5 ms·

> Protect your kids and control what they can access online. Yes, god forbid some parents would like to have a little bit of control and the ability to protect

> Protect your kids and control what they can access online. Yes, god forbid some parents would like to have a little bit of control and the ability to protect their children from seeing obscene material when they're too young to handle it. Evil! Mozilla needs to quash these terrible people! May they burn with Brendan Eich!

saagarjha 7y ago
"Protecting your kids" is often "we log everything and have complete visibility over how people are using our service, and we're willing to share a bit of that with parents to spy on their children". It's a valid concern to have unless there's evidence to the contrary.
- core-questions 7y ago
  I assume every single DNS provider is logging and, if possible, selling my data. Why wouldn't I? This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. Still, if your goal is to block your kids' access to things, DNS is a good place to do it. Works across all your devices and doesn't require any install.
  - newscracker 7y ago
    I’d be interested to get to any links/descriptions on how you run your own DNS server and the monetary and time costs of it.
    - core-questions 7y ago
      You should look into setting up a Pi-Hole. https://pi-hole.net/ https://pi-hole.net/ Good jumping off point for this.
      - newscracker 7y ago
        Thanks. I have heard of pi-hole and know what it does (though I haven’t setup one myself). I’ll take a shot at it. I was wondering what stack the GP was using, where it was hosted and what the costs were.
  - icebraining 7y ago
    > This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. How do you prevent the ISP from logging those requests to the root?
    - LinuxBender 7y ago
      I can't speak for them, but I do the same thing and use a VPN to resolvers on numerous VPS providers. Those talk upstream to the root servers. Between the min-ttl cache at each layer and the large number of resolvers, correlation of my DNS requests is non trivial. I also ensure that client subnet EDNS is blocked.
    - core-questions 7y ago
      Hey, good point. I guess there's not much I can do about that yet, without DNSSEC or whatever.
      - tptacek 7y ago
        DNSSEC does nothing whatsoever to prevent your ISP from logging your requests.
    - autoexec 7y ago
      Unless you're connected to a VPN 100% of the time wouldn't your ISP already have access to see every domain you browse to?
      - icebraining 7y ago
        They do via the SNI header, but Firefox already includes support for encrypted SNI. So if the server supports that, all the ISP gets is the IP of the server you're connecting to. If that IP only hosts a single domain, then they can still tell, but in other cases (think sites behind Cloudflare, or using shared load balancers), they can't. Or actually, they might still, using side-channel attacks, but it's significantly harder to accomplish, especially at scale.
- threatofrain 7y ago
  Further, any mention of homosexuality is often considered to be inherently and unmistakably morally obscene, such as by the One Million Moms group, or as described by various state GOP platforms. This would include the narratives on whether lesbian or gay parents exist.
  - cookiecaper 7y ago
    One of the positives of DNS-level blocking is that it's relatively rough-grained. You can block pornhub.com, but you can't block out every mention of homosexuality at the DNS level without blocking any site that may potentially mention it, which would include any news site, discussion forum, social media, etc. We should be skeptical of aggresively-enforced DoH. In most cases, the vendor's interest in stopping ad blockers is stronger than their interest in protecting user privacy. Mozilla is slightly more removed, but as they're dependent on The Big G for revenue, we're basically just waiting for that shoe to drop.
    - threatofrain 7y ago
      Yes, so one should expect that religious sites describing the healthy mode of heterosexuality should remain visible, while sites discussing homosexual parenting ought be stricken via DNS. Is the positive you're talking about summed up as "it's not that bad"?
      - core-questions 7y ago
        It's well within any parent's rights to block content like that, yes. If I can prevent my children from seeing obscene and objectionable things until they're old enough to have reasonable conversations about it, I will. That doesn't mean I want to raise bigots, it just means I want to do what I can to ensure the narratives being pushed on my children are wholesome ones that will help them to grow up to be useful, contributing members of society and parents as well. Maybe you don't care about that for your own kids; that's on you, champ. I'm not arguing for anything censoring anyone else, or anyone censoring what any adult reads.
    - 7y ago
cremp 7y ago
I'm not saying that the product doesn't have it's use, but it is not how DoH should work. I'm trying to bolster the point that they are promoting logs and more importantly, blocking DNS queries. How can I trust the DoH endpoint if I know they have an active product whose purpose is to log and not give back the requested IP.

saagarjha 7y ago

"Protecting your kids" is often "we log everything and have complete visibility over how people are using our service, and we're willing to share a bit of that with parents to spy on their children". It's a valid concern to have unless there's evidence to the contrary.

core-questions 7y ago
I assume every single DNS provider is logging and, if possible, selling my data. Why wouldn't I? This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. Still, if your goal is to block your kids' access to things, DNS is a good place to do it. Works across all your devices and doesn't require any install.
- newscracker 7y ago
  I’d be interested to get to any links/descriptions on how you run your own DNS server and the monetary and time costs of it.
  - core-questions 7y ago
    You should look into setting up a Pi-Hole. https://pi-hole.net/ https://pi-hole.net/ Good jumping off point for this.
    - newscracker 7y ago
      Thanks. I have heard of pi-hole and know what it does (though I haven’t setup one myself). I’ll take a shot at it. I was wondering what stack the GP was using, where it was hosted and what the costs were.
- icebraining 7y ago
  > This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. How do you prevent the ISP from logging those requests to the root?
  - LinuxBender 7y ago
    I can't speak for them, but I do the same thing and use a VPN to resolvers on numerous VPS providers. Those talk upstream to the root servers. Between the min-ttl cache at each layer and the large number of resolvers, correlation of my DNS requests is non trivial. I also ensure that client subnet EDNS is blocked.
  - core-questions 7y ago
    Hey, good point. I guess there's not much I can do about that yet, without DNSSEC or whatever.
    - tptacek 7y ago
      DNSSEC does nothing whatsoever to prevent your ISP from logging your requests.
  - autoexec 7y ago
    Unless you're connected to a VPN 100% of the time wouldn't your ISP already have access to see every domain you browse to?
    - icebraining 7y ago
      They do via the SNI header, but Firefox already includes support for encrypted SNI. So if the server supports that, all the ISP gets is the IP of the server you're connecting to. If that IP only hosts a single domain, then they can still tell, but in other cases (think sites behind Cloudflare, or using shared load balancers), they can't. Or actually, they might still, using side-channel attacks, but it's significantly harder to accomplish, especially at scale.
threatofrain 7y ago
Further, any mention of homosexuality is often considered to be inherently and unmistakably morally obscene, such as by the One Million Moms group, or as described by various state GOP platforms. This would include the narratives on whether lesbian or gay parents exist.
- cookiecaper 7y ago
  One of the positives of DNS-level blocking is that it's relatively rough-grained. You can block pornhub.com, but you can't block out every mention of homosexuality at the DNS level without blocking any site that may potentially mention it, which would include any news site, discussion forum, social media, etc. We should be skeptical of aggresively-enforced DoH. In most cases, the vendor's interest in stopping ad blockers is stronger than their interest in protecting user privacy. Mozilla is slightly more removed, but as they're dependent on The Big G for revenue, we're basically just waiting for that shoe to drop.
  - threatofrain 7y ago
    Yes, so one should expect that religious sites describing the healthy mode of heterosexuality should remain visible, while sites discussing homosexual parenting ought be stricken via DNS. Is the positive you're talking about summed up as "it's not that bad"?
    - core-questions 7y ago
      It's well within any parent's rights to block content like that, yes. If I can prevent my children from seeing obscene and objectionable things until they're old enough to have reasonable conversations about it, I will. That doesn't mean I want to raise bigots, it just means I want to do what I can to ensure the narratives being pushed on my children are wholesome ones that will help them to grow up to be useful, contributing members of society and parents as well. Maybe you don't care about that for your own kids; that's on you, champ. I'm not arguing for anything censoring anyone else, or anyone censoring what any adult reads.
  - 7y ago

cremp 7y ago

I'm not saying that the product doesn't have it's use, but it is not how DoH should work. I'm trying to bolster the point that they are promoting logs and more importantly, blocking DNS queries. How can I trust the DoH endpoint if I know they have an active product whose purpose is to log and not give back the requested IP.