5 ms·

DNS over HTTPS is great for the average user. Anyone who needs some other configuration, clearly is knowledgeable enough to change the behavior.

by Jonnax 7y ago

lucb1e 7y ago
I have mixed feelings about this. Yes, we should do what is best for most people, and in particular those who cannot or will not configure it by themselves. But I, too, would like to have good defaults. In this particular case it seems relatively easy: have a blacklist of bad ISPs (similar to how we keep track of phishing sites) and enable it by default for those users (they already have lots of remote calls built in, such as http://detectportal.firefox.com/success.txt http://detectportal.firefox.com/success.txt or the update check, which could easily check to which ISP the request comes from). In the general case, I guess it would be something to choose on first run, which nobody wants. Perhaps there should be a flag/setting "I do want first-run questions for questionable defaults", so that I don't have to hear through the media which settings I have to change after the next update?
zrm 7y ago
It's not a matter of knowledge. If each application ignores the OS DNS configuration in favor of its own, it's no longer possible to make a system-wide change to it. You have to change each application individually, and then go back and do it again for each one that updates to a version that adds its own support for DoH. You also then end up with each application using its own implementation, but DoH is a complex protocol (DNS+TLS+HTTP), so that's a lot of attack surface. Better to have one high-quality up-to-date implementation in the OS than dozens of applications that each get their own chance to screw it up. It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local names with RFC1918 addresses that are only accessible on the local network. Move to DoH via some default external provider and that breaks and requires touching every application on every client to fix it.
- m45t3r 7y ago
  > It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local names with RFC1918 addresses that are only accessible on the local network. Move to DoH via some default external provider and that breaks and requires touching every application on every client to fix it. This is not true, Firefox will fallback to your OS configured name resolver if it can't find a name. You can also set it to strict mode so it will only use DOH, but this is not the option that Firefox set by default. https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...
  - zrm 7y ago
    Better, but still broken because in many cases the names also exist in the global DNS but should have different addresses, e.g. because they have port mappings from public addresses but you don't want to have to use hairpin NAT for local connections, or the local router doesn't support that. It also implies that you're sending all queries for local names to an external provider when that otherwise wouldn't be happening.
    - m45t3r 7y ago
      This is also covered (mostly) by Firefox. In enterprise configurations DOH will be disabled by default, and this should cover most of the cases above. https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...
      - zrm 7y ago
        That's really the opposite of those cases. If you're using group policy then Mozilla's default doesn't matter very much because you can set it to whatever you want using group policy anyway. Where the default really matters is on the devices where it has to be changed via high friction individualized action, e.g. BYOD. I completely understand why they want to support DoH. And then Firefox users with untrustworthy DNS providers would have a solution to it which is no more complicated than a single checkbox to enable it. But what is really being gained over that, which is worth all the trouble of making it the default even for all the people whose existing DNS providers are no less trustworthy than Cloudflare and far less centralized?
dontbenebby 7y ago
Also what would I change it to? Cloudflare was already my selected dns provider. Is the issue that DoH will leak individual pages, not just domains? If not I'm not clear what the issue is. I trust cloudflare more than my isp.
- falcolas 7y ago
  Quite literally anything you wanted to change it too. Google. Cloudflare. Your local ISP. Amazon. Verasign. Level3. Or you can run your own and do your own recursive lookups.
  - dontbenebby 7y ago
    Running one's own sounds like the only one that would increase your privacy more than cloudflare... but I worry if I slip up and don't keep patches etc up to date a private dns server could be more harmful. Probably better to leave such things to professionals.
m45t3r 7y ago
You can also argue that an OpenBSD user is not your average user. So I think the default from Firefox makes sense (since most of Firefox users are on Windows and should probably be average users), and the fact that OpenBSD override that default also makes sense.

DNS over HTTPS is great for the average user. Anyone who needs some other configuration, clearly is knowledgeable enough to change the behavior.

by Jonnax 7y ago

DNS over HTTPS is great for the average user. Anyone who needs some other configuration, clearly is knowledgeable enough to change the behavior.

lucb1e 7y ago

I have mixed feelings about this. Yes, we should do what is best for most people, and in particular those who cannot or will not configure it by themselves. But I, too, would like to have good defaults. In this particular case it seems relatively easy: have a blacklist of bad ISPs (similar to how we keep track of phishing sites) and enable it by default for those users (they already have lots of remote calls built in, such as http://detectportal.firefox.com/success.txt http://detectportal.firefox.com/success.txt or the update check, which could easily check to which ISP the request comes from). In the general case, I guess it would be something to choose on first run, which nobody wants. Perhaps there should be a flag/setting "I do want first-run questions for questionable defaults", so that I don't have to hear through the media which settings I have to change after the next update?

zrm 7y ago

It's not a matter of knowledge. If each application ignores the OS DNS configuration in favor of its own, it's no longer possible to make a system-wide change to it. You have to change each application individually, and then go back and do it again for each one that updates to a version that adds its own support for DoH. You also then end up with each application using its own implementation, but DoH is a complex protocol (DNS+TLS+HTTP), so that's a lot of attack surface. Better to have one high-quality up-to-date implementation in the OS than dozens of applications that each get their own chance to screw it up. It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local names with RFC1918 addresses that are only accessible on the local network. Move to DoH via some default external provider and that breaks and requires touching every application on every client to fix it.

m45t3r 7y ago
> It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local names with RFC1918 addresses that are only accessible on the local network. Move to DoH via some default external provider and that breaks and requires touching every application on every client to fix it. This is not true, Firefox will fallback to your OS configured name resolver if it can't find a name. You can also set it to strict mode so it will only use DOH, but this is not the option that Firefox set by default. https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...
- zrm 7y ago
  Better, but still broken because in many cases the names also exist in the global DNS but should have different addresses, e.g. because they have port mappings from public addresses but you don't want to have to use hairpin NAT for local connections, or the local router doesn't support that. It also implies that you're sending all queries for local names to an external provider when that otherwise wouldn't be happening.
  - m45t3r 7y ago
    This is also covered (mostly) by Firefox. In enterprise configurations DOH will be disabled by default, and this should cover most of the cases above. https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...
    - zrm 7y ago
      That's really the opposite of those cases. If you're using group policy then Mozilla's default doesn't matter very much because you can set it to whatever you want using group policy anyway. Where the default really matters is on the devices where it has to be changed via high friction individualized action, e.g. BYOD. I completely understand why they want to support DoH. And then Firefox users with untrustworthy DNS providers would have a solution to it which is no more complicated than a single checkbox to enable it. But what is really being gained over that, which is worth all the trouble of making it the default even for all the people whose existing DNS providers are no less trustworthy than Cloudflare and far less centralized?

dontbenebby 7y ago

Also what would I change it to? Cloudflare was already my selected dns provider. Is the issue that DoH will leak individual pages, not just domains? If not I'm not clear what the issue is. I trust cloudflare more than my isp.

falcolas 7y ago
Quite literally anything you wanted to change it too. Google. Cloudflare. Your local ISP. Amazon. Verasign. Level3. Or you can run your own and do your own recursive lookups.
- dontbenebby 7y ago
  Running one's own sounds like the only one that would increase your privacy more than cloudflare... but I worry if I slip up and don't keep patches etc up to date a private dns server could be more harmful. Probably better to leave such things to professionals.

m45t3r 7y ago

You can also argue that an OpenBSD user is not your average user. So I think the default from Firefox makes sense (since most of Firefox users are on Windows and should probably be average users), and the fact that OpenBSD override that default also makes sense.