3 ms·
I believe you meant Group Policies, as Active Directory in itself won't solve any Firefox configuration problems. With policies.json, we have such experience th
by vetinari 7y ago
I believe you meant Group Policies, as Active Directory in itself won't solve any Firefox configuration problems. With policies.json, we have such experience that random Firefox updates wipe it out and we have to redeploy.
With the DNSSEC breackage, the issue is the scope. With a little bit of thought, they could break just .application-dns.net instead of entire .net, if they used use.application-dns.net instead of use-application-dns.net. But I guess collateral damage wasn't in the mind of whoever suggested that.
- tptacek 7y agoThe whole point of this feature is to ensure DNS filtering keeps working. Since DNS filtering already conflicts with DNSSEC, what does it matter that one of Firefox's mechanisms for signaling that you want DNS filtering also conflicts with DNSSEC?
- vetinari 7y agoNo, the point of this feature is to use the resolver configured by the network administrator. DNS filtering might be one of the reasons, but there might be others, like resolving zones behind ACL, which by definition won't be resolvable by public resolvers. Also, it is a difference, when a single second level domain has broken DNSSEC (especially one used only by single application that won't use DNSSEC anyway), and when entire top level domain is broken (which will be used by other applications, which do validate DNSSEC). I know that DNSSEC is not favoured by browser makers; I'm personally not a big fan either. But just ignoring it as they were all the years is something different, than actively trying to undermine it and damaging other users of it.