4 ms·

Mozilla is being more aggressive here than Google. My understanding about how Chrome will work, if the DNS servers configured on your machine support DoH, they

by kyrra 7y ago

Mozilla is being more aggressive here than Google. My understanding about how Chrome will work, if the DNS servers configured on your machine support DoH, they will silently upgrade to use DoH. But it is entirely based on what your system DNS server is set to. https://9to5google.com/2019/10/28/chrome-encrypt-dns/ https://9to5google.com/2019/10/28/chrome-encrypt-dns/ Mozilla (I believe) is doing rolling out DoH to users (in the US) to use CloudFlare's DoH server. This will bypass the system configured DNS servers. This can be disabled in settings. And if the DoH DNS lookup fails, it'll fallback to the system configured DNS. https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https (I'm a googler, opinions are my own)

SAI_Peregrinus 7y ago
Additionally (for Mozilla, not sure about chrome) there are a couple of checks to allow system administrators to force Firefox to fall back to the system DNS if desired. Either they can return NXDOMAIN (or some other options) to queries for use-application-dns.net, or they can use the usual group policy/active directory/policies.json methods to configure users' Firefox to not use DoH or use their internal DNS server with DoH if supported. https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... https://support.mozilla.org/en-US/kb/customizing-firefox-using-group-policy-windows https://support.mozilla.org/en-US/kb/customizing-firefox-usi... https://support.mozilla.org/en-US/kb/customizing-firefox-using-policiesjson https://support.mozilla.org/en-US/kb/customizing-firefox-usi... https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverhttps https://github.com/mozilla/policy-templates/blob/master/READ...
- vetinari 7y ago
  With the admins having to userride use-application-dns.net, they have to break DNSSEC for the .net root. Classy move, Mozilla.
  - SAI_Peregrinus 7y ago
    They don't have to, that's one of the options. If they're corporate admins they likely have Active Directory or the ability to require the profiles.json, which also disables it. It's intended as a way to allow DNS filtering software to work when admins aren't involved with user devices. DNS filtering software breaks DNSSEC anyway. So using it doesn't break anything extra.
    - vetinari 7y ago
      I believe you meant Group Policies, as Active Directory in itself won't solve any Firefox configuration problems. With policies.json, we have such experience that random Firefox updates wipe it out and we have to redeploy. With the DNSSEC breackage, the issue is the scope. With a little bit of thought, they could break just .application-dns.net instead of entire .net, if they used use.application-dns.net instead of use-application-dns.net. But I guess collateral damage wasn't in the mind of whoever suggested that.
      - tptacek 7y ago
        The whole point of this feature is to ensure DNS filtering keeps working. Since DNS filtering already conflicts with DNSSEC, what does it matter that one of Firefox's mechanisms for signaling that you want DNS filtering also conflicts with DNSSEC?
        vetinari 7y ago
        No, the point of this feature is to use the resolver configured by the network administrator. DNS filtering might be one of the reasons, but there might be others, like resolving zones behind ACL, which by definition won't be resolvable by public resolvers. Also, it is a difference, when a single second level domain has broken DNSSEC (especially one used only by single application that won't use DNSSEC anyway), and when entire top level domain is broken (which will be used by other applications, which do validate DNSSEC). I know that DNSSEC is not favoured by browser makers; I'm personally not a big fan either. But just ignoring it as they were all the years is something different, than actively trying to undermine it and damaging other users of it.
JohnFen 7y ago
> Mozilla is being more aggressive here than Google. This is true. Nothing has shaken my faith in Mozilla more than their efforts with DoH.

by kyrra 7y ago

SAI_Peregrinus 7y ago

Additionally (for Mozilla, not sure about chrome) there are a couple of checks to allow system administrators to force Firefox to fall back to the system DNS if desired. Either they can return NXDOMAIN (or some other options) to queries for use-application-dns.net, or they can use the usual group policy/active directory/policies.json methods to configure users' Firefox to not use DoH or use their internal DNS server with DoH if supported. https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... https://support.mozilla.org/en-US/kb/customizing-firefox-using-group-policy-windows https://support.mozilla.org/en-US/kb/customizing-firefox-usi... https://support.mozilla.org/en-US/kb/customizing-firefox-using-policiesjson https://support.mozilla.org/en-US/kb/customizing-firefox-usi... https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverhttps https://github.com/mozilla/policy-templates/blob/master/READ...

vetinari 7y ago
With the admins having to userride use-application-dns.net, they have to break DNSSEC for the .net root. Classy move, Mozilla.
- SAI_Peregrinus 7y ago
  They don't have to, that's one of the options. If they're corporate admins they likely have Active Directory or the ability to require the profiles.json, which also disables it. It's intended as a way to allow DNS filtering software to work when admins aren't involved with user devices. DNS filtering software breaks DNSSEC anyway. So using it doesn't break anything extra.
  - vetinari 7y ago
    I believe you meant Group Policies, as Active Directory in itself won't solve any Firefox configuration problems. With policies.json, we have such experience that random Firefox updates wipe it out and we have to redeploy. With the DNSSEC breackage, the issue is the scope. With a little bit of thought, they could break just .application-dns.net instead of entire .net, if they used use.application-dns.net instead of use-application-dns.net. But I guess collateral damage wasn't in the mind of whoever suggested that.
    - tptacek 7y ago
      The whole point of this feature is to ensure DNS filtering keeps working. Since DNS filtering already conflicts with DNSSEC, what does it matter that one of Firefox's mechanisms for signaling that you want DNS filtering also conflicts with DNSSEC?
      - vetinari 7y ago
        No, the point of this feature is to use the resolver configured by the network administrator. DNS filtering might be one of the reasons, but there might be others, like resolving zones behind ACL, which by definition won't be resolvable by public resolvers. Also, it is a difference, when a single second level domain has broken DNSSEC (especially one used only by single application that won't use DNSSEC anyway), and when entire top level domain is broken (which will be used by other applications, which do validate DNSSEC). I know that DNSSEC is not favoured by browser makers; I'm personally not a big fan either. But just ignoring it as they were all the years is something different, than actively trying to undermine it and damaging other users of it.

JohnFen 7y ago

> Mozilla is being more aggressive here than Google. This is true. Nothing has shaken my faith in Mozilla more than their efforts with DoH.