cloudflare has committed themselves to not track users via DNS requests, and only log what’s strictly necessary. And if you distrust Cloudflare, you have a much bigger problem. Half the Internet routes through Cloudflare these days. If they wanted to spy on you, they have (potentially clear-text) access to a good chunk of your HTTPS traffic. And as many others have pointed out, it’s a much better recommendation to have people change the DoH server to something else.
falcolas 7y ago
It's worth noting that CloudFlare has already proven itself to not be a neutral party - they have proven willing to take sites offline for both legal and social pressure reasons. This will greatly impact the internet's ability to route around censorship as if it were damage.
- AgentME 7y ago
  I agree, only somewhere that hosts neo-nazi websites would be trustworthy enough for this. /s
- comex 7y ago
  Cloudflare has proven willing to refuse to use their own bandwidth to host particular websites. That's very different from censoring DNS requests, and there's no reason to think they would do the latter.
auslander 7y ago
How decisions are made in Mozilla? By whom? Is there public discussion beforehand?
- gcp 7y ago
  This has been tested and debated for months. Initial support for Firefox rolled out 9 months ago or so: https://miketabor.com/enable-dns-over-https-and-encrypted-sni-in-firefox/ https://miketabor.com/enable-dns-over-https-and-encrypted-sn... The conclusion of the debate was that it vastly improves the privacy for most users. Which is why it shipped in Firefox. Take that into account when you read (misleading, factually wrong) push-back like the original article.
  - gcp 7y ago
    First announcements were even longer ago: https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-ove...
  - auslander 7y ago
    > The conclusion of the debate Obviously debate is still on, as we see in here and in [0], and it looks like HN folks are not in favour of these integrations, including me. So question stands, how/why the debate was concluded, did all developers had a vote? Is there a link to discussion? [0] https://news.ycombinator.com/item?id=20927832 https://news.ycombinator.com/item?id=20927832
    - gcp 7y ago
      >it looks like HN folks are not in favour of these integrations, including me. I have no idea why you think that random HN discussion afterwards (in response to an article filled with misinformation!) would have any bearing on how Firefox is developed. https://www.mozilla.org/en-US/about/governance/ https://www.mozilla.org/en-US/about/governance/ >Is there a link to discussion? There's been about 1.5 year of extended discussion and iteration over DoH, yes. I'm sorry but there certainly isn't just a "single" link!
- 7y ago
ltt481 7y ago
Living in Russia, I, for one, welcome DoH and ESNI. I know I trust Cloudflare more than my government and ISP (The same ISP that routinely spoofs requests to inject ad pages/reminders to pay for service, nevermind all the blocked sites).
- konart 7y ago
  Not like DoH helps much here though.
9588 7y ago
I think dns (and many other "trivial" to implement sensitive services) should be a gov service. Preferably the eu and idealy made usable for anyone.
Grue3 7y ago
Not convincing. I live in Russia, explain why I wouldn't want this turned on?
Aissen 7y ago
This is a gross over-simplification. Cloudflare is required by contract to respect your privacy, which is much stronger than even the privacy laws have here in the EU since it addresses everyone, not just the EU population: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... The people fighting for the status quo probably know how to run their own resolver, even with DoH or DTLS. But Mozilla's conundrum is how to protect everyone 's privacy (and to a certain extent, security). DoH, despite all its flaws, attempts to do that by piggy-backing on already working infrastructure, so it seems like a good fit to move everyone to DoH. But then, they're the chicken-and-egg problem. How do you make sure people deploy local DoH resolvers if no browser enforces the move to DoH ? How do you make sure those resolvers are truthful, or even respect local law (having both is often impossible). So, you need to compromise. I'd have preferred to have temporary non-profit third party entity handle this à-la-Letsencrypt, but Mozilla deemed its contract with Cloudflare sufficient to provide enough guaranties. Ideally, name resolution should be done closer to the user instead of being centralized like that. But by arguing instead of experimenting we just keep the status quo. Time will tell if this was a bad decision. But it's not as clear cut as this blog post says it is.
- partialrecall 7y ago
  > "This is a gross over-simplification. Cloudflare is required by contract to respect your privacy" How often to corporations take other corporations to court over contract disputes? I think it's pretty often.
  - Aissen 7y ago
    It is indeed. We'll see if Mozilla's lawyers are good at writing contracts once the Mozilla vs Oath case resolves: https://blog.mozilla.org/blog/2017/12/05/mozilla-files-cross-complaint-against-yahoo-holdings-and-oath/ https://blog.mozilla.org/blog/2017/12/05/mozilla-files-cross...
- nullc 7y ago
  A contract where cloudflare receives no consideration isn't particularly comforting, as such agreements are routinely ignored by courts (or equivalently by capping damages at nothing). > Mozilla's conundrum is how to protect everyone 's privacy And exactly how does this protect user's privacy? Instead of the user's ISP being able to see where the user connects now both cloudflare AND the user's ISP (via seeing the connection itself) can tell.
m-p-3 7y ago
For those who are uneasy to use CF DoH, here's a list of alternative DoH Resolvers https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-available-servers https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-av...
garganzol 7y ago
We are having zero problems with the current decentralized DNS architecture. Evidently, Mozilla plays the role of a Google's darling once again. Those financial "donations" have some interesting effects, aren't they? Aside from an official "Google Search Bar in Firefox" line. What's even more interesting is that Hacker News moderator deranked the topic. Probably all the actors represent the same mafia ring, as they painfully in need to defend those interests to stay commercially relevant in changing world (hello IPFS).
unionpivo 7y ago
One thing that concerns me greatly is debugging network problems. Up until now, you could use dig, nslookup and other tools to see how your computers resolves to help you figure stuff out. Now what do you do? also what happens when firefox uses this cloudflare, some other X application will start using Z, and the third Y. Also I work, and used to work for many small shops (under 50 people) in different industries. Its standard practice to have internal domains, sometimes even having different things on the same domain (ie mail.comany.co is diffrenet server form inside and outside the network). If you don't have AD (increasingly common here with apple and linux laptops being the 95% of users), you will have to go to each user on every device that has firefox and help him fix the settings. I would say just block it at firewall level, but it's not trivial, without breaking sites that use cloudflare.
kemonocode 7y ago
Also, do keep in mind that by using DoH, you're also rendering anything like Pi-Hole useless. The solution of course being to use DoH from the Pi-Hole device [0], picking your own provider and disabling it on Firefox. Only step you need to change is the part where upstream providers are given and use your own instead of Cloudflare's default. [0] https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/
SimeVidas 7y ago
> It means people outside the US can now be fully tracked by US government How?
NikkiA 7y ago
I had to turn it off, not because I'm opposed to the idea, far from it, I'd love to use DoH, but because cloudflare's spat with archive.is renders the whole thing useless if you ever need to browse archive.is stored copies of pages.
- tick_tock_tick 7y ago
  Kind of a disservice to call it cloudflare's spat when archive.is added special code to make their dns implementation non spec compliant only when queried by cloudflare.
  - yuft 7y ago
    I wonder if they will deal with it now that all US Firefox users will be unable to use it by default.
darkhorn 7y ago
I don't know about you guys but in Turkey if you query wikipedia.org from 8.8.8.8 it doesn't return results. However if you use DoH you can access Wikipedia. Thank you whoever contributed to DoH!
- teddyh 7y ago
  Whatever convinced Google – Google – to censor Turkey, you don’t think they will be able to convince Cloudflare to do the same? This is a problem of centralization.
tssva 7y ago
I think this is a horrible idea and applications should respect the OS DNS configuration. I have already configured the instance of dnsmasq on my router at home to return NXDOMAIN for the canary domain. That being said I am a little confused by those that are concerned because this change would mean their DNS queries will be sent to a US company and they don't trust US companies. Firefox is developed and distributed by a US corporation and is just a susceptible to being forced to follow US government directives as Cloudflare.
codedokode 7y ago
> It is clear what Mozilla needs to do: Mozilla can and should revert the change and allow users to easily opt-in. I think it should be on by default. In my country encrypted DNS makes it more difficult for the government to track what people watch and to block sites. > And to select or enter the DoH provider instead of defaulting to Cloudflare. You can enter any DNS server address in Firefox. While I agree, that it is bad to concentrate all the world's DNS queries in the hands of an entity under US jurisdiction, not encrypting DNS is much worse currently. So Cloudflare and US government are the lesser evil for me. Also, if there were volunteers running free DoH servers then Mozilla could choose one of them randomly instead of sending all queries to USA.
- saurik 7y ago
  Why not install DoH system wide, then (the kind of change which is easy if tools like Firefox use the system APIs for this and very difficult if individual applications all reimplement DNS) instead of only doing it for Firefox?
  - codedokode 7y ago
    Because it is easier to embed it into a browser rather than persuade vendors of all major OSes (Windows, Mac, Android and thousand of Linux distributions) to add it. Also, even if a company like Microsoft adds it to Windows, they will add it only to they latest version and leave people on Windows XP, 7 and 8 without protection. Same with Google - they will add it only to the latest Android. Because commercial companies want you to buy new products, not to use the old one for a long time.
stordoff 7y ago
Maybe I'm missing something, but the "I think just me and you was safer" image feels a little misleading. There already was a third party - your ISP/DNS provider.
dreamcompiler 7y ago
I had no idea this was going to be the default. It's massively wrong. I use a Pihole DNS server, which means after a lot of debugging I'd have discovered Firefox had unilaterally decided to stop abiding by internet protocols. It's always one step forward and two back with these Moz guys. I guess that's better than every step back like Chrome, but jeez Moz, get a clue.
methou 7y ago
The stated problem is that there are few providers, as for the offending party - Firefox, it's they've defaulted to a company based in the US or a 14 Eyes member. It doesn't feel right to address the issue by blaming the DoH, or Firefox, as they are not defaulting to the prime evil - Google. I believe the better suggestion here to say is to set up own DoH servers, urge related parties to opensource their own implementation if there's none.
tptacek 7y ago
As somebody who's been working for internet security over 20 years, we strongly believe that applications should not choose the DNS server. The operating system is designed to manage DNS and network settings for all applications. This is nonsense.
- tambre 7y ago
  Instead of a reactionary remark please provide arguments and explanations for your viewpoint to actually further the discussion.
  - draw_down 7y ago
    I think tptacek's comment is just fine as it is.
sirtoffski 7y ago
Idk folks, the entire debate seems to be out of proportion. 1) If you do not agree with Mozilla’s actions - do not user their browser. I mean Mozilla isn’t forcing anyone to use Firefox. As a company they are free to design their product as they see fit. As an individual you are free to either use their product or not. 2) If you disagree and still chose to use Firefox - just because you are reading this means you have the knowledge to disable DoH. 3) If Mozilla remove the option to disable DoH over CF and you don’t like it - use another browser. 4) If you are concerned for other people’s data going to CF (specifically people who are not as well informed, people who don’t know what DoH or even DNS is) - very noble indeed, but unfortunately options are limited here. Encourage people to do some research and to decide for themselves whether or not they are as passionate about it. The main point I am making is just as we want to be free in choosing whether or not to use DoH over CF, Mozilla is as free to design their own product.
gommm 7y ago
As someone who has donated to Mozilla over the years and used Firefox as much as possible, this makes me very unlikely to donate in the future. People say that it's trivial to change. It's trivial to change for us who are technically minded. It's far from obvious and will not be changed by non-technical users. This will only increase the massive amount of data that Cloudflare gets about people's online behavior. I am always very skeptical of centralization and of having a company get this much information. Remember google's Don't be evil? I'm extremely uncomfortable with such a massive centralization of data. People might say that the status co is not great because DNS is sent to the ISP. I'd argue the status co is better because it's far less centralized. And, at least for Europeans, I trust European legislation better than US legislations. I can understand the argument that some countries have mass surveillance and it's a net positive for users in those countries since it will protect them. But in that case, I feel that the default should be randomized from a list of provider, not only one company. I also would be much less concerned by this if it was an option on first startup with a clear explanation (even though users tend to not read and blindly click accept, it's at least more of an informed consent) And anyway, that purpose of preventing mass surveillance and blocking in those countries where it would actually be useful seems to be moot because of: > Additionally, Mozilla is also working with ISPs to make sure users won't use DoH as a way to bypass legally-set blocklists. > The organization said it's been asking ISPs and providers of network-based parental control solutions to add a "canary domain" to their blocklists. When Firefox will detect that this canary domain is blocked, it will disable DoH to prevent the feature to be used as a filter-bypassing solution. So, if isp in countries with censorship can use a canary website to prevent users from bypassing "legally-set blocklists". What is the point again of enabling this?
- diffeomorphism 7y ago
  > This will only increase the massive amount of data that Cloudflare gets about people's online behavior No, it explicitly won't. Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
tannhaeuser 7y ago
With Mozilla pushing their users around, it's inevitable that a FF fork with Moz's shenigans disabled will become mainstream. What's the current state of eg Seamonkey?
distant_hat 7y ago
In places like India, blocking is often done at the DNS level. Cloudflare and Firefox are big reasons I can get around stupid overbroad government blocking of whatever they think is anti-national or porn.
auslander 7y ago
List of FF "integrations" grows. There is also HIBP one. We need a clean from 3rd parties version, like ungoogled-chromium project.
Tharkun 7y ago
The result will be simple: FF market share in corporate environments will drop. If sysadmins have to jump through hoops simply to get the thing to respect corporate DNS settings, then it won't be used.
dqonvzpa 7y ago
“DoH means that Firefox will concentrate all DNS traffic on Cloudflare” Not true, you can choose DoH servers.
nullc 7y ago
Wow, thats awful that they're sending all user DNS requests to cloudflare without informed consent. Is this also potentially a violation of federal wiretap law? My ISP being able to monitor where I connect is not great, but being exposed to my ISP and cloudflare monitoring it is not better-- and is also very unexpected. There are also at least somewhat clear standards of privacy expected from ISPs, it's entirely unclear to me what duty of care cloudflare has towards users of this service or what position they'd be in to resist further compromise of user data (through either legal or illegal means).
bechampion 7y ago
privacy aside , how about internal hosted zones and stuff that isn't resolvable by TLDS or CCTLDS?
Niksko 7y ago
Pretty hilarious that this entire article is negated by contractual agreements spelled out in Firefox's FAQ in DoH https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
clan 7y ago
The Internet was a great distributed system with reasonable separation of concerns. Now we are content that applications do their own name resolution and said resolution is centralised on a very few (non-altruistic) hands (CloudFlare/Google). Add amp to this. Sprinkle it with the views of people who run their own mail server and consider where this leaves us. I am not that naive and think we can keep ourselves in 1995. But I do think we give up on too many of the good parts all to freely.
- pixl97 7y ago
  The internet also was 99% plaintext. Then we realized that governments would pull all kinds of tricks to watch that text. From your own state monitoring all the traffic, to outside states hijacking BGP and slurping up your data. This has, at least in the case of http centralized certificates. Here's the next thing, no one is stopping you from running your own DoH server. No one is stopping you from changing the FF config to use it. The big issue has been is the end user has been so unaware of security for so long and done so little about it somebody has to. There is no financial incentive for your ISP to care, so they have not. Most operating systems, specifically Windows, but also Apple have done little to nothing for client DNS security. This could have been handled between operating system developers and DNS infrastructure but they didn't care to.
  - zzzcpan 7y ago
    > This could have been handled between operating system developers and DNS infrastructure but they didn't care to. No, there was a lot of caring over the years as DNS is old and insecure, in particular unencrypted communications with authoritative DNS servers being the biggest issue. And yet completely ignored by DNS-over-HTTPS, because solving it would likely eliminate the need for resolvers in the middle, so surveillance capitalism isn't interested, they only want to "solve" it in a such way that doesn't really solve it, but just gives them DNS data.
DavideNL 7y ago
It's weird how large companies can make decisions like this (re-routing all DNS requests to the US) on their own, without local/EU government stepping in to prevent it...
TX-i 7y ago
I don't understand the DoH protocol entirely. I thought the entire point of it was to pass encrypted requests to CloudFlare. Can anyone confirm how this works? I thought this was the entire point of DoH, adding encryption to requests and directing it away from the plaintext DNS requests.
knorker 7y ago
The government already has your DNS queries. So the whole point of the argument is moot. The ISPs, and anyone they share the data with, also already have the DNS queries, so the argument is wrong. But also, if you do want just one government to have the data, do you prefer that data to go to your local country, which may be speech-oppressing regimes like Syria, Saudi Arabia, UK, Ukraine, or Iran? I fail to see how this is in any way a step backwards.
_Codemonkeyism 7y ago
I was never a conspiracy buff but the hordes of shills here who think it's a good idea to send the whole worlds browsing habits to the US a country with practically no protection of data lets this seem like a long prepared operation. The Chinese had to hack BGP to get that kind of data for a limited time.
mcovey 7y ago
I simply don't like DoH because I use a DNS provider that I have chosen - OpenDNS - specifically because they log my DNS queries and let me see that log. I don't mind DNS lookups from my network being logged, as long as the provider does accurate, uncensored DNS lookups. It's helped me find domains to block such as tracking domains used by IoT devices that I can't configure myself. I have my router directing all DNS traffic to OpenDNS so these devices can't pick their own servers, any outbound requests on port 53 will be redirected. If they start using DoH/DoT, I can't do that so easily. I'd have to start monitoring outbound traffic and do hostname resolution on the IPs. I think the privacy argument for DoH in the browser is fairly weak, since doing a DNS lookup is not really an indication of, well, anything really. No matter what domain it was, there's no indication that the user intended to visit a website or use a service on that domain, it could be as simple as a lookup to load an embedded image in a spam email. The only good usage of it is to prevent censorship via DNS.

408 points by telmich 7y ago

What they should do is offer several alternatives when enabling DoH (Cloudflare isn't the only DoH provider out there), and anto-detect if your ISP or local network supports it at the enterprise level. At least you can change the provider in about:config. I don't remember if you can do it through the settings page.

akerro 7y ago
Many ISPs won't offer such thing https://www.zdnet.com/article/uk-isp-group-names-mozilla-internet-villain-for-supporting-dns-over-https/ https://www.zdnet.com/article/uk-isp-group-names-mozilla-int...
- raverbashing 7y ago
  > claimed that Mozilla plans to support DNS-over-HTTPS "in such a way as to bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK." > By planning to support DNS-over-HTTPS, Mozilla is throwing a monkey wrench in many ISPs' ability to sniff on customers' traffic and filter traffic for government-mandated "bad sites." But I don't see why they can't offer their DoH, it seems their issue is with Cloudflare not with DoH per se
  - chii 7y ago
    because most people don't know they can easily bypass the DNS based filters that is used to block "bad sites". DoH by default uses cloudflare's DNS, and so won't (need to) comply with the UK's filter laws.
    - profmonocle 7y ago
      > DoH by default uses cloudflare's DNS, and so won't (need to) comply with the UK's filter laws. I'm assuming the DoH servers used by British users are physically in the UK. (I believe they anycast the service from all of their edge locations, and they have several in the UK.) So the fact that Cloudflare doesn't have to comply with this law is precarious. Is it because only ISPs are required to comply? If so, it seems like a matter of time before Parliament amends the law to require any public DNS operator to implement the filters as well.
- lysp 7y ago
  Also certain countries (eg. Australia), have a metadata retention law. That means that the ISP dns will 100% be logging all requests made. The risk of Cloudflare doing it is far outweighed by ISPs legally being required to do it, at least in Australia.
  - profmonocle 7y ago
    What if the user just doesn't make any DNS queries, because all their host lookups are going over DoH? They can log all the user's DNS queries, but all of them will just be for the DoH server whenever the user starts Firefox.
    - lysp 7y ago
      I assume DoH will not be logged at all. Or just many connections logged to "one.one.one.one". Difference being if I connected to ISP ABC's DoH server - communication between will be encrypted, but the actual requests will be logged after they receive the request.
- ripdog 7y ago
  Note that Mozilla has added a way for network operators to disable DoH for their entire network, by NXDOMAINing a specific fake address. UK ISPs will presumably do that, and DoH won't happen in the UK for a while.
dsr_ 7y ago
I can't see any way in which that could be abused. Kazakhstan, China, Russia and the NSA all agree with me.
bennyp101 7y ago
Yea, Preferences > Network Settings > Enable DNS over HTTPS Can currently choose "Cloudfare (default)" or "Custom" But I agree, a few more options on there would be good, and if they are turning it on by default, then there should be a setup page that appears to let you choose the provider or something

akerro 7y ago

Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government! If you don't like CF just switch to different provider https://github.com/curl/curl/wiki/DNS-over-HTTPS https://github.com/curl/curl/wiki/DNS-over-HTTPS

ndidi 7y ago
I do trust my ISP and my government more than I trust CloudFlare.
- dao- 7y ago
  Is your ISP in the US and your government the US government? The DoH rollout w/ Cloudflare is only planned for the US.
  - vetinari 7y ago
    > The DoH rollout w/ Cloudflare is only planned for the US. For now.
- seszett 7y ago
  It seems very American to me to trust a private actor such as CouldFlare more than your own government. I feel like at least in Europe, a large majority of people would trust their government and local ISP much more than some company halfway over the world with basically no accountancy in your own country, especially an American one since it means your data is basically at the mercy of the US government.
  - buildzr 7y ago
    Aren't there a bunch of European ISPs applying government enforced DNS blocking? Seems like this is a very good move for them.
    - q3k 7y ago
      The ISP I run is applying [1] such blocks on our DNS recursors (blocking illegal online gambling domains, as per legal requirements [2]). I still trust my DNS servers (or those of most ISPs, for that matter) more than I trust Cloudflare. I'd rather have intelligence services go through the effort of infiltrating every single ISP separately to get any useful dragnet intelligence, instead of just one large entity that can illegally collect all traffic from all users of a web browser. [1] - https://github.com/q3k/rsh-unbound https://github.com/q3k/rsh-unbound [2] - https://hazard.mf.gov.pl/Ustawa https://hazard.mf.gov.pl/Ustawa

fimdomeio 7y ago

Does anyone knows why does mozilla think this is a good idea? Between each user sharing dns queries with their isps and everyone sharing dns queries with cloudflare it appears that it's obviously more secure the first approach even if none of them is really that great.

Avamander 7y ago
ISPs have proven themselves untrustworthy repeatedly, CloudFlare yet really hasn't. Not that I like the control they have, but it's honestly the fault of ISP's this has happened.
- userbinator 7y ago
  some ISPs. The problem is that Mozilla is taking a very US-centric view of a product that is used worldwide.
  - gsnedders 7y ago
    …and DNS over HTTPS, using CloudFlare, is only being enabled in the US. A US-centric view for a US-only decision seems fair to me?
  - magashna 7y ago
    The change is only being rolled out to the US.
  - Avamander 7y ago
    True, I don't think it's ideal, but non-US entities are in slumber, there's still basically no deployment of more secure standards by ISPs. I'd send my ISP an e-mail about providing DoH but they can't even give me IPv6.
- falcolas 7y ago
  Cloudflare has taken sites offline before, in response to legal requests (CP) and social pressure (8ch). Whether it’s right to do it or not, Cloudflare has proven that it is not a neutral party.

netfl0 7y ago

Firefox, wth. Cloudflare is not the internet.

m-p-3 7y ago
It's currently proxying 10.2% of all known websites (by the surveyor) on the entire Internet. https://w3techs.com/technologies/details/cn-cloudflare/all/all https://w3techs.com/technologies/details/cn-cloudflare/all/a... Not big, but not insignificant.
- deleted 7y ago
  [deleted]

ros65536 7y ago

I think this article would benefit from not shoehorning politics into the issue. Couldn't take this seriously after the irrelevant slight at Trump.

Crinus 7y ago

If the single DoH 'server' is the issue, wouldn't having a list of several 'servers' around the globe (hopefully in places where there isn't any form of censorship and preferably though non-commercial institutions) that the browser selects randomly solve this?

vetinari 7y ago
No. The browser has no business in selecting DNS servers; it is a system-wide setting and it should ask the operating system to resolve names. How the operating system resolves names, is up to it. It could use tcp-over-pigeons, if the sysadmin configured it so, and no application should be working around that. If you want to use DoH with Cloudflare, you are free to configure your system to do so. You will also get consistency, all your apps will use the same system, not just the browser. Let the others to have their systems configured as it suits them.
- yuft 7y ago
  Maybe if the OS providers were more proactive about DNS over TLS/HTTPS, Mozilla wouldn't have needed to do this to keep users secure.
  - vetinari 7y ago
    Android does support DNS-over-TLS, and it does it in a way that does not break networks - whatever it gets from DHCP, it tries the same server with DoT first. Users can also configure their preferred DoT server. Linux, or at least the glibc-based distributions, have a concept of nss_modules; you can configure whatever mechanism you want, some people are using DNSCrypt or nss-tls, for example. Systemd-resolved, with all the hate it gets, does support DoT. So do other local caching resolvers, like Knot. With other systems, you would have to discuss that with the respective vendors. Vendors also discuss these issues with customers, and very few customers are fond of breaking their systems. Activism, as Mozilla has shown, is a good way to irritate a good chunk of your user base. The change would have to be gradual, and allow the local admins to be in control (like Android and Linux distributions do).

Chirael 7y ago

It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?

Johnnynator 7y ago
Yes, a DoH request would never hit your Pi Hole
m-p-3 7y ago
Yes, unless you configure Firefox to not use Cloudflare DoH.
jfindley 7y ago
Out of the box? Yep! I realise that will annoy people but honestly it's a good thing - any solution that would not bypass a pi-hole would allow governments and ISPs to do the same. To retain your pi-hole, you'll need to run a DoH proxy on your pi-hole device, configure your browser to use that as the DoH provider, and this will allow your pi-hole to inspect and modify DNS results. Your pi-hole can then use any upstream DoH provider that you want.
taneq 7y ago
Would it be hard to make pi-hole into a DoH provider so you could just point your browser at it? Or does that defeat the "just works" factor of the pi-hole?
- kadoban 7y ago
  Probably easier to just turn off DoH in Firefox. In a home LAN configuration, which I'd expect is the vast majority of Pi-hole setups, I don't think you'd really be gaining anything from DoH. And even if Pi-hole does support being a DoH server, you'd have to configure that in Firefox anyway.
  - ocdtrekkie 7y ago
    Presumably you'd want DoH on the Pi-hole in the other direction, so that it's encrypting your DNS requests forwarded out to the Internet. But yeah, there'd be no reason to want to deal with certificates for your local network machines to do DoH from Pi-hole to PC.

bennyp101 7y ago

The only thing that annoys me slightly about this, is that I currently have a couple of pi-holes running at home (one for us, and one for the kids) and I have the Mikrotik setup to redirect any request for DNS to the correct pi (So even if they change the DNS on the device it still hits the pi) This is going to make that a pain - especially if they introduce it in the mobile version?

sjagoe 7y ago
You should be able to disable the Firefox default-on DoH across your network by returning NXDOMAIN for use-application-dns.net [1] I don't know how to configure pi-hole, but at the dnsmasq level you can do that with this directive: address=/use-application-dns.net/ [1] https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...
- bennyp101 7y ago
  Interesting, thanks. I guess if these use normal DNS requests first to determine if it should be allowed, then it will work. > If a user has chosen to manually enable DoH, the signal from the network will be ignored and the user’s preference will be honored Well, that kinda puts a dampner on it all!
ripdog 7y ago
Only firefox does this, and Firefox has uBlock Origin. Why is this an issue?

jfindley 7y ago

This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP). If instead what you worry about is the government spying on your traffic then complaining about DoH is even more silly - DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany). DoH is vital to protect users around the world from censorship and worse. Enabling it by default is a good thing - protecting users from abuse shouldn't only be opt-in. There has to be SOME default chosen, and the default needs to be a site large and well run enough to a) handle the load, and b) be in the firefox HSTS preload list. There aren't a lot of good DoH providers that fit these criteria - CF is one of the few.

taneq 7y ago
> There has to be SOME default chosen It seems trivial to select a half a dozen likely candidates and let the user choose between them on install. Honestly I'd like them to do the same with the search engine. Yes, it's simple enough to change the default, but it'd be nice to choose up-front.
- johnmaguire2013 7y ago
  Every question you make a potential user/customer answer is a potential loss of conversion. Most Firefox users do not care. Those that do can figure out how to change it easily enough.
- deleted 7y ago
  [deleted]
- matharmin 7y ago
  Yes, it's trivial. It's also very annoying to the probably 99% of users who don't care about it at all, especially if this becomes just one of many settings that needs to be configured on startup.

mantap 7y ago

This misses the forest for the trees. In the UK ISPs are already legally mandated to log your web requests and provide them to the government. Those who live under free regimes should not deny those of us who live under oppressive governments the right to privacy of our communications. The fact that cloudflare is a US entity and thus not subject to UK law is the whole point.

chopin 7y ago
As far as I understood the OP is that it shouldn't be the default. If you worry for your government, you should use a VPN anyway (where possible which is the case for UK afaik).
- mantap 7y ago
  Why shouldn't it be the default? Switzerland has a population 8 million. Why should the default be geared towards a small minority when there are billions of people not just in the UK but in Asia and Africa who would benefit from this feature. If they OP thinks that their country's laws are strong enough to make the feature unnecessary then they can turn it off.
tadzik_ 7y ago
> Those who live under free regimes should not deny those of us who live under oppressive governments the right to privacy of our communications And those who live under oppresive governments should not be an excuse to force those who don't to have their traffic routed through a property of an oppressive government. Yes, I know it's not about to be a default for non-US users yet. But "The UK people are getting screwed" is not a very good argument for "everyone should be getting screwed by the US".
- mantap 7y ago
  It's not just the UK people. Most people in the world live in countries that have oppressive internet laws. Swiss people are a tiny privileged minority. The author should travel the world and see exactly how the internet is outside of their bubble. DoH is an important privacy feature and important for protecting people's fundamental rights.

paulcarroty 7y ago

DoH and DoT are very interested technologies, disabling them 'cause Cloudflare is ... strange. From another side, DoH/DoT prevents ISPs/government from DNS modifying/rerouting.

antientropic 7y ago
Why is that strange? It seems rather obvious to me why people are reluctant to route all their DNS queries through a for-profit company in a country with no real privacy laws (and one that you have to assume is backdoored by the NSA).
- paulcarroty 7y ago
  'Cause it not vendor-locked to Cloudflare, you can use your own server.

coleifer 7y ago

There are two points: 1. centralization of all dns lookups is worrisome 2. Dns should not be handled by applications. It should be handled by the operating system. I see a lot of people conflating the two in the comments.

kbumsik 7y ago
> 2. Dns should not be handled by applications. It should be handled by the operating system. I agree with #1 but why it should be managed by the OS?
- userbinator 7y ago
  No one wants a proliferation of different applications which all have different settings to access the network, especially when the OS provides centralised functionality to do so.
- rocqua 7y ago
  Because the OS gets provisioned with DNS by DHCP. Because the OS incorporates the hosts file. Any internal domains or local domain edits are not covered by this.
- vezycash 7y ago
  It's annoying. I've already experienced this with chrome as chrome ignores my hosts file settings. Example: Say you use hosts file to block porn and other shady sites for your kid, all they have to do is use chrome.
  - Someone1234 7y ago
    This has nothing to do with the topic. Chrome isn't replacing the OS's DNS resolver, and that bug is just that: a bug. A bug that I cannot reproduce. Chrome follows my HOSTS file fine on Windows 10. But even if it didn't it would still be off-topic.
- deadbunny 7y ago
  Because I don't want to have to manage 400 configs when I can manage 1.

aazaa 7y ago

> DoH means that Firefox will concentrate all DNS traffic on Cloudflare, and they send traffic from all their users to one entity. Why does DoH necessarily mean that Cloudflare will be handling the traffic? The article barrels right to that conclusion without explaining why.

bennyp101 7y ago
The default setting in Firefox is to use Cloudfare as the DOH provider
- aazaa 7y ago
  Thanks for pointing this out. > It is clear what Mozilla needs to do: Mozilla can and should revert the change and allow users to easily opt-in. And to select or enter the DoH provider instead of defaulting to Cloudflare. Buried lede is buried.

userbinator 7y ago

It's very disturbing to see the overreach that Mozilla has resorted to and the "privacy" argument (it was "security" before that...) being used to justify essentially ignoring system configuration. My ISP has more accountability than a company in another country. The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems. Exactly. If Mozilla wants to, it's more than welcome to reach into the VPN area with its own products, but I don't believe this functionality should be part of a browser. They're already reaching into the VPN area[1], should they also investigate bypassing Chinese censorship with their own "firewall-busting" obfuscating VPN? That's not something most users want nor need in their browsers, and such functionality is really a cat-and-mouse game that I think is best left to smaller and less-well-known entities. It's unfortunate that browsers are already beyond "neutral", when IMHO the only thing they should do is fetch exactly the page URL that was entered and display it. Edit: yes, apparently people disagree and want Mozilla to control what the Internet (and every user, ignoring his/her default configuration) does. This is really really disturbing. [1] https://news.ycombinator.com/item?id=20927832 https://news.ycombinator.com/item?id=20927832

seanhunter 7y ago
> The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems. This is beside the point. Mozilla make a browser. They don't make the address resolution code for the underlying operating system. Operating system vendors are of course going to start to support DNS-over-https. You can disable dns-over-https if you don't want it enabled. Just go to about:config and set network.trr.mode. to 5
- throw0101a 7y ago
  > You can disable dns-over-https if you don't want it enabled. It was also possible to disable Ubuntu from sending your desktop searches to online retailers: * https://www.pcworld.com/article/2889895/how-to-stop-ubuntu-from-sending-your-desktop-searches-to-online-retailers.html https://www.pcworld.com/article/2889895/how-to-stop-ubuntu-f... Just because something can be disabled does not necessarily mean it should be enabled by default in the first place.

wwright 7y ago

How will this affect using Firefox on an intranet, where there are often services and websites on a local-only DNS server? Will Firefox be unable to reach those sites by default?

treggle 7y ago

I strongly support DoH as it prevents government snooping on the public. It’s really unhelpful that people like this attack Firefox over this issue. Stand strong Firefox against this.

notyourday 7y ago
One goes fishing where the fish is. There are dozens of large and hundreds of medium to small ISPs in the US. There's only one Cloudflare. That's where the resources to get the data would be concentrated. It has been demonstrated with PRISM. If Mozilla wants to play this game, it really should make DoH a visible top level choice for a user.
- magashna 7y ago
  Most users don't understand DNS, HTTPS, or DoH. I think this decision overall is good, and for those who see and understand the possible issues, it's trivial to remedy.

booblik 7y ago

My understanding is that the DNS query goes to the closest of the more than 180 Cloudflare servers, not specifically to the US servers. Complete FUD.

userbinator 7y ago
The point is that Cloudflare is a US company. From that perspective, where their servers are located is irrelevant.
- booblik 7y ago
  Of course it is relevant. They claim US government has access to all the logs, this is simply not true.
  - falcolas 7y ago
    Please provide some proof that a US company would not have to respond to US government requests. The location of the servers doesn’t matter.

throw0101a 7y ago

In other news, bots have now started using DoH (one via Google's DoH service): * https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module https://www.proofpoint.com/us/threat-insight/post/psixbot-no... * https://news.ycombinator.com/item?id=20934680 https://news.ycombinator.com/item?id=20934680

riccardogiorato 7y ago

I hope to see a solution from Mozilla, is it known why they choose DoH with Cloudflare? It seems a bit strange from a company always focused on OSS.

mikl 7y ago
There aren’t a whole bunch of companies that are able to provide a good DNS service world-wide. You’ll need high-reliability DNS servers co-located all over the world. Probably a multi-million dollar investment to get such a thing going, saying nothing of the running costs.

isostatic 7y ago

> The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems. Not in applications! You're right. But so are Mozilla. Here we are 30 years into the web, and we're still using plain old DNS. DNS over TLS should have caught on, but it didn't. Apple and Microsoft had years to ensure it's implemented as standard, but they didn't. The points this article makes - about DHCP options, about multiple providers, are very valid. But they're also just talking shops. The biggest problems here seems to be 1) DHCP can't give internal DOH servers. When I'm at home I want it landing on my own DOH server, but when I'm away I want to use a different one. 2) Internal DNS resolving falls to bits

throw0101a 7y ago
> DNS over TLS should have caught on, but it didn't. So enable DoT instead.
m-p-3 7y ago
Agreed, I'd prefer setting up the DNS-over-HTTPS config at the gateway level (and either push the config over DHCP, or have the gateway act as a local resolver, which forwards the new requests over DoH), but we're not there yet.
- isostatic 7y ago
  In theory isn't it "just" a matter of agreeing a DHCP option number, then having the DHCP client (or vpn client or whatever) be responsible for passing it to applications that want it (including the system resolver, be that mDNSResponder, systemd, glibc, whatever windows uses) Anyone who wants to can configure their dhcp client to ignore it, or use a different service, you could even have applications doing that too, but this would allow a network operator to tell people where the recommended resource is. Likewise if you want to change your DNS provider yourself you would have a single location on your machine to do it for the entire OS, rather than having to change 50 different applications.
- bscphil 7y ago
  > have the gateway act as a local resolver, which forwards the new requests over DoH This is what I would like to see as a default (and included in routers). In fact, it's what I already do myself. I think (as others here have said) that the privacy concerns the article raises are mostly FUD. But I do agree with the article when it says handling DNS at the application level is kind of a terrible idea (even though it might seem justified in this case). If the end result is that every application has its own built in network stack, that's going to be terrible for security, usability, and make it much harder to debug third-party apps.

auslander 7y ago

OpenBSD folks removed it, and they are always right about security, as they were with disabling Intel hyperthreading.

tedk-42 7y ago

I think it's good Firefox are leading the way on DoH. The ability to chose which DNS provider you query will be next on the feature list for Firefox I imagine. Cloudflare have the same mindset to do something about the vulnerability of DNS to snooping (see their 1.1.1.1 app). Two companies with the same mindset. I'm hoping others follow them. The article itself sounds paranoid and divides those that would rather trust private companies (with good intentions) against those that would rather trust their ISP/Government (also with good intentions).

lousken 7y ago

As a sysadmin and a user i dont see any problems with DoH, i can easily set a DNS entry[0] so that FF respects my company configuration. And as a user I've been using DoH for months, just not from cloudflare but from CZ NIC because the latency was slightly better. You can easily set your custom DoH provider with 2 clicks in the Options menu. Also for most users I see benefits, because most of them don't use VPNs on free wifis. edit: I also think OS maintainers are the main problem here, none of this would've happened if they supported DoT or DoH themselves. [0] https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...

mikl 7y ago

Disagree. Most users haven’t chosen their DNS server, so replacing one unchosen DNS server with another makes no practical difference. And DoH means that people snooping on your network can no longer spy on you. Cloudflare has committed themselves to not track users via DNS requests, and only log what’s strictly necessary. And if you distrust Cloudflare, you have a much bigger problem. Half the Internet routes through Cloudflare these days. If they wanted to spy on you, they have (potentially clear-text) access to a good chunk of your HTTPS traffic. And as many others have pointed out, it’s a much better recommendation to have people change the DoH server to something else.

falcolas 7y ago

It's worth noting that CloudFlare has already proven itself to not be a neutral party - they have proven willing to take sites offline for both legal and social pressure reasons. This will greatly impact the internet's ability to route around censorship as if it were damage.

AgentME 7y ago
I agree, only somewhere that hosts neo-nazi websites would be trustworthy enough for this. /s
comex 7y ago
Cloudflare has proven willing to refuse to use their own bandwidth to host particular websites. That's very different from censoring DNS requests, and there's no reason to think they would do the latter.

auslander 7y ago

How decisions are made in Mozilla? By whom? Is there public discussion beforehand?

gcp 7y ago
This has been tested and debated for months. Initial support for Firefox rolled out 9 months ago or so: https://miketabor.com/enable-dns-over-https-and-encrypted-sni-in-firefox/ https://miketabor.com/enable-dns-over-https-and-encrypted-sn... The conclusion of the debate was that it vastly improves the privacy for most users. Which is why it shipped in Firefox. Take that into account when you read (misleading, factually wrong) push-back like the original article.
- gcp 7y ago
  First announcements were even longer ago: https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-ove...
- auslander 7y ago
  > The conclusion of the debate Obviously debate is still on, as we see in here and in [0], and it looks like HN folks are not in favour of these integrations, including me. So question stands, how/why the debate was concluded, did all developers had a vote? Is there a link to discussion? [0] https://news.ycombinator.com/item?id=20927832 https://news.ycombinator.com/item?id=20927832
  - gcp 7y ago
    >it looks like HN folks are not in favour of these integrations, including me. I have no idea why you think that random HN discussion afterwards (in response to an article filled with misinformation!) would have any bearing on how Firefox is developed. https://www.mozilla.org/en-US/about/governance/ https://www.mozilla.org/en-US/about/governance/ >Is there a link to discussion? There's been about 1.5 year of extended discussion and iteration over DoH, yes. I'm sorry but there certainly isn't just a "single" link!
7y ago

ltt481 7y ago

Living in Russia, I, for one, welcome DoH and ESNI. I know I trust Cloudflare more than my government and ISP (The same ISP that routinely spoofs requests to inject ad pages/reminders to pay for service, nevermind all the blocked sites).

konart 7y ago
Not like DoH helps much here though.

9588 7y ago

I think dns (and many other "trivial" to implement sensitive services) should be a gov service. Preferably the eu and idealy made usable for anyone.

Grue3 7y ago

Not convincing. I live in Russia, explain why I wouldn't want this turned on?

Aissen 7y ago

This is a gross over-simplification. Cloudflare is required by contract to respect your privacy, which is much stronger than even the privacy laws have here in the EU since it addresses everyone, not just the EU population: https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/privacy-policy/firefox/ https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... The people fighting for the status quo probably know how to run their own resolver, even with DoH or DTLS. But Mozilla's conundrum is how to protect everyone 's privacy (and to a certain extent, security). DoH, despite all its flaws, attempts to do that by piggy-backing on already working infrastructure, so it seems like a good fit to move everyone to DoH. But then, they're the chicken-and-egg problem. How do you make sure people deploy local DoH resolvers if no browser enforces the move to DoH ? How do you make sure those resolvers are truthful, or even respect local law (having both is often impossible). So, you need to compromise. I'd have preferred to have temporary non-profit third party entity handle this à-la-Letsencrypt, but Mozilla deemed its contract with Cloudflare sufficient to provide enough guaranties. Ideally, name resolution should be done closer to the user instead of being centralized like that. But by arguing instead of experimenting we just keep the status quo. Time will tell if this was a bad decision. But it's not as clear cut as this blog post says it is.

partialrecall 7y ago
> "This is a gross over-simplification. Cloudflare is required by contract to respect your privacy" How often to corporations take other corporations to court over contract disputes? I think it's pretty often.
- Aissen 7y ago
  It is indeed. We'll see if Mozilla's lawyers are good at writing contracts once the Mozilla vs Oath case resolves: https://blog.mozilla.org/blog/2017/12/05/mozilla-files-cross-complaint-against-yahoo-holdings-and-oath/ https://blog.mozilla.org/blog/2017/12/05/mozilla-files-cross...
nullc 7y ago
A contract where cloudflare receives no consideration isn't particularly comforting, as such agreements are routinely ignored by courts (or equivalently by capping damages at nothing). > Mozilla's conundrum is how to protect everyone 's privacy And exactly how does this protect user's privacy? Instead of the user's ISP being able to see where the user connects now both cloudflare AND the user's ISP (via seeing the connection itself) can tell.

m-p-3 7y ago

For those who are uneasy to use CF DoH, here's a list of alternative DoH Resolvers https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-available-servers https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-av...

garganzol 7y ago

We are having zero problems with the current decentralized DNS architecture. Evidently, Mozilla plays the role of a Google's darling once again. Those financial "donations" have some interesting effects, aren't they? Aside from an official "Google Search Bar in Firefox" line. What's even more interesting is that Hacker News moderator deranked the topic. Probably all the actors represent the same mafia ring, as they painfully in need to defend those interests to stay commercially relevant in changing world (hello IPFS).

unionpivo 7y ago

One thing that concerns me greatly is debugging network problems. Up until now, you could use dig, nslookup and other tools to see how your computers resolves to help you figure stuff out. Now what do you do? also what happens when firefox uses this cloudflare, some other X application will start using Z, and the third Y. Also I work, and used to work for many small shops (under 50 people) in different industries. Its standard practice to have internal domains, sometimes even having different things on the same domain (ie mail.comany.co is diffrenet server form inside and outside the network). If you don't have AD (increasingly common here with apple and linux laptops being the 95% of users), you will have to go to each user on every device that has firefox and help him fix the settings. I would say just block it at firewall level, but it's not trivial, without breaking sites that use cloudflare.

kemonocode 7y ago

Also, do keep in mind that by using DoH, you're also rendering anything like Pi-Hole useless. The solution of course being to use DoH from the Pi-Hole device [0], picking your own provider and disabling it on Firefox. Only step you need to change is the part where upstream providers are given and use your own instead of Cloudflare's default. [0] https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/

SimeVidas 7y ago

> It means people outside the US can now be fully tracked by US government How?

NikkiA 7y ago

I had to turn it off, not because I'm opposed to the idea, far from it, I'd love to use DoH, but because cloudflare's spat with archive.is renders the whole thing useless if you ever need to browse archive.is stored copies of pages.

tick_tock_tick 7y ago
Kind of a disservice to call it cloudflare's spat when archive.is added special code to make their dns implementation non spec compliant only when queried by cloudflare.
- yuft 7y ago
  I wonder if they will deal with it now that all US Firefox users will be unable to use it by default.

darkhorn 7y ago

I don't know about you guys but in Turkey if you query wikipedia.org from 8.8.8.8 it doesn't return results. However if you use DoH you can access Wikipedia. Thank you whoever contributed to DoH!

teddyh 7y ago
Whatever convinced Google – Google – to censor Turkey, you don’t think they will be able to convince Cloudflare to do the same? This is a problem of centralization.

tssva 7y ago

I think this is a horrible idea and applications should respect the OS DNS configuration. I have already configured the instance of dnsmasq on my router at home to return NXDOMAIN for the canary domain. That being said I am a little confused by those that are concerned because this change would mean their DNS queries will be sent to a US company and they don't trust US companies. Firefox is developed and distributed by a US corporation and is just a susceptible to being forced to follow US government directives as Cloudflare.

codedokode 7y ago

> It is clear what Mozilla needs to do: Mozilla can and should revert the change and allow users to easily opt-in. I think it should be on by default. In my country encrypted DNS makes it more difficult for the government to track what people watch and to block sites. > And to select or enter the DoH provider instead of defaulting to Cloudflare. You can enter any DNS server address in Firefox. While I agree, that it is bad to concentrate all the world's DNS queries in the hands of an entity under US jurisdiction, not encrypting DNS is much worse currently. So Cloudflare and US government are the lesser evil for me. Also, if there were volunteers running free DoH servers then Mozilla could choose one of them randomly instead of sending all queries to USA.

saurik 7y ago
Why not install DoH system wide, then (the kind of change which is easy if tools like Firefox use the system APIs for this and very difficult if individual applications all reimplement DNS) instead of only doing it for Firefox?
- codedokode 7y ago
  Because it is easier to embed it into a browser rather than persuade vendors of all major OSes (Windows, Mac, Android and thousand of Linux distributions) to add it. Also, even if a company like Microsoft adds it to Windows, they will add it only to they latest version and leave people on Windows XP, 7 and 8 without protection. Same with Google - they will add it only to the latest Android. Because commercial companies want you to buy new products, not to use the old one for a long time.

stordoff 7y ago

Maybe I'm missing something, but the "I think just me and you was safer" image feels a little misleading. There already was a third party - your ISP/DNS provider.

dreamcompiler 7y ago

I had no idea this was going to be the default. It's massively wrong. I use a Pihole DNS server, which means after a lot of debugging I'd have discovered Firefox had unilaterally decided to stop abiding by internet protocols. It's always one step forward and two back with these Moz guys. I guess that's better than every step back like Chrome, but jeez Moz, get a clue.

methou 7y ago

The stated problem is that there are few providers, as for the offending party - Firefox, it's they've defaulted to a company based in the US or a 14 Eyes member. It doesn't feel right to address the issue by blaming the DoH, or Firefox, as they are not defaulting to the prime evil - Google. I believe the better suggestion here to say is to set up own DoH servers, urge related parties to opensource their own implementation if there's none.

tptacek 7y ago

As somebody who's been working for internet security over 20 years, we strongly believe that applications should not choose the DNS server. The operating system is designed to manage DNS and network settings for all applications. This is nonsense.

tambre 7y ago
Instead of a reactionary remark please provide arguments and explanations for your viewpoint to actually further the discussion.
- draw_down 7y ago
  I think tptacek's comment is just fine as it is.

sirtoffski 7y ago

Idk folks, the entire debate seems to be out of proportion. 1) If you do not agree with Mozilla’s actions - do not user their browser. I mean Mozilla isn’t forcing anyone to use Firefox. As a company they are free to design their product as they see fit. As an individual you are free to either use their product or not. 2) If you disagree and still chose to use Firefox - just because you are reading this means you have the knowledge to disable DoH. 3) If Mozilla remove the option to disable DoH over CF and you don’t like it - use another browser. 4) If you are concerned for other people’s data going to CF (specifically people who are not as well informed, people who don’t know what DoH or even DNS is) - very noble indeed, but unfortunately options are limited here. Encourage people to do some research and to decide for themselves whether or not they are as passionate about it. The main point I am making is just as we want to be free in choosing whether or not to use DoH over CF, Mozilla is as free to design their own product.

gommm 7y ago

As someone who has donated to Mozilla over the years and used Firefox as much as possible, this makes me very unlikely to donate in the future. People say that it's trivial to change. It's trivial to change for us who are technically minded. It's far from obvious and will not be changed by non-technical users. This will only increase the massive amount of data that Cloudflare gets about people's online behavior. I am always very skeptical of centralization and of having a company get this much information. Remember google's Don't be evil? I'm extremely uncomfortable with such a massive centralization of data. People might say that the status co is not great because DNS is sent to the ISP. I'd argue the status co is better because it's far less centralized. And, at least for Europeans, I trust European legislation better than US legislations. I can understand the argument that some countries have mass surveillance and it's a net positive for users in those countries since it will protect them. But in that case, I feel that the default should be randomized from a list of provider, not only one company. I also would be much less concerned by this if it was an option on first startup with a clear explanation (even though users tend to not read and blindly click accept, it's at least more of an informed consent) And anyway, that purpose of preventing mass surveillance and blocking in those countries where it would actually be useful seems to be moot because of: > Additionally, Mozilla is also working with ISPs to make sure users won't use DoH as a way to bypass legally-set blocklists. > The organization said it's been asking ISPs and providers of network-based parental control solutions to add a "canary domain" to their blocklists. When Firefox will detect that this canary domain is blocked, it will disable DoH to prevent the feature to be used as a filter-bypassing solution. So, if isp in countries with censorship can use a canary website to prevent users from bypassing "legally-set blocklists". What is the point again of enabling this?

diffeomorphism 7y ago
> This will only increase the massive amount of data that Cloudflare gets about people's online behavior No, it explicitly won't. Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy. https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https

tannhaeuser 7y ago

With Mozilla pushing their users around, it's inevitable that a FF fork with Moz's shenigans disabled will become mainstream. What's the current state of eg Seamonkey?

distant_hat 7y ago

In places like India, blocking is often done at the DNS level. Cloudflare and Firefox are big reasons I can get around stupid overbroad government blocking of whatever they think is anti-national or porn.

auslander 7y ago

List of FF "integrations" grows. There is also HIBP one. We need a clean from 3rd parties version, like ungoogled-chromium project.

Tharkun 7y ago

The result will be simple: FF market share in corporate environments will drop. If sysadmins have to jump through hoops simply to get the thing to respect corporate DNS settings, then it won't be used.

dqonvzpa 7y ago

“DoH means that Firefox will concentrate all DNS traffic on Cloudflare” Not true, you can choose DoH servers.

nullc 7y ago

Wow, thats awful that they're sending all user DNS requests to cloudflare without informed consent. Is this also potentially a violation of federal wiretap law? My ISP being able to monitor where I connect is not great, but being exposed to my ISP and cloudflare monitoring it is not better-- and is also very unexpected. There are also at least somewhat clear standards of privacy expected from ISPs, it's entirely unclear to me what duty of care cloudflare has towards users of this service or what position they'd be in to resist further compromise of user data (through either legal or illegal means).

bechampion 7y ago

privacy aside , how about internal hosted zones and stuff that isn't resolvable by TLDS or CCTLDS?

Niksko 7y ago

Pretty hilarious that this entire article is negated by contractual agreements spelled out in Firefox's FAQ in DoH https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https

clan 7y ago

The Internet was a great distributed system with reasonable separation of concerns. Now we are content that applications do their own name resolution and said resolution is centralised on a very few (non-altruistic) hands (CloudFlare/Google). Add amp to this. Sprinkle it with the views of people who run their own mail server and consider where this leaves us. I am not that naive and think we can keep ourselves in 1995. But I do think we give up on too many of the good parts all to freely.

pixl97 7y ago
The internet also was 99% plaintext. Then we realized that governments would pull all kinds of tricks to watch that text. From your own state monitoring all the traffic, to outside states hijacking BGP and slurping up your data. This has, at least in the case of http centralized certificates. Here's the next thing, no one is stopping you from running your own DoH server. No one is stopping you from changing the FF config to use it. The big issue has been is the end user has been so unaware of security for so long and done so little about it somebody has to. There is no financial incentive for your ISP to care, so they have not. Most operating systems, specifically Windows, but also Apple have done little to nothing for client DNS security. This could have been handled between operating system developers and DNS infrastructure but they didn't care to.
- zzzcpan 7y ago
  > This could have been handled between operating system developers and DNS infrastructure but they didn't care to. No, there was a lot of caring over the years as DNS is old and insecure, in particular unencrypted communications with authoritative DNS servers being the biggest issue. And yet completely ignored by DNS-over-HTTPS, because solving it would likely eliminate the need for resolvers in the middle, so surveillance capitalism isn't interested, they only want to "solve" it in a such way that doesn't really solve it, but just gives them DNS data.

DavideNL 7y ago

It's weird how large companies can make decisions like this (re-routing all DNS requests to the US) on their own, without local/EU government stepping in to prevent it...

TX-i 7y ago

I don't understand the DoH protocol entirely. I thought the entire point of it was to pass encrypted requests to CloudFlare. Can anyone confirm how this works? I thought this was the entire point of DoH, adding encryption to requests and directing it away from the plaintext DNS requests.

knorker 7y ago

The government already has your DNS queries. So the whole point of the argument is moot. The ISPs, and anyone they share the data with, also already have the DNS queries, so the argument is wrong. But also, if you do want just one government to have the data, do you prefer that data to go to your local country, which may be speech-oppressing regimes like Syria, Saudi Arabia, UK, Ukraine, or Iran? I fail to see how this is in any way a step backwards.

_Codemonkeyism 7y ago

I was never a conspiracy buff but the hordes of shills here who think it's a good idea to send the whole worlds browsing habits to the US a country with practically no protection of data lets this seem like a long prepared operation. The Chinese had to hack BGP to get that kind of data for a limited time.

mcovey 7y ago

I simply don't like DoH because I use a DNS provider that I have chosen - OpenDNS - specifically because they log my DNS queries and let me see that log. I don't mind DNS lookups from my network being logged, as long as the provider does accurate, uncensored DNS lookups. It's helped me find domains to block such as tracking domains used by IoT devices that I can't configure myself. I have my router directing all DNS traffic to OpenDNS so these devices can't pick their own servers, any outbound requests on port 53 will be redirected. If they start using DoH/DoT, I can't do that so easily. I'd have to start monitoring outbound traffic and do hostname resolution on the IPs. I think the privacy argument for DoH in the browser is fairly weak, since doing a DNS lookup is not really an indication of, well, anything really. No matter what domain it was, there's no indication that the user intended to visit a website or use a service on that domain, it could be as simple as a lookup to load an embedded image in a spam email. The only good usage of it is to prevent censorship via DNS.