3 ms·

Today's Guardian has a piece [1] on Firefox's DNS over HTTP and how Mozilla has no plans yet to make it the default in the UK. Most of the article is about how

Today's Guardian has a piece [1] on Firefox's DNS over HTTP and how Mozilla has no plans yet to make it the default in the UK. Most of the article is about how it breaks centralised web filtering, and has concerned-sounding quotes from child protection organisations. Probably a predictable slant for a general readership publication to take, but it is concerning that use of DoH might be being framed solely as enabling criminality. As someone who lives in the UK and who enabled it several months ago for privacy (anti-tracking) reasons, I'm going to have to keep an eye on this. [1] https://www.theguardian.com/technology/2019/sep/24/firefox-no-uk-plans-to-make-encrypted-browser-tool-its-default https://www.theguardian.com/technology/2019/sep/24/firefox-n...

t0astbread 7y ago
Couldn't the UK just work together with popular DoH providers to implement filtering in a clean way?
- tialaramex 7y ago
  Mozilla's TRR agreements require that the end user willingly consented to any shenanigans done to their DNS results from your server. So you can make a kiddy filter DNS provider that won't let you resolve pornhub, but your users need to have gone "Yeah, kiddy filter, that's what I want" not get opted into it by a government policy. If you don't want a TRR agreement then sure, but now you'll need to teach users to go in and manually configure your servers. I have a feeling that "Here are the mandatory government instructions for ensuring censorship citizen" is not an effective strategy.
- andyjohnson0 7y ago
  I'd be ok with that. The problem would be the emergence of unscrupulous DoH providers. Presumably the fear is that having DoH built into the browser lowers the bar to entry for people who want to use it as part of engaging in criminality.
  - t0astbread 7y ago
    DoH compared to plain old DNS is about as much as a crime-enabler as HTTPS compared to HTTP (probably even less)
    - andyjohnson0 7y ago
      I was referring to people accessing illegal material, with DoH being used to bypass ISP-level content filtering.
Vinnl 7y ago
> The trade body for British ISPs even nominated Mozilla as one of its “internet villains of the year” in July over the issue. Wow. I mean, you can have an argument over de desirability of DoH, but referring to Mozilla as internet villains is really missing the forest for the trees. Luckily: > A month later, the body withdrew the nomination and cancelled the “award” entirely, saying it “clearly sent the wrong message”.
mike-cardwell 7y ago
As someone who lives in the UK and who disabled DoH in Firefox several months ago, and more recently LAN-wide using Mozillas announced canary domain (use-application-dns.net) for privacy reasons, I'm going to have to keep an eye on this. I'm happy to hear that they currently have no plans to launch DoH in the UK, but I worry that this is only a temporary situation. Note: If you want to protect the less tech-savy Firefox users on your LAN from Mozillas DoH implementation, update your DNS server to NXDOMAIN use-application-dns.net. You can do this easily in Unbound with the following piece of config: local-zone: "use-application-dns.net" static

t0astbread 7y ago

Couldn't the UK just work together with popular DoH providers to implement filtering in a clean way?

tialaramex 7y ago
Mozilla's TRR agreements require that the end user willingly consented to any shenanigans done to their DNS results from your server. So you can make a kiddy filter DNS provider that won't let you resolve pornhub, but your users need to have gone "Yeah, kiddy filter, that's what I want" not get opted into it by a government policy. If you don't want a TRR agreement then sure, but now you'll need to teach users to go in and manually configure your servers. I have a feeling that "Here are the mandatory government instructions for ensuring censorship citizen" is not an effective strategy.
andyjohnson0 7y ago
I'd be ok with that. The problem would be the emergence of unscrupulous DoH providers. Presumably the fear is that having DoH built into the browser lowers the bar to entry for people who want to use it as part of engaging in criminality.
- t0astbread 7y ago
  DoH compared to plain old DNS is about as much as a crime-enabler as HTTPS compared to HTTP (probably even less)
  - andyjohnson0 7y ago
    I was referring to people accessing illegal material, with DoH being used to bypass ISP-level content filtering.

Vinnl 7y ago

> The trade body for British ISPs even nominated Mozilla as one of its “internet villains of the year” in July over the issue. Wow. I mean, you can have an argument over de desirability of DoH, but referring to Mozilla as internet villains is really missing the forest for the trees. Luckily: > A month later, the body withdrew the nomination and cancelled the “award” entirely, saying it “clearly sent the wrong message”.

mike-cardwell 7y ago

As someone who lives in the UK and who disabled DoH in Firefox several months ago, and more recently LAN-wide using Mozillas announced canary domain (use-application-dns.net) for privacy reasons, I'm going to have to keep an eye on this. I'm happy to hear that they currently have no plans to launch DoH in the UK, but I worry that this is only a temporary situation. Note: If you want to protect the less tech-savy Firefox users on your LAN from Mozillas DoH implementation, update your DNS server to NXDOMAIN use-application-dns.net. You can do this easily in Unbound with the following piece of config: local-zone: "use-application-dns.net" static