9 ms·

see also this cluster-fudge: "firefox: Safe Browsing updates fail due to insufficient quota on the Google API key" https://bugs.debian.org/cgi-bin/bugreport.cgi

see also this cluster-fudge: "firefox: Safe Browsing updates fail due to insufficient quota on the Google API key" https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895147 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895147 both issues are still open after more than 1 year! There seems to be a disconnect in how FF security is perceived by tech savvy users and how security/privacy critical bugs get prioritized by Mozilla. edit: Just recently I discovered DoH was activated by default now and bypassing my /etc/hosts block list without any warning. This opened me up to tracking from sites I thought I had blocked (discovered it only by accident and after several months when I actively looked into DoH and the network.trr.mode setting). In all above cases the failure-modes are insecure. It's like a firewall that suddenly switches its enforcement policy from a deny-all+whitelisting to allow-all+blacklisting without properly informing users. Totally unacceptable!

rovek 7y ago
My DoH in 71.0 and 72.0 is off by default, I haven't changed those settings.
- glyxbaer 7y ago
  Seems to be automatically enabled for users in the US [1] if I understand correctly. [1] https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
otterlicious 7y ago
The linked bug appears to be waiting on action from the Debian maintainers. The Mozilla devs in that thread seem very responsive.
- EwanToo 7y ago
  Yes, the linked bug (from the comment) appears to be entirely between Debian and Google (Chromium is affected too) with Mozilla offering to facilitate, with no (public at least) response from debian?
deleted 7y ago
[deleted]
pbhjpbhj 7y ago
Thank you for that note on DNS-over-HTTP .. it might explain a weird event for me recently where a blacklisted site wasn't blocked (opendns + pihole). Are FF sending all my DNS data to a private third party now then? Doesn't sound a very FOSS thing to do?
- byuu 7y ago
  Yes, they are sending all of your DNS requests to Cloudflare. You can of course change it, but it's opt-out and not communicated to users that this is happening.
  - fourthark 7y ago
    In the name of privacy. https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs
    - byuu 7y ago
      You may trust Cloudflare, but I do not. I trust my DNS provider. It's fine for me, I keep up on these things and I have disabled DoH already (I don't care for any current DoH provider, and I also rely on /etc/hosts entries.) In any case, my post was only meant to inform. To each their own, use them if you like or if you trust their privacy promises more than I do. But people should be aware that Mozilla silently changed where all your DNS requests are routed to.
      - coldpie 7y ago
        > You may trust Cloudflare, but I do not. I trust my DNS provider. For many, maybe even most, the situation is reversed. ISP-provided DNS (the default for 99% of web users) is very often intentionally mis-configured to return ad-laden "search results" instead of NXDOMAIN. The situation is more authoritarian administrative districts is even worse. You're right that trusting Cloudflare isn't ideal either, but they are at least better behaved than most ISPs, so it's the lesser of two evils, I think. Non-technical users shouldn't be expected to know how these things function, they should just get the least-bad option by default.
mosselman 7y ago
Thanks for this. What should I do to disable this? Set network.trr.mode in about:config to 0?
- shakna 7y ago
  Doesn't have to be so arcane. Network Settings -> Untick "Enable DNS over HTTPS"
  - mosselman 7y ago
    Thanks
- DyslexicAtheist 7y ago
  set network.trr.mode to 5: https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver also if you have unbound or local dnsmasq caching you could set a canary domain (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... ). To set it up with dnsmasq just add the line for the canary to /etc/dnsmasq.conf: address=/use-application-dns.net/
  - move-on-by 7y ago
    For those running a PiHole, I thought for sure that the pihole was already doing this for me. Turns out the implementations (#2915 & #2916) are still sitting in the development branch waiting for a release - they were merged to development on Sep 07, 2019. * https://github.com/pi-hole/pi-hole/pull/2915 https://github.com/pi-hole/pi-hole/pull/2915 * https://github.com/pi-hole/pi-hole/pull/2916 https://github.com/pi-hole/pi-hole/pull/2916 * https://github.com/pi-hole/pi-hole/compare/master...development https://github.com/pi-hole/pi-hole/compare/master...developm...
esarbe 7y ago
I guess you want your money back?
- DyslexicAtheist 7y ago
  no I want people who call themselves "devs" to actually care about security or stay away from production code. These are violations of very basic security principles.
  - smarnach 7y ago
    What do you mean by "stay away from production code"?
    - dylan604 7y ago
      Not the person you're replying, but I read it as "If you don't know what you're doing, do not touch".
  - phatfish 7y ago
    Ah yes, the entitled belligerent type that wants their high standards met or you get insults thrown at you. Feel free to develop your own browser, or use an alternative. Having my DNS queries go in plain text over the public internet is crazy. The fact that ISPs are moaning about it so loudly should be a big clue DoH is a good idea.
  - esarbe 7y ago
    What basic security principles would that be?
deleted 7y ago
[deleted]
AnIdiotOnTheNet 7y ago
Mozilla likes to talk a good game about caring about privacy and user control, but it's mostly just marketing. These are the same people who integrated Pocket and did that stupid Mr. Robot thing.
zaarn 7y ago
DoH is only activated by default in the US and if you use PiHole or similar there is a DNS canary that prevents FF from using DoH. Additionally it shouldn't be ignoring your /etc/hosts block list as DoH simply replaces DNS not the host list.
judge2020 7y ago
> Just recently I discovered DoH was activated by default now and bypassing my /etc/hosts block list without any warning It reads your /etc/hosts before going to DoH I believe.

rovek 7y ago

My DoH in 71.0 and 72.0 is off by default, I haven't changed those settings.

glyxbaer 7y ago
Seems to be automatically enabled for users in the US [1] if I understand correctly. [1] https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https

otterlicious 7y ago

The linked bug appears to be waiting on action from the Debian maintainers. The Mozilla devs in that thread seem very responsive.

EwanToo 7y ago
Yes, the linked bug (from the comment) appears to be entirely between Debian and Google (Chromium is affected too) with Mozilla offering to facilitate, with no (public at least) response from debian?

deleted 7y ago

[deleted]

pbhjpbhj 7y ago

Thank you for that note on DNS-over-HTTP .. it might explain a weird event for me recently where a blacklisted site wasn't blocked (opendns + pihole). Are FF sending all my DNS data to a private third party now then? Doesn't sound a very FOSS thing to do?

byuu 7y ago
Yes, they are sending all of your DNS requests to Cloudflare. You can of course change it, but it's opt-out and not communicated to users that this is happening.
- fourthark 7y ago
  In the name of privacy. https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs
  - byuu 7y ago
    You may trust Cloudflare, but I do not. I trust my DNS provider. It's fine for me, I keep up on these things and I have disabled DoH already (I don't care for any current DoH provider, and I also rely on /etc/hosts entries.) In any case, my post was only meant to inform. To each their own, use them if you like or if you trust their privacy promises more than I do. But people should be aware that Mozilla silently changed where all your DNS requests are routed to.
    - coldpie 7y ago
      > You may trust Cloudflare, but I do not. I trust my DNS provider. For many, maybe even most, the situation is reversed. ISP-provided DNS (the default for 99% of web users) is very often intentionally mis-configured to return ad-laden "search results" instead of NXDOMAIN. The situation is more authoritarian administrative districts is even worse. You're right that trusting Cloudflare isn't ideal either, but they are at least better behaved than most ISPs, so it's the lesser of two evils, I think. Non-technical users shouldn't be expected to know how these things function, they should just get the least-bad option by default.

mosselman 7y ago

Thanks for this. What should I do to disable this? Set network.trr.mode in about:config to 0?

shakna 7y ago
Doesn't have to be so arcane. Network Settings -> Untick "Enable DNS over HTTPS"
- mosselman 7y ago
  Thanks
DyslexicAtheist 7y ago
set network.trr.mode to 5: https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver also if you have unbound or local dnsmasq caching you could set a canary domain (https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... ). To set it up with dnsmasq just add the line for the canary to /etc/dnsmasq.conf: address=/use-application-dns.net/
- move-on-by 7y ago
  For those running a PiHole, I thought for sure that the pihole was already doing this for me. Turns out the implementations (#2915 & #2916) are still sitting in the development branch waiting for a release - they were merged to development on Sep 07, 2019. * https://github.com/pi-hole/pi-hole/pull/2915 https://github.com/pi-hole/pi-hole/pull/2915 * https://github.com/pi-hole/pi-hole/pull/2916 https://github.com/pi-hole/pi-hole/pull/2916 * https://github.com/pi-hole/pi-hole/compare/master...development https://github.com/pi-hole/pi-hole/compare/master...developm...

esarbe 7y ago

I guess you want your money back?

DyslexicAtheist 7y ago
no I want people who call themselves "devs" to actually care about security or stay away from production code. These are violations of very basic security principles.
- smarnach 7y ago
  What do you mean by "stay away from production code"?
  - dylan604 7y ago
    Not the person you're replying, but I read it as "If you don't know what you're doing, do not touch".
- phatfish 7y ago
  Ah yes, the entitled belligerent type that wants their high standards met or you get insults thrown at you. Feel free to develop your own browser, or use an alternative. Having my DNS queries go in plain text over the public internet is crazy. The fact that ISPs are moaning about it so loudly should be a big clue DoH is a good idea.
- esarbe 7y ago
  What basic security principles would that be?

deleted 7y ago

[deleted]

AnIdiotOnTheNet 7y ago

Mozilla likes to talk a good game about caring about privacy and user control, but it's mostly just marketing. These are the same people who integrated Pocket and did that stupid Mr. Robot thing.

zaarn 7y ago

DoH is only activated by default in the US and if you use PiHole or similar there is a DNS canary that prevents FF from using DoH. Additionally it shouldn't be ignoring your /etc/hosts block list as DoH simply replaces DNS not the host list.

judge2020 7y ago

> Just recently I discovered DoH was activated by default now and bypassing my /etc/hosts block list without any warning It reads your /etc/hosts before going to DoH I believe.