4 ms·

It's because DoH can't be blocked without breaking the internet. I don't understand the benefit to Mozilla, but pushing HTTPS + DoH + ESNI + a handful of huge

It's because DoH can't be blocked without breaking the internet. I don't understand the benefit to Mozilla, but pushing HTTPS + DoH + ESNI + a handful of huge CDN IPs guarantees the death of ad blockers. The biggest DNS servers for application level DoH are going to be run by ad companies and the future of tracking is via DNS (over HTTPS) queries.

dngray 7y ago
> don't understand the benefit to Mozilla, but pushing HTTPS + DoH + ESNI It is to prevent against ISP filtering and censorship. A lot of governments do it with DNS rather than deep packet inspection in a full-on china style way. > The biggest DNS servers for application level DoH are going to be run by ad companies and the future of tracking is via DNS (over HTTPS) queries. Adblocking is better done with things like uBlock anyway. The reason is because you can manipulate the document object model with that to actually block the thing popping up. Adblocking with DNS is pretty crappy, you end up getting huge white squares and blank popups anyway.
- donmcronald 7y ago
  And mobile apps?
  - dngray 7y ago
    > And mobile apps? Well Fennec on Android supports extensions mostly. I currently have: • CleanURLs https://addons.mozilla.org/addon/clearurls/ https://addons.mozilla.org/addon/clearurls/ • Cookie AutoDelete https://addons.mozilla.org/addon/cookie-autodelete/ https://addons.mozilla.org/addon/cookie-autodelete/ • CSS Exfil Protection https://addons.mozilla.org/addon/css-exfil-protection/ https://addons.mozilla.org/addon/css-exfil-protection/ • Decentraleyes https://addons.mozilla.org/addon/decentraleyes/ https://addons.mozilla.org/addon/decentraleyes/ • ETag Stoppa https://addons.mozilla.org/addon/etag-stoppa/ https://addons.mozilla.org/addon/etag-stoppa/ • HTTPS Everywhere https://addons.mozilla.org/addon/https-everywhere/ https://addons.mozilla.org/addon/https-everywhere/ • Redirect AMP to HTML https://addons.mozilla.org/addon/amp2html/ https://addons.mozilla.org/addon/amp2html/ • uBlock Origin https://addons.mozilla.org/addon/ublock-origin/ https://addons.mozilla.org/addon/ublock-origin/ • uMatrix https://addons.mozilla.org/firefox/addon/umatrix/ https://addons.mozilla.org/firefox/addon/umatrix/ On my workstation/laptop I don't use Cookie Autodelete or Etag Stoppa because I have • Firefox Multi-Account Containers https://addons.mozilla.org/addon/multi-account-containers/ https://addons.mozilla.org/addon/multi-account-containers/ • Temporary Containers https://addons.mozilla.org/addon/temporary-containers/ https://addons.mozilla.org/addon/temporary-containers/ instead. Oh and Tridactyl https://github.com/tridactyl/tridactyl https://github.com/tridactyl/tridactyl, I found this to be a better solution on my 13" laptop because Tree Style Tab https://addons.mozilla.org/addon/tree-style-tab https://addons.mozilla.org/addon/tree-style-tab takes up too much screen real estate. I am hoping when Fenix comes up to parity on the extensions front we will have a solution to https://bugzilla.mozilla.org/show_bug.cgi?id=1398097 https://bugzilla.mozilla.org/show_bug.cgi?id=1398097, which will allow for Container support.
- close04 7y ago
  > Adblocking is better done with things like uBlock anyway While true it has a very restricted use case: only on (some) browsers. Doesn't take into account any other application or device. And even uBlock will take a hit soon, at least on the most popular browser today. [0] So you can bet that the likes of Google will put their full weight behind any solution that prevents or at least severely inconveniences adblocking. [0] https://news.ycombinator.com/item?id=20050173 https://news.ycombinator.com/item?id=20050173
  - dngray 7y ago
    ehe yeah fuck google for doing that, clearly they care more about their bottom line. I don't have Chrome on my machine. What can you expect when the browser is made by an advertising company.
deleted 7y ago
[deleted]
CameronNemo 7y ago
Cloudflare is not an ad company. Perhaps you are thinking of Google?
ignoramous 7y ago
In case of DoH, one could firewall DoH servers and the fallback should be then to use OS defined resolvers. Of course, the app/ad-network could always complain abt connectivity and render the app unusable to get one to disable the firewall rules. Other way is to simply do all the advertisements and tracking through first-party domains / servers. I fully expect a standard here to take shape to let CDNs and 3Ps serve content from 1P domains (if it isn't already). One way to counter this could be to run the apps in a sandbox where one can restrict them from using certain APIs or fool them into thinking all is right with the world but content-block them anyway (like uBlockOrigin). Developing a sandbox is already possible in Android (see ParallelSpace), but likely requires a lot of work. It'd be interesting to see what WASM does to content blockers. If uBlockOrigin et al are still effective with WASM apps, one could simply run most, if not all apps from the browser and achieve content-blocking to their heart's content (no pun).
- donmcronald 7y ago
  What if the DoH IP is running via Cloudflare? How do you block their IPs? I agree about 1st party domains.
  - ignoramous 7y ago
    If TLS requests and responses could be intercepted (again, not straight forward with cert-pinning), blackholing MIME-type application/dns-message should work. Also, requests outgoing to dns.cloudflare.com/dns-query or dns.adguard.com/dns-query are blockable using URL rules. As the standard for DoH evolves (DoH resolver names might not require URLs, like how DoT doesn't, to eliminate the need for a bootstrap DNS resolver), URL blocking will be ineffective, as well. I guess, it is a cat and mouse game from here on.
    - xg15 7y ago
      I think the cat-and-mouse game is already over at "If TLS requests and responses could be intercepted". You need the cooperation of the app/device to do that. If it offers some way to do that, it will probably also have an option to just disable DoH. If it doesn't, you're back to blocking all Cloudflare (and Google) IPs.

dngray 7y ago

> don't understand the benefit to Mozilla, but pushing HTTPS + DoH + ESNI It is to prevent against ISP filtering and censorship. A lot of governments do it with DNS rather than deep packet inspection in a full-on china style way. > The biggest DNS servers for application level DoH are going to be run by ad companies and the future of tracking is via DNS (over HTTPS) queries. Adblocking is better done with things like uBlock anyway. The reason is because you can manipulate the document object model with that to actually block the thing popping up. Adblocking with DNS is pretty crappy, you end up getting huge white squares and blank popups anyway.

donmcronald 7y ago
And mobile apps?
- dngray 7y ago
  > And mobile apps? Well Fennec on Android supports extensions mostly. I currently have: • CleanURLs https://addons.mozilla.org/addon/clearurls/ https://addons.mozilla.org/addon/clearurls/ • Cookie AutoDelete https://addons.mozilla.org/addon/cookie-autodelete/ https://addons.mozilla.org/addon/cookie-autodelete/ • CSS Exfil Protection https://addons.mozilla.org/addon/css-exfil-protection/ https://addons.mozilla.org/addon/css-exfil-protection/ • Decentraleyes https://addons.mozilla.org/addon/decentraleyes/ https://addons.mozilla.org/addon/decentraleyes/ • ETag Stoppa https://addons.mozilla.org/addon/etag-stoppa/ https://addons.mozilla.org/addon/etag-stoppa/ • HTTPS Everywhere https://addons.mozilla.org/addon/https-everywhere/ https://addons.mozilla.org/addon/https-everywhere/ • Redirect AMP to HTML https://addons.mozilla.org/addon/amp2html/ https://addons.mozilla.org/addon/amp2html/ • uBlock Origin https://addons.mozilla.org/addon/ublock-origin/ https://addons.mozilla.org/addon/ublock-origin/ • uMatrix https://addons.mozilla.org/firefox/addon/umatrix/ https://addons.mozilla.org/firefox/addon/umatrix/ On my workstation/laptop I don't use Cookie Autodelete or Etag Stoppa because I have • Firefox Multi-Account Containers https://addons.mozilla.org/addon/multi-account-containers/ https://addons.mozilla.org/addon/multi-account-containers/ • Temporary Containers https://addons.mozilla.org/addon/temporary-containers/ https://addons.mozilla.org/addon/temporary-containers/ instead. Oh and Tridactyl https://github.com/tridactyl/tridactyl https://github.com/tridactyl/tridactyl, I found this to be a better solution on my 13" laptop because Tree Style Tab https://addons.mozilla.org/addon/tree-style-tab https://addons.mozilla.org/addon/tree-style-tab takes up too much screen real estate. I am hoping when Fenix comes up to parity on the extensions front we will have a solution to https://bugzilla.mozilla.org/show_bug.cgi?id=1398097 https://bugzilla.mozilla.org/show_bug.cgi?id=1398097, which will allow for Container support.
close04 7y ago
> Adblocking is better done with things like uBlock anyway While true it has a very restricted use case: only on (some) browsers. Doesn't take into account any other application or device. And even uBlock will take a hit soon, at least on the most popular browser today. [0] So you can bet that the likes of Google will put their full weight behind any solution that prevents or at least severely inconveniences adblocking. [0] https://news.ycombinator.com/item?id=20050173 https://news.ycombinator.com/item?id=20050173
- dngray 7y ago
  ehe yeah fuck google for doing that, clearly they care more about their bottom line. I don't have Chrome on my machine. What can you expect when the browser is made by an advertising company.

deleted 7y ago

[deleted]

CameronNemo 7y ago

Cloudflare is not an ad company. Perhaps you are thinking of Google?

ignoramous 7y ago

In case of DoH, one could firewall DoH servers and the fallback should be then to use OS defined resolvers. Of course, the app/ad-network could always complain abt connectivity and render the app unusable to get one to disable the firewall rules. Other way is to simply do all the advertisements and tracking through first-party domains / servers. I fully expect a standard here to take shape to let CDNs and 3Ps serve content from 1P domains (if it isn't already). One way to counter this could be to run the apps in a sandbox where one can restrict them from using certain APIs or fool them into thinking all is right with the world but content-block them anyway (like uBlockOrigin). Developing a sandbox is already possible in Android (see ParallelSpace), but likely requires a lot of work. It'd be interesting to see what WASM does to content blockers. If uBlockOrigin et al are still effective with WASM apps, one could simply run most, if not all apps from the browser and achieve content-blocking to their heart's content (no pun).

donmcronald 7y ago
What if the DoH IP is running via Cloudflare? How do you block their IPs? I agree about 1st party domains.
- ignoramous 7y ago
  If TLS requests and responses could be intercepted (again, not straight forward with cert-pinning), blackholing MIME-type application/dns-message should work. Also, requests outgoing to dns.cloudflare.com/dns-query or dns.adguard.com/dns-query are blockable using URL rules. As the standard for DoH evolves (DoH resolver names might not require URLs, like how DoT doesn't, to eliminate the need for a bootstrap DNS resolver), URL blocking will be ineffective, as well. I guess, it is a cat and mouse game from here on.
  - xg15 7y ago
    I think the cat-and-mouse game is already over at "If TLS requests and responses could be intercepted". You need the cooperation of the app/device to do that. If it offers some way to do that, it will probably also have an option to just disable DoH. If it doesn't, you're back to blocking all Cloudflare (and Google) IPs.