2 ms·

> It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local na

by m45t3r 7y ago

> It also breaks all of the usual things that make local DNS work. Your local DHCP server provides your local DNS server which includes entries for the local names with RFC1918 addresses that are only accessible on the local network. Move to DoH via some default external provider and that breaks and requires touching every application on every client to fix it. This is not true, Firefox will fallback to your OS configured name resolver if it can't find a name. You can also set it to strict mode so it will only use DOH, but this is not the option that Firefox set by default. https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...

zrm 7y ago
Better, but still broken because in many cases the names also exist in the global DNS but should have different addresses, e.g. because they have port mappings from public addresses but you don't want to have to use hairpin NAT for local connections, or the local router doesn't support that. It also implies that you're sending all queries for local names to an external provider when that otherwise wouldn't be happening.
- m45t3r 7y ago
  This is also covered (mostly) by Firefox. In enterprise configurations DOH will be disabled by default, and this should cover most of the cases above. https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...
  - zrm 7y ago
    That's really the opposite of those cases. If you're using group policy then Mozilla's default doesn't matter very much because you can set it to whatever you want using group policy anyway. Where the default really matters is on the devices where it has to be changed via high friction individualized action, e.g. BYOD. I completely understand why they want to support DoH. And then Firefox users with untrustworthy DNS providers would have a solution to it which is no more complicated than a single checkbox to enable it. But what is really being gained over that, which is worth all the trouble of making it the default even for all the people whose existing DNS providers are no less trustworthy than Cloudflare and far less centralized?
    - m45t3r 7y ago
      > But what is really being gained over that Try to explain for a common person what benefits DOH brings to them, or why their DNS provider is unstrustworthy. > [...] which is worth all the trouble of making it the default even for all the people whose existing DNS providers are no less trustworthy than Cloudflare and far less centralized? A small number of people will actually have those "trouble" that you speak, and for most of them the case is so specific that they probably are power users that can figure out themselves.

by m45t3r 7y ago

zrm 7y ago

Better, but still broken because in many cases the names also exist in the global DNS but should have different addresses, e.g. because they have port mappings from public addresses but you don't want to have to use hairpin NAT for local connections, or the local router doesn't support that. It also implies that you're sending all queries for local names to an external provider when that otherwise wouldn't be happening.

m45t3r 7y ago
This is also covered (mostly) by Firefox. In enterprise configurations DOH will be disabled by default, and this should cover most of the cases above. https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/ https://blog.mozilla.org/futurereleases/2019/09/06/whats-nex...
- zrm 7y ago
  That's really the opposite of those cases. If you're using group policy then Mozilla's default doesn't matter very much because you can set it to whatever you want using group policy anyway. Where the default really matters is on the devices where it has to be changed via high friction individualized action, e.g. BYOD. I completely understand why they want to support DoH. And then Firefox users with untrustworthy DNS providers would have a solution to it which is no more complicated than a single checkbox to enable it. But what is really being gained over that, which is worth all the trouble of making it the default even for all the people whose existing DNS providers are no less trustworthy than Cloudflare and far less centralized?
  - m45t3r 7y ago
    > But what is really being gained over that Try to explain for a common person what benefits DOH brings to them, or why their DNS provider is unstrustworthy. > [...] which is worth all the trouble of making it the default even for all the people whose existing DNS providers are no less trustworthy than Cloudflare and far less centralized? A small number of people will actually have those "trouble" that you speak, and for most of them the case is so specific that they probably are power users that can figure out themselves.