7 ms·

So both Firefox and now Chrome will ignore DNS-level malware blockers, such as Pi-Hole. Malware/Adware will inevitably start using the same tricks, if they hav

So both Firefox and now Chrome will ignore DNS-level malware blockers, such as Pi-Hole. Malware/Adware will inevitably start using the same tricks, if they haven't already. And of course DoH is impossible to block without also blocking all of HTTPS. That's the point of it. A case study in unintended consequences.

middleclick 6y ago
You can turn it off?
- corford 6y ago
  For how long?
- LeoPanthera 6y ago
  In these two examples, yes. In more malicious future software? Certainly not.
yegle 6y ago
Run your own DoH/DoT server that forward to PiHole? It works well and with the added benefit of bring PiHole with you (on Android P and above, via DoT) http://github.com/yegle/your-dns http://github.com/yegle/your-dns
skybrian 6y ago
I'm not a Pi-Hole user but it looks like they already support this protocol? https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/
- goatsi 6y ago
  That's for making upstream DNS over HTTPS requests, not how they serve clients on the local network.
goatsi 6y ago
As of Pi-Hole release 4.4 it will automatically disable DoH for all Firefox browsers it serves by sinkholing the canary domain [0]. For Chrome it appears that they are just upgrading to DoH for the existing DNS servers if it is possible. Since a local Pi-Hole server wouldn't be in their possible upgrade list it would be left untouched. [0] https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...