7 ms·

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they gettin

Questions I couldn’t find answers to in the post or linked info about the Trusted Resolver Program: What’s in it for the Cloudflare & NextDNS? Are they getting paid to handle this traffic or paying to have the opportunity to access this data? Can users outside the US opt-in? The comment about having “no plans” to enable this outside the USA seems a bit disingenuous. Hard to believe they built this program / feature and have no plan to eventually roll out to all users. Perhaps what they wanted to say was they have no fixed timeline for roll out to other locations.

bepvte 7y ago
Yes, if you press the network and proxy settings in the preferences page, you will see a DNS over HTTPS setting. You can also use this to set your own resolver in case you dont trust cloudflare.
close04 7y ago
> The comment about having “no plans” to enable this outside the USA seems a bit disingenuous The comment actually very clearly says "we do not have plans to roll out the feature in Europe or other regions at this time". Also I have mixed feelings about this. On one hand yeah, encryption is great and someone sitting between me and my ISP will no longer be able to monitor my DNS queries. On the other hand I don't feel like this is protecting me from anything at this time. Instead of trusting my ISP, I have to trust Cloudflare. And in the meantime my ISP still knows where I am connecting to, between looking at the IP and the SNI (they mention ESNI but we're not there yet and it still just a partial fix). DoH (in general, not Mozilla's problem) just enables any piece of software or hardware on my network to bypass any security controls I have in place. No more filtering DNS with things like PiHole, no more blocking DNS port on your firewall. This tends to work out great for Google and any random IoT device manufacturer. I could cover this with more enterprisey setups but that's the last thing I want to do at home. So the average user probably sees no difference either way, nothing lost, nothing gained. But for me it's a clear regression because I lose the little control I had over that traffic and I just spread more data around to yet more companies. Some may even be in legal jurisdictions that are even less trustworthy than where my ISP is located.
- deleted 7y ago
  [deleted]
- tialaramex 7y ago
  > DoH just enables any piece of software or hardware on my network to bypass any security controls I have in place. I think this is an error in how you've thought about the problem. If your "security controls" depend upon other people volunteering to use some protocol then those weren't "security controls" they were more like "guidelines". [ My local airport has a sign and a telephone so that if you've arrived with goods that are forbidden or without permission to enter the country you can call up the relevant authorities and have them come fine or arrest you. The telephone looks dusty. Do you think maybe people just decide not to call? ] Mozilla does also have a programme https://iot.mozilla.org/ https://iot.mozilla.org/ about how to design IoT devices that allow their owners to control them rather than trying to bodge things by hoping they use protocols you can intercept.
  - 72deluxe 7y ago
    So I should block outgoing TLS requests to be able to stop DoH? Seems a bad idea.... At least with DNS I could run a local DNS server and block outgoing port 53 from anything else. Now I no longer have this option and each app gets to look up what it wants, when it wants. Sure, it's great that my ISP cannot see what's in these requests but nor can I! And it also means that any application (eg. any Google product) can query for advertising/tracking domains without me being able to do a thing about it. It isn't solving a problem - it's creating a far, far worse one (for me). If I have got this wrong, or there is a method around this - what is it???
    - JoshTriplett 7y ago
      Don't put devices on your network if you don't want to give them network access. And don't block technologies and protocols that help people protect themselves just because they also help devices protect themselves from you MITMing their connections. If you want to run a device reverse-engineering lab you have more work to do to break the security of a device. Also remember that if you can break the security of a device, so could an ISP router. The correct behavior for devices is to treat the intermediate network between them and the servers they talk to as hostile. How many people are using custom local plaintext DNS as a measure to analyze local devices on their network? How many more people are having their whole network's DNS usage analyzed by their ISP and anyone their ISP sells data to? The defaults are designed to be the right choice for people who don't change the defaults.
stiray 7y ago
Will they roll it out in Canada? Raising eyebrow and thinking if it has anything to do with GDPR
krn 7y ago
> What’s in it for the Cloudflare & NextDNS? It gives them a competitive advantage in DNS industry against other B2B providers, such as NS1.
- pbhjpbhj 7y ago
  How? Surely the only way that's possible is if they derive data about users, which they can then sell .. which is what Mozilla claim to be preventing.
  - dimensi0nal 7y ago
    Cloudflare's resolver does not send the client subnet, which hurts performance when users connect to anything that doesn't use Cloudflare.
    - jiveturkey 7y ago
      That's one thing, sure, but that doesn't affect the majority of sites. CF's DNS POPs are likely more dense than the great majority of service providers POPs. So using the subnet of the resolver is about as good (if not better) than having ECS info for practical purposes. (Because the client is normally going to hit the closest DNS POP to them in BGP network distance.) I'm not a CF fanboi, in fact I think they are evil. But let's not make weak arguments. That said, yeah suppression of ECS info is a deliberate anti-competitive choice by CF. They probably have convinced themselves its about privacy, but it isn't. The real benefit to them is, as the CDN, they get the benefit of even lower latency and even better control. With a penalty to everyone else. It's a disgusting arrangement, and a net loss in privacy. Your ISP already knows what websites you visit, they don't need the DNS because they see the actual traffic. I'd find it more palatable if these so-called TRR providers were required to be DNS-only. Maybe DNS + registrar.
      - yborg 7y ago
        >Your ISP already knows what websites you visit, they don't need the DNS because they see the actual traffic. Then why were the big ISPs lobbying against this plan when proposed by Google originally? Because they truly were concerned for the welfare of the Internet as they claimed? This is a concern they've never exhibited in the past, their only demonstrated concerns have been related to their revenue streams.
teekert 7y ago
Huh? It works for me in the Netherlands, at least, it is in the settings. How to confirm if I'm using it?
- fanf2 7y ago
  Go to about:networking and look at the DNS tab
  - dmix 7y ago
    I'm in Canada and TRR is indeed marked false for every domain.
    - ryanisnan 7y ago
      Strange. I'm also in Canada, but TRR is marked true for every domain.
- pbhjpbhj 7y ago
  If you use it, presumably you can make a GDPR claim to find out way Cloudflare are doing with the data?
gsich 7y ago
Collect data of course. Mozilla is very naive to trust that they won't collect data (be it personal or otherwise). Neither they nor the enduser can ensure that.
- stjohnswarts 7y ago
  Who is more likely to abuse it though, those guys or your ISP? Security is never 100%, it's whack-a-mole
  - gsich 7y ago
    I don't know, that wasn't the point though. At least with the ISP I am a customer, not a product.
    - dmix 7y ago
      And we all know what the ISP business model is. We have a right to ask what Cloudflare is getting out of this. We've seen the "don't be evil" free stuff thing turn sideways before.
- zoonosis 7y ago
  In order to be included in Firefox, they needed to agree to the DOH-resolver policy[1]. That states that: > We intend to publicly document violations of this Policy and take additional actions if necessary. I believe that those "additional actions" will prevent providers from violating the policy. If not, they will be removed from Firefox. [1] https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
- mintplant 7y ago
  Mozilla doesn't trust. That's what the legal team is for. All this stuff is covered by contracts and audits.
rasengan 7y ago
> having “no plans” to enable this outside the USA seems a bit disingenuous. Other countries have censorship (China, UK, New Zealand, etc) whereas there is none in the US. I wonder if that’s why?
- TheRealPomax 7y ago
  it's probably because cloudflare and friends went "we want to see what hit we're taking if we do this for free for you, by only enabling this by default for the US first" or something.
- floatingatoll 7y ago
  Mozilla was founded in USA, which may be of relevance for why USA was selected as the country of launch. I don’t know anything specific about their decision, though.
cnst 7y ago
> What’s in it for the Cloudflare & NextDNS? I'm amazed noone else is asking this. CF's whole business model centres around the concept of denying website access to minorities they classify as "bots". Some big actors can afford to practice the notion of reciprocity by blocking access to Cloudflare in return — https://news.ycombinator.com/item?id=21155056 https://news.ycombinator.com/item?id=21155056 — try doing that now when you might end up blocking access to your site for all Firefox users.
donmcronald 7y ago
After eSNI becomes mainstream, network level ad blocking will be extremely difficult. My guess is there will be a huge ad blocking subscription play in the future. They’re usurping control and calling it a privacy enhancement so they can sell the control back to us with per user per month pricing.

bepvte 7y ago

Yes, if you press the network and proxy settings in the preferences page, you will see a DNS over HTTPS setting. You can also use this to set your own resolver in case you dont trust cloudflare.

close04 7y ago

> The comment about having “no plans” to enable this outside the USA seems a bit disingenuous The comment actually very clearly says "we do not have plans to roll out the feature in Europe or other regions at this time". Also I have mixed feelings about this. On one hand yeah, encryption is great and someone sitting between me and my ISP will no longer be able to monitor my DNS queries. On the other hand I don't feel like this is protecting me from anything at this time. Instead of trusting my ISP, I have to trust Cloudflare. And in the meantime my ISP still knows where I am connecting to, between looking at the IP and the SNI (they mention ESNI but we're not there yet and it still just a partial fix). DoH (in general, not Mozilla's problem) just enables any piece of software or hardware on my network to bypass any security controls I have in place. No more filtering DNS with things like PiHole, no more blocking DNS port on your firewall. This tends to work out great for Google and any random IoT device manufacturer. I could cover this with more enterprisey setups but that's the last thing I want to do at home. So the average user probably sees no difference either way, nothing lost, nothing gained. But for me it's a clear regression because I lose the little control I had over that traffic and I just spread more data around to yet more companies. Some may even be in legal jurisdictions that are even less trustworthy than where my ISP is located.

deleted 7y ago
[deleted]
tialaramex 7y ago
> DoH just enables any piece of software or hardware on my network to bypass any security controls I have in place. I think this is an error in how you've thought about the problem. If your "security controls" depend upon other people volunteering to use some protocol then those weren't "security controls" they were more like "guidelines". [ My local airport has a sign and a telephone so that if you've arrived with goods that are forbidden or without permission to enter the country you can call up the relevant authorities and have them come fine or arrest you. The telephone looks dusty. Do you think maybe people just decide not to call? ] Mozilla does also have a programme https://iot.mozilla.org/ https://iot.mozilla.org/ about how to design IoT devices that allow their owners to control them rather than trying to bodge things by hoping they use protocols you can intercept.
- 72deluxe 7y ago
  So I should block outgoing TLS requests to be able to stop DoH? Seems a bad idea.... At least with DNS I could run a local DNS server and block outgoing port 53 from anything else. Now I no longer have this option and each app gets to look up what it wants, when it wants. Sure, it's great that my ISP cannot see what's in these requests but nor can I! And it also means that any application (eg. any Google product) can query for advertising/tracking domains without me being able to do a thing about it. It isn't solving a problem - it's creating a far, far worse one (for me). If I have got this wrong, or there is a method around this - what is it???
  - JoshTriplett 7y ago
    Don't put devices on your network if you don't want to give them network access. And don't block technologies and protocols that help people protect themselves just because they also help devices protect themselves from you MITMing their connections. If you want to run a device reverse-engineering lab you have more work to do to break the security of a device. Also remember that if you can break the security of a device, so could an ISP router. The correct behavior for devices is to treat the intermediate network between them and the servers they talk to as hostile. How many people are using custom local plaintext DNS as a measure to analyze local devices on their network? How many more people are having their whole network's DNS usage analyzed by their ISP and anyone their ISP sells data to? The defaults are designed to be the right choice for people who don't change the defaults.

stiray 7y ago

Will they roll it out in Canada? Raising eyebrow and thinking if it has anything to do with GDPR

krn 7y ago

> What’s in it for the Cloudflare & NextDNS? It gives them a competitive advantage in DNS industry against other B2B providers, such as NS1.

pbhjpbhj 7y ago
How? Surely the only way that's possible is if they derive data about users, which they can then sell .. which is what Mozilla claim to be preventing.
- dimensi0nal 7y ago
  Cloudflare's resolver does not send the client subnet, which hurts performance when users connect to anything that doesn't use Cloudflare.
  - jiveturkey 7y ago
    That's one thing, sure, but that doesn't affect the majority of sites. CF's DNS POPs are likely more dense than the great majority of service providers POPs. So using the subnet of the resolver is about as good (if not better) than having ECS info for practical purposes. (Because the client is normally going to hit the closest DNS POP to them in BGP network distance.) I'm not a CF fanboi, in fact I think they are evil. But let's not make weak arguments. That said, yeah suppression of ECS info is a deliberate anti-competitive choice by CF. They probably have convinced themselves its about privacy, but it isn't. The real benefit to them is, as the CDN, they get the benefit of even lower latency and even better control. With a penalty to everyone else. It's a disgusting arrangement, and a net loss in privacy. Your ISP already knows what websites you visit, they don't need the DNS because they see the actual traffic. I'd find it more palatable if these so-called TRR providers were required to be DNS-only. Maybe DNS + registrar.
    - yborg 7y ago
      >Your ISP already knows what websites you visit, they don't need the DNS because they see the actual traffic. Then why were the big ISPs lobbying against this plan when proposed by Google originally? Because they truly were concerned for the welfare of the Internet as they claimed? This is a concern they've never exhibited in the past, their only demonstrated concerns have been related to their revenue streams.

teekert 7y ago

Huh? It works for me in the Netherlands, at least, it is in the settings. How to confirm if I'm using it?

fanf2 7y ago
Go to about:networking and look at the DNS tab
- dmix 7y ago
  I'm in Canada and TRR is indeed marked false for every domain.
  - ryanisnan 7y ago
    Strange. I'm also in Canada, but TRR is marked true for every domain.
pbhjpbhj 7y ago
If you use it, presumably you can make a GDPR claim to find out way Cloudflare are doing with the data?

gsich 7y ago

Collect data of course. Mozilla is very naive to trust that they won't collect data (be it personal or otherwise). Neither they nor the enduser can ensure that.

stjohnswarts 7y ago
Who is more likely to abuse it though, those guys or your ISP? Security is never 100%, it's whack-a-mole
- gsich 7y ago
  I don't know, that wasn't the point though. At least with the ISP I am a customer, not a product.
  - dmix 7y ago
    And we all know what the ISP business model is. We have a right to ask what Cloudflare is getting out of this. We've seen the "don't be evil" free stuff thing turn sideways before.
zoonosis 7y ago
In order to be included in Firefox, they needed to agree to the DOH-resolver policy[1]. That states that: > We intend to publicly document violations of this Policy and take additional actions if necessary. I believe that those "additional actions" will prevent providers from violating the policy. If not, they will be removed from Firefox. [1] https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
mintplant 7y ago
Mozilla doesn't trust. That's what the legal team is for. All this stuff is covered by contracts and audits.

rasengan 7y ago

> having “no plans” to enable this outside the USA seems a bit disingenuous. Other countries have censorship (China, UK, New Zealand, etc) whereas there is none in the US. I wonder if that’s why?

TheRealPomax 7y ago
it's probably because cloudflare and friends went "we want to see what hit we're taking if we do this for free for you, by only enabling this by default for the US first" or something.
floatingatoll 7y ago
Mozilla was founded in USA, which may be of relevance for why USA was selected as the country of launch. I don’t know anything specific about their decision, though.

cnst 7y ago

> What’s in it for the Cloudflare & NextDNS? I'm amazed noone else is asking this. CF's whole business model centres around the concept of denying website access to minorities they classify as "bots". Some big actors can afford to practice the notion of reciprocity by blocking access to Cloudflare in return — https://news.ycombinator.com/item?id=21155056 https://news.ycombinator.com/item?id=21155056 — try doing that now when you might end up blocking access to your site for all Firefox users.

donmcronald 7y ago

After eSNI becomes mainstream, network level ad blocking will be extremely difficult. My guess is there will be a huge ad blocking subscription play in the future. They’re usurping control and calling it a privacy enhancement so they can sell the control back to us with per user per month pricing.