8 ms·

With the admins having to userride use-application-dns.net, they have to break DNSSEC for the .net root. Classy move, Mozilla.

SAI_Peregrinus 7y ago
They don't have to, that's one of the options. If they're corporate admins they likely have Active Directory or the ability to require the profiles.json, which also disables it. It's intended as a way to allow DNS filtering software to work when admins aren't involved with user devices. DNS filtering software breaks DNSSEC anyway. So using it doesn't break anything extra.
- vetinari 7y ago
  I believe you meant Group Policies, as Active Directory in itself won't solve any Firefox configuration problems. With policies.json, we have such experience that random Firefox updates wipe it out and we have to redeploy. With the DNSSEC breackage, the issue is the scope. With a little bit of thought, they could break just .application-dns.net instead of entire .net, if they used use.application-dns.net instead of use-application-dns.net. But I guess collateral damage wasn't in the mind of whoever suggested that.
  - tptacek 7y ago
    The whole point of this feature is to ensure DNS filtering keeps working. Since DNS filtering already conflicts with DNSSEC, what does it matter that one of Firefox's mechanisms for signaling that you want DNS filtering also conflicts with DNSSEC?
    - vetinari 7y ago
      No, the point of this feature is to use the resolver configured by the network administrator. DNS filtering might be one of the reasons, but there might be others, like resolving zones behind ACL, which by definition won't be resolvable by public resolvers. Also, it is a difference, when a single second level domain has broken DNSSEC (especially one used only by single application that won't use DNSSEC anyway), and when entire top level domain is broken (which will be used by other applications, which do validate DNSSEC). I know that DNSSEC is not favoured by browser makers; I'm personally not a big fan either. But just ignoring it as they were all the years is something different, than actively trying to undermine it and damaging other users of it.

SAI_Peregrinus 7y ago

They don't have to, that's one of the options. If they're corporate admins they likely have Active Directory or the ability to require the profiles.json, which also disables it. It's intended as a way to allow DNS filtering software to work when admins aren't involved with user devices. DNS filtering software breaks DNSSEC anyway. So using it doesn't break anything extra.

vetinari 7y ago
I believe you meant Group Policies, as Active Directory in itself won't solve any Firefox configuration problems. With policies.json, we have such experience that random Firefox updates wipe it out and we have to redeploy. With the DNSSEC breackage, the issue is the scope. With a little bit of thought, they could break just .application-dns.net instead of entire .net, if they used use.application-dns.net instead of use-application-dns.net. But I guess collateral damage wasn't in the mind of whoever suggested that.
- tptacek 7y ago
  The whole point of this feature is to ensure DNS filtering keeps working. Since DNS filtering already conflicts with DNSSEC, what does it matter that one of Firefox's mechanisms for signaling that you want DNS filtering also conflicts with DNSSEC?
  - vetinari 7y ago
    No, the point of this feature is to use the resolver configured by the network administrator. DNS filtering might be one of the reasons, but there might be others, like resolving zones behind ACL, which by definition won't be resolvable by public resolvers. Also, it is a difference, when a single second level domain has broken DNSSEC (especially one used only by single application that won't use DNSSEC anyway), and when entire top level domain is broken (which will be used by other applications, which do validate DNSSEC). I know that DNSSEC is not favoured by browser makers; I'm personally not a big fan either. But just ignoring it as they were all the years is something different, than actively trying to undermine it and damaging other users of it.