4 ms·

So this whole Firefox DoH is a moot point when these other options exist. Why Mozilla must you insist on making this more difficult?

tiew9Vii 7y ago
Applications should respect OS settings unless told otherwise by a user i.e opt in not opt out. It’s useful Firefox has the option to enable dns over https for users who do not run their own dns, dnscrypt, stubby servers etc but it should absolutely be opt in otherwise it’s bypassing any custom dns servers setup already. I run a small OpenBSD router with stubby for dns over tls and unbound for caching. Unbound is also loaded with a dns blocklist for adblocking/malicious site blocking which unfortunately would get bypassed automatically by browser defaults. OpenBSD just patched Firefox to disable doh by default.
- techntoke 7y ago
  There probably already exists, but I would like to see a standardized Docker setup for encrypted DNS and running your own DNS with unbound. I run both Unbound and Nsd locally, but I probably have a lot I could improve upon. I just used what few informative tutorials I was able to find.
  - dngray 7y ago
    The arch wiki actually has a section on using unbound, dnsmasq, pdnsd with dnscrypt: https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DNS_cache_configuration https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DN... I do this on my router, and then force all of it over the VPN with a socks proxy.
    - techntoke 7y ago
      Any chance you could setup that in a Docker contaienr?
      - dngray 7y ago
        It would be very trivial to do. I currently use AlpineLinux and have mine setup like so: https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Unbound_DNS_forwarder_with_dnscrypt https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...
- josteink 7y ago
  > I run a small OpenBSD router with stubby for dns over tls and unbound for caching. Good news you can add DNS records which informs Firefox to disable DoH: https://news.ycombinator.com/item?id=20913248 https://news.ycombinator.com/item?id=20913248 > OpenBSD just patched Firefox to disable doh by default. People never seem to get it or admit it up front, but OpenBSD consistently seem to be making the right choices all the way.
  - dngray 7y ago
    > People never seem to get it or admit it up front, but OpenBSD consistently seem to be making the right choices all the way. It's also worth noting that OpenBSD is used by a relevantly small number of users, when you consider everyone in the world. Out of those users I would bet close on 100% of them actually know what DNS is. So just because they do something with their default packaging does not mean it is right for everyone everywhere. Take something like Ubuntu for example.
- dngray 7y ago
  > Applications should respect OS settings unless told otherwise by a user i.e opt in not opt out. No, this is absolutely terrible. The reason being is because it leaves pleb users who don't even know what DNS is unprotected. It's also only really okay, when you control the DNS server on your network otherwise you're unprotected. Advanced users which have their own local DNS servers and have those set up to do lookups over DoT/DoHS etc are certainly in the minority. Getting all operating systems to include support for DoHs and all unsupported ones to include it isn't going to happen, so I think at this point it's certainly justifiable to include support in the browser. In the future we may see every OS will have support for something like DNS over QUIC (where DoHs will lead to). We see with Android 9 support for DoT, but that is just Android 9 (10.4% in May 2019) https://www.androidauthority.com/android-version-distribution-748439/ https://www.androidauthority.com/android-version-distributio... We know there's plenty of older android devices out there which will likely never see an update.
donmcronald 7y ago
It's because DoH can't be blocked without breaking the internet. I don't understand the benefit to Mozilla, but pushing HTTPS + DoH + ESNI + a handful of huge CDN IPs guarantees the death of ad blockers. The biggest DNS servers for application level DoH are going to be run by ad companies and the future of tracking is via DNS (over HTTPS) queries.
- dngray 7y ago
  > don't understand the benefit to Mozilla, but pushing HTTPS + DoH + ESNI It is to prevent against ISP filtering and censorship. A lot of governments do it with DNS rather than deep packet inspection in a full-on china style way. > The biggest DNS servers for application level DoH are going to be run by ad companies and the future of tracking is via DNS (over HTTPS) queries. Adblocking is better done with things like uBlock anyway. The reason is because you can manipulate the document object model with that to actually block the thing popping up. Adblocking with DNS is pretty crappy, you end up getting huge white squares and blank popups anyway.
  - donmcronald 7y ago
    And mobile apps?
    - dngray 7y ago
      > And mobile apps? Well Fennec on Android supports extensions mostly. I currently have: • CleanURLs https://addons.mozilla.org/addon/clearurls/ https://addons.mozilla.org/addon/clearurls/ • Cookie AutoDelete https://addons.mozilla.org/addon/cookie-autodelete/ https://addons.mozilla.org/addon/cookie-autodelete/ • CSS Exfil Protection https://addons.mozilla.org/addon/css-exfil-protection/ https://addons.mozilla.org/addon/css-exfil-protection/ • Decentraleyes https://addons.mozilla.org/addon/decentraleyes/ https://addons.mozilla.org/addon/decentraleyes/ • ETag Stoppa https://addons.mozilla.org/addon/etag-stoppa/ https://addons.mozilla.org/addon/etag-stoppa/ • HTTPS Everywhere https://addons.mozilla.org/addon/https-everywhere/ https://addons.mozilla.org/addon/https-everywhere/ • Redirect AMP to HTML https://addons.mozilla.org/addon/amp2html/ https://addons.mozilla.org/addon/amp2html/ • uBlock Origin https://addons.mozilla.org/addon/ublock-origin/ https://addons.mozilla.org/addon/ublock-origin/ • uMatrix https://addons.mozilla.org/firefox/addon/umatrix/ https://addons.mozilla.org/firefox/addon/umatrix/ On my workstation/laptop I don't use Cookie Autodelete or Etag Stoppa because I have • Firefox Multi-Account Containers https://addons.mozilla.org/addon/multi-account-containers/ https://addons.mozilla.org/addon/multi-account-containers/ • Temporary Containers https://addons.mozilla.org/addon/temporary-containers/ https://addons.mozilla.org/addon/temporary-containers/ instead. Oh and Tridactyl https://github.com/tridactyl/tridactyl https://github.com/tridactyl/tridactyl, I found this to be a better solution on my 13" laptop because Tree Style Tab https://addons.mozilla.org/addon/tree-style-tab https://addons.mozilla.org/addon/tree-style-tab takes up too much screen real estate. I am hoping when Fenix comes up to parity on the extensions front we will have a solution to https://bugzilla.mozilla.org/show_bug.cgi?id=1398097 https://bugzilla.mozilla.org/show_bug.cgi?id=1398097, which will allow for Container support.
executesorder66 7y ago
I use DNS over TLS at home, but at work I am glad that Firefox provides DoH since DNS over TLS is not supported by my work's corporate DNS servers and other common DNS servers are blocked on the network.

tiew9Vii 7y ago

Applications should respect OS settings unless told otherwise by a user i.e opt in not opt out. It’s useful Firefox has the option to enable dns over https for users who do not run their own dns, dnscrypt, stubby servers etc but it should absolutely be opt in otherwise it’s bypassing any custom dns servers setup already. I run a small OpenBSD router with stubby for dns over tls and unbound for caching. Unbound is also loaded with a dns blocklist for adblocking/malicious site blocking which unfortunately would get bypassed automatically by browser defaults. OpenBSD just patched Firefox to disable doh by default.

techntoke 7y ago
There probably already exists, but I would like to see a standardized Docker setup for encrypted DNS and running your own DNS with unbound. I run both Unbound and Nsd locally, but I probably have a lot I could improve upon. I just used what few informative tutorials I was able to find.
- dngray 7y ago
  The arch wiki actually has a section on using unbound, dnsmasq, pdnsd with dnscrypt: https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DNS_cache_configuration https://wiki.archlinux.org/index.php/Dnscrypt-proxy#Local_DN... I do this on my router, and then force all of it over the VPN with a socks proxy.
  - techntoke 7y ago
    Any chance you could setup that in a Docker contaienr?
    - dngray 7y ago
      It would be very trivial to do. I currently use AlpineLinux and have mine setup like so: https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Unbound_DNS_forwarder_with_dnscrypt https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...
josteink 7y ago
> I run a small OpenBSD router with stubby for dns over tls and unbound for caching. Good news you can add DNS records which informs Firefox to disable DoH: https://news.ycombinator.com/item?id=20913248 https://news.ycombinator.com/item?id=20913248 > OpenBSD just patched Firefox to disable doh by default. People never seem to get it or admit it up front, but OpenBSD consistently seem to be making the right choices all the way.
- dngray 7y ago
  > People never seem to get it or admit it up front, but OpenBSD consistently seem to be making the right choices all the way. It's also worth noting that OpenBSD is used by a relevantly small number of users, when you consider everyone in the world. Out of those users I would bet close on 100% of them actually know what DNS is. So just because they do something with their default packaging does not mean it is right for everyone everywhere. Take something like Ubuntu for example.
dngray 7y ago
> Applications should respect OS settings unless told otherwise by a user i.e opt in not opt out. No, this is absolutely terrible. The reason being is because it leaves pleb users who don't even know what DNS is unprotected. It's also only really okay, when you control the DNS server on your network otherwise you're unprotected. Advanced users which have their own local DNS servers and have those set up to do lookups over DoT/DoHS etc are certainly in the minority. Getting all operating systems to include support for DoHs and all unsupported ones to include it isn't going to happen, so I think at this point it's certainly justifiable to include support in the browser. In the future we may see every OS will have support for something like DNS over QUIC (where DoHs will lead to). We see with Android 9 support for DoT, but that is just Android 9 (10.4% in May 2019) https://www.androidauthority.com/android-version-distribution-748439/ https://www.androidauthority.com/android-version-distributio... We know there's plenty of older android devices out there which will likely never see an update.

donmcronald 7y ago

It's because DoH can't be blocked without breaking the internet. I don't understand the benefit to Mozilla, but pushing HTTPS + DoH + ESNI + a handful of huge CDN IPs guarantees the death of ad blockers. The biggest DNS servers for application level DoH are going to be run by ad companies and the future of tracking is via DNS (over HTTPS) queries.

dngray 7y ago
> don't understand the benefit to Mozilla, but pushing HTTPS + DoH + ESNI It is to prevent against ISP filtering and censorship. A lot of governments do it with DNS rather than deep packet inspection in a full-on china style way. > The biggest DNS servers for application level DoH are going to be run by ad companies and the future of tracking is via DNS (over HTTPS) queries. Adblocking is better done with things like uBlock anyway. The reason is because you can manipulate the document object model with that to actually block the thing popping up. Adblocking with DNS is pretty crappy, you end up getting huge white squares and blank popups anyway.
- donmcronald 7y ago
  And mobile apps?
  - dngray 7y ago
    > And mobile apps? Well Fennec on Android supports extensions mostly. I currently have: • CleanURLs https://addons.mozilla.org/addon/clearurls/ https://addons.mozilla.org/addon/clearurls/ • Cookie AutoDelete https://addons.mozilla.org/addon/cookie-autodelete/ https://addons.mozilla.org/addon/cookie-autodelete/ • CSS Exfil Protection https://addons.mozilla.org/addon/css-exfil-protection/ https://addons.mozilla.org/addon/css-exfil-protection/ • Decentraleyes https://addons.mozilla.org/addon/decentraleyes/ https://addons.mozilla.org/addon/decentraleyes/ • ETag Stoppa https://addons.mozilla.org/addon/etag-stoppa/ https://addons.mozilla.org/addon/etag-stoppa/ • HTTPS Everywhere https://addons.mozilla.org/addon/https-everywhere/ https://addons.mozilla.org/addon/https-everywhere/ • Redirect AMP to HTML https://addons.mozilla.org/addon/amp2html/ https://addons.mozilla.org/addon/amp2html/ • uBlock Origin https://addons.mozilla.org/addon/ublock-origin/ https://addons.mozilla.org/addon/ublock-origin/ • uMatrix https://addons.mozilla.org/firefox/addon/umatrix/ https://addons.mozilla.org/firefox/addon/umatrix/ On my workstation/laptop I don't use Cookie Autodelete or Etag Stoppa because I have • Firefox Multi-Account Containers https://addons.mozilla.org/addon/multi-account-containers/ https://addons.mozilla.org/addon/multi-account-containers/ • Temporary Containers https://addons.mozilla.org/addon/temporary-containers/ https://addons.mozilla.org/addon/temporary-containers/ instead. Oh and Tridactyl https://github.com/tridactyl/tridactyl https://github.com/tridactyl/tridactyl, I found this to be a better solution on my 13" laptop because Tree Style Tab https://addons.mozilla.org/addon/tree-style-tab https://addons.mozilla.org/addon/tree-style-tab takes up too much screen real estate. I am hoping when Fenix comes up to parity on the extensions front we will have a solution to https://bugzilla.mozilla.org/show_bug.cgi?id=1398097 https://bugzilla.mozilla.org/show_bug.cgi?id=1398097, which will allow for Container support.

executesorder66 7y ago

I use DNS over TLS at home, but at work I am glad that Firefox provides DoH since DNS over TLS is not supported by my work's corporate DNS servers and other common DNS servers are blocked on the network.