4 ms·

I think part of the negativity you see is network admins working in businesses. Their opinion is that it's a way for people to get around corporate firewalls.

by Jonnax 7y ago

I think part of the negativity you see is network admins working in businesses. Their opinion is that it's a way for people to get around corporate firewalls. Kinda blind to the idea that if a browser can implement DNS over HTTPS then anything can. Especially since there's some of ways that Mozilla have implemented for a local area DNS server to override its settings. There's also another camp, if you remember the "internet villain of the year" award that Mozilla got for DNS over HTTPS from an ISP industry group. Of course their argument was parental controls being made ineffective. But of course it's transparent that this was a gambit to change public opinion so they can keep collecting browsing data to sell. Interesting to note they went after Mozilla not Google who are also implementing it. But really the messed up thing is that this improves privacy for the vast majority of users. Especially those people around the world where searching the wrong thing up online can lead to imprisonment or worse. This kind of thing is a privacy improvement for millions. And I find it shocking that people in Business IT care more about managing their corporate devices than the good of the majority of internet users.

userbinator 7y ago
I'm not a network admin working in a business, but I am the network admin of my home network, and I really do not want applications starting to effectively contain their own VPN clients and subverting my control.
- Jonnax 7y ago
  DNS isn't a VPN nor really a security product. It's just a look up table. The job blocking domains should be the job of a firewall. Of course this becomes more complex. But any application can implement DNS over HTTPS. Malware could even just get a list of IPs from another IP. An application can even just hard code IPs rather than using DNS and then they're in the same position.
  - userbinator 7y ago
    Tunneling DNS inside HTTPS effectively forms part of a VPN already (and I wonder when Mozilla will decide to also stuff the rest of the traffic through...) DNS-based blocking is not perfect, but is currently still very powerful for things like adblocking. You're basically saying that Firefox is now behaving like malware, which I agree with... Windows 10's telemetry is also another piece of software which has started to become hostile in this manner, hardcoding IPs and such.
    - silon42 7y ago
      Exactly. To control DoH we need to start to MITM all connections and block everthing else unless whitelisted.
      - EvanAnderson 7y ago
        For home network operators who value controlling the name resolution of devices they 'own' MITM won't be enough once embedded device manufacturers start using certificate pinning w/ DoH.
        silon42 7y ago
        Obviously, there will be a choice not to buy them / keep them offline.
    - kibwen 7y ago
      > I wonder when Mozilla will decide to also stuff the rest of the traffic through Mozilla has recently begun offering an integrated VPN with Firefox, though unlike DoH that has a monthly subscription fee (hell, I don't blame them for wanting to diversify their revenue). The partner in that case is Mullvad. > You're basically saying that Firefox is now behaving like malware This is hyperbole. End users should look out for their own best interests by using any means necessary, which includes hiding as much as they can from the network. If the network doesn't like that, then it has the choice not to allow that user to attach a device to the network.
    - judge2020 7y ago
unionpivo 7y ago
> Their opinion is that it's a way for people to get around corporate firewalls. Kinda blind to the idea that if a browser can implement DNS over HTTPS then anything can. Thats not the problem. If more application folow Firefox, and do DNS on their own, corporate applications and sites will stop working, and IT will get the blame. Now that it's just firefox, ok, but if other app will follow the lead, we will constantly have to play whack a mole, why someone doesn't resolve correctly. How do I debug problems ? Is there a tool (something like dig), i can use to see, how will Firefox resolve a domain ? Where i work we don't block anything on our firewall, but we have plenty of services only exposed on internal DNS. Not to mention, we have to a lot of times replicate environment that is similar to clients, so I often create zones, where people can VPN in, and have similar DNS resolution as the target. Each app doing its own DNS will make that harder. > Especially those people around the world where searching the wrong thing up online can lead to imprisonment or worse That would be true, if Mozilla rolled this out worldwide, but its US only. Also right now there are bazillion ISP with bazillion DNS servers. There are very few DOH DNS providers that Mozilla endorses, so if majority of "privacy" conscious people will start using them, it will become that more valuable for various bad actors to compromise them. Right now there are so many ISP's with their own DNS's that even if all of them were selling the data, just finding them all and buying their data would be huge task. This is another centralization of previously decentralized service. (like it happened with email) Honestly I think that in the long run, this will be worse for privacy that we have now.
zoonosis 7y ago
> I think part of the negativity you see is network admins working in businesses. They can block the canary domain[1]. > Of course their argument was parental controls being made ineffective. DoH is disabled on Windows and macOS if parental controls are enabled[1]. [1] https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...

by Jonnax 7y ago

userbinator 7y ago

I'm not a network admin working in a business, but I am the network admin of my home network, and I really do not want applications starting to effectively contain their own VPN clients and subverting my control.

Jonnax 7y ago
DNS isn't a VPN nor really a security product. It's just a look up table. The job blocking domains should be the job of a firewall. Of course this becomes more complex. But any application can implement DNS over HTTPS. Malware could even just get a list of IPs from another IP. An application can even just hard code IPs rather than using DNS and then they're in the same position.
- userbinator 7y ago
  Tunneling DNS inside HTTPS effectively forms part of a VPN already (and I wonder when Mozilla will decide to also stuff the rest of the traffic through...) DNS-based blocking is not perfect, but is currently still very powerful for things like adblocking. You're basically saying that Firefox is now behaving like malware, which I agree with... Windows 10's telemetry is also another piece of software which has started to become hostile in this manner, hardcoding IPs and such.
  - silon42 7y ago
    Exactly. To control DoH we need to start to MITM all connections and block everthing else unless whitelisted.
    - EvanAnderson 7y ago
      For home network operators who value controlling the name resolution of devices they 'own' MITM won't be enough once embedded device manufacturers start using certificate pinning w/ DoH.
      - silon42 7y ago
        Obviously, there will be a choice not to buy them / keep them offline.
  - kibwen 7y ago
    > I wonder when Mozilla will decide to also stuff the rest of the traffic through Mozilla has recently begun offering an integrated VPN with Firefox, though unlike DoH that has a monthly subscription fee (hell, I don't blame them for wanting to diversify their revenue). The partner in that case is Mullvad. > You're basically saying that Firefox is now behaving like malware This is hyperbole. End users should look out for their own best interests by using any means necessary, which includes hiding as much as they can from the network. If the network doesn't like that, then it has the choice not to allow that user to attach a device to the network.
  - judge2020 7y ago

unionpivo 7y ago

> Their opinion is that it's a way for people to get around corporate firewalls. Kinda blind to the idea that if a browser can implement DNS over HTTPS then anything can. Thats not the problem. If more application folow Firefox, and do DNS on their own, corporate applications and sites will stop working, and IT will get the blame. Now that it's just firefox, ok, but if other app will follow the lead, we will constantly have to play whack a mole, why someone doesn't resolve correctly. How do I debug problems ? Is there a tool (something like dig), i can use to see, how will Firefox resolve a domain ? Where i work we don't block anything on our firewall, but we have plenty of services only exposed on internal DNS. Not to mention, we have to a lot of times replicate environment that is similar to clients, so I often create zones, where people can VPN in, and have similar DNS resolution as the target. Each app doing its own DNS will make that harder. > Especially those people around the world where searching the wrong thing up online can lead to imprisonment or worse That would be true, if Mozilla rolled this out worldwide, but its US only. Also right now there are bazillion ISP with bazillion DNS servers. There are very few DOH DNS providers that Mozilla endorses, so if majority of "privacy" conscious people will start using them, it will become that more valuable for various bad actors to compromise them. Right now there are so many ISP's with their own DNS's that even if all of them were selling the data, just finding them all and buying their data would be huge task. This is another centralization of previously decentralized service. (like it happened with email) Honestly I think that in the long run, this will be worse for privacy that we have now.

zoonosis 7y ago

> I think part of the negativity you see is network admins working in businesses. They can block the canary domain[1]. > Of course their argument was parental controls being made ineffective. DoH is disabled on Windows and macOS if parental controls are enabled[1]. [1] https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...