4 ms·

For those of you worrying about what this will do to parental controls, I did a little bit of research. In this blog the chromium team say: https://blog.chrom

by nickcw 6y ago

For those of you worrying about what this will do to parental controls, I did a little bit of research. In this blog the chromium team say: https://blog.chromium.org/2019/10/addressing-some-misconceptions-about.html https://blog.chromium.org/2019/10/addressing-some-misconcept... > The first claim is that Google is going to redirect user DNS traffic to Google's own DNS or another DoH-compliant DNS provider. That is incorrect. Because we believe in user choice and user control, we have no plans to force users to change their DNS provider. Today, there are many independent DNS providers, although ISPs serve approximately 97% of user DNS needs. As long as these service providers keep catering to user needs and concerns, it will remain a diverse ecosystem. We’re simply enabling support in Chrome for secure DoH connections if a user’s DNS provider of choice offers it. Chrome will check if the user’s DNS provider is among a list of participating DoH-compatible providers and if so, it will enable DoH. If the DNS provider is not on the list, Chrome won’t enable DoH and will continue to operate as it does today. As DoH adoption increases, we expect to see the number of DoH-enabled DNS providers grow. This is re-iterated in the next paragraph > The second claim we’ve seen is that the secure DoH connection will limit the family-safe content controls offered by some ISPs. In fact, any existing content controls of your DNS provider, including any protections for children, should remain active. DoH secures the URL data only while it’s in transit between your browser and the DNS provider, so your provider’s malware protection and parental control features will continue to work as they have in the past. So this isn't going to break parental controls by default... ...unlike Firefox's proposed scheme which requires action by the DNS providers. https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https https://support.mozilla.org/en-US/kb/configuring-networks-di...

lol768 6y ago
>...unlike Firefox's proposed scheme which requires action by the DNS providers. Maintaining a hardcoded whitelist of providers (which is what it sounds like is happening in Chrome) is a bit naff. Mozilla's solution scales, at least. Also, their solution doesn't _require_ action from the DNS providers - corporate IT staff can customise this behaviour for managed machines via an pref or enterprise policy. Defaulting to transport security for DNS queries out of the box is a Good Thing.
- nickcw 6y ago
  My home ISP which provides the filtered DNS I use for my children haven't managed to configure their DNS to do the right thing with use-application-dns.net (it should NXDOMAIN) That is what I meant by the DNS providers need to take action. Now I imagine these will all get fixed eventually, but I know if I was a teenage boy I wouldn't be complaining to anyone that my internet was suddenly unfiltered ;-)
  - iso1631 6y ago
    If I was a teenage boy I'd simply change the DNS server to something more appropriate for my needs, or manually enable DoH if you're MitMing DNS I'd like to see the OS, not browser, attempt to use the configured DNS entry via DOH, failing back to DoT and finally DNS. I'd like my browser to use the OS to provide DNS services, not implement their own. I'd like my OS to take hints from my network (DHCP etc), but for me, the sysadmin, be able to override them if I don't trust the network.
    - tfmc 6y ago
      And if you were a teenage girl?
      - chapium 6y ago
        I'm guessing that is unlikely for the parent post.
  - bitcurious 6y ago
    FYI a fun little weekend project might be to set up network-wide ad/nsfw blocking with pihole and a Raspberry Pi. Mine cost about $40, maybe 2 hours to configure how I want it. My work laptop has a nsfw filter while my the rest of my devices have more intense ad blocking, and of course all block malware domains. You need a router that supports a custom dns setting though, and static internal IPs if you want per-device rules. The main reason to do this it to block ads on smart TVs, etc. though, not for your use case.
mc32 6y ago
So Pi-hole should continue to work without issue? My worry here is that google has proven they see themselves as the only subversives allowed. They are okay with themselves censoring and curating content but someone outside comes in and they are not happy to have other subversives. I used to trust them to do the right thing many years ago, but that’s not the case any longer.
- nickcw 6y ago
  With Chrome I don't think there will be a problem. With Firefox it needs to report use-application-dns.net as not available (see NXDOMAIN below) $ dig use-application-dns.net. ; <<>> DiG 9.16.1-Ubuntu <<>> use-application-dns.net. ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22419 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
- newman314 6y ago
  I'm not against the idea of DoH but I do want to exert control about how it is being used. So if you want to use DoH within your network and have Pi-hole, I'd probably put a DoH endpoint on the same server as the Pi-hole and configure my browser to point to that instead. It'd look something like Laptop/desktop --(DoH)--> DoH server --> Pi-hole --> Upstream DNS --(DoH?)--> Public DNS Not ideal but until someone creates a system that acts as DoH server, adblocker, upstream DoH resolver, this is probably the best that one can do for now.
  - deleted 6y ago
    [deleted]
snazz 6y ago
Using DNS for parental controls is likely not very effective except for very young children. Most devices that you would give to children (anything from Apple, most Android devices, Chromebooks, Windows) offer parental controls that aren't as easy to circumvent and work on networks other than your home network. Of course, it might be good to use both as a sort of defense in depth.
- cmrdporcupine 6y ago
  Parental controls on chromebooks are awful. Family Link itself is a badly put together product, but its claim to support ChromeOS is woeful, half of the stuff doesn't work, and mysteriously disappears from the app when the device in question is a chromebook. They haven't done a good job. FWIW I work for Google, mean no offense to the team that works on this, but it has all sorts of problems, including service reliability. My wife is taking UX design courses and one of her final course projects was a multi page paper breaking down a bunch of our issues with it :-) We've been down this road for months. Issues at home with mental health damaging content being accessed repeatedly, and I ended up signing up for OpenDNS; problem solved [for now].
  - nolroz 6y ago
    I've been extremely frustrated with the ux and functionality of family link.
- pbhjpbhj 6y ago
  It's been pretty effective up to age ~13. I'm not really sure after that, as I don't really bother to monitor. I've blocked malware too by having DNS controls, presumably that won't be possible with DoH: Chrome (without addons) might check to see if I've set a local DNS provider but ad-/app- embedded malware won't.
  - snazz 6y ago
    That's reasonable. After a certain point, the goal is to encourage good judgement and trustworthiness, not lock down everything super aggressively.

by nickcw 6y ago

lol768 6y ago

>...unlike Firefox's proposed scheme which requires action by the DNS providers. Maintaining a hardcoded whitelist of providers (which is what it sounds like is happening in Chrome) is a bit naff. Mozilla's solution scales, at least. Also, their solution doesn't _require_ action from the DNS providers - corporate IT staff can customise this behaviour for managed machines via an pref or enterprise policy. Defaulting to transport security for DNS queries out of the box is a Good Thing.

nickcw 6y ago
My home ISP which provides the filtered DNS I use for my children haven't managed to configure their DNS to do the right thing with use-application-dns.net (it should NXDOMAIN) That is what I meant by the DNS providers need to take action. Now I imagine these will all get fixed eventually, but I know if I was a teenage boy I wouldn't be complaining to anyone that my internet was suddenly unfiltered ;-)
- iso1631 6y ago
  If I was a teenage boy I'd simply change the DNS server to something more appropriate for my needs, or manually enable DoH if you're MitMing DNS I'd like to see the OS, not browser, attempt to use the configured DNS entry via DOH, failing back to DoT and finally DNS. I'd like my browser to use the OS to provide DNS services, not implement their own. I'd like my OS to take hints from my network (DHCP etc), but for me, the sysadmin, be able to override them if I don't trust the network.
  - tfmc 6y ago
    And if you were a teenage girl?
    - chapium 6y ago
      I'm guessing that is unlikely for the parent post.
- bitcurious 6y ago
  FYI a fun little weekend project might be to set up network-wide ad/nsfw blocking with pihole and a Raspberry Pi. Mine cost about $40, maybe 2 hours to configure how I want it. My work laptop has a nsfw filter while my the rest of my devices have more intense ad blocking, and of course all block malware domains. You need a router that supports a custom dns setting though, and static internal IPs if you want per-device rules. The main reason to do this it to block ads on smart TVs, etc. though, not for your use case.

mc32 6y ago

So Pi-hole should continue to work without issue? My worry here is that google has proven they see themselves as the only subversives allowed. They are okay with themselves censoring and curating content but someone outside comes in and they are not happy to have other subversives. I used to trust them to do the right thing many years ago, but that’s not the case any longer.

nickcw 6y ago
With Chrome I don't think there will be a problem. With Firefox it needs to report use-application-dns.net as not available (see NXDOMAIN below) $ dig use-application-dns.net. ; <<>> DiG 9.16.1-Ubuntu <<>> use-application-dns.net. ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22419 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
newman314 6y ago
I'm not against the idea of DoH but I do want to exert control about how it is being used. So if you want to use DoH within your network and have Pi-hole, I'd probably put a DoH endpoint on the same server as the Pi-hole and configure my browser to point to that instead. It'd look something like Laptop/desktop --(DoH)--> DoH server --> Pi-hole --> Upstream DNS --(DoH?)--> Public DNS Not ideal but until someone creates a system that acts as DoH server, adblocker, upstream DoH resolver, this is probably the best that one can do for now.
- deleted 6y ago
  [deleted]

snazz 6y ago

Using DNS for parental controls is likely not very effective except for very young children. Most devices that you would give to children (anything from Apple, most Android devices, Chromebooks, Windows) offer parental controls that aren't as easy to circumvent and work on networks other than your home network. Of course, it might be good to use both as a sort of defense in depth.

cmrdporcupine 6y ago
Parental controls on chromebooks are awful. Family Link itself is a badly put together product, but its claim to support ChromeOS is woeful, half of the stuff doesn't work, and mysteriously disappears from the app when the device in question is a chromebook. They haven't done a good job. FWIW I work for Google, mean no offense to the team that works on this, but it has all sorts of problems, including service reliability. My wife is taking UX design courses and one of her final course projects was a multi page paper breaking down a bunch of our issues with it :-) We've been down this road for months. Issues at home with mental health damaging content being accessed repeatedly, and I ended up signing up for OpenDNS; problem solved [for now].
- nolroz 6y ago
  I've been extremely frustrated with the ux and functionality of family link.
pbhjpbhj 6y ago
It's been pretty effective up to age ~13. I'm not really sure after that, as I don't really bother to monitor. I've blocked malware too by having DNS controls, presumably that won't be possible with DoH: Chrome (without addons) might check to see if I've set a local DNS provider but ad-/app- embedded malware won't.
- snazz 6y ago
  That's reasonable. After a certain point, the goal is to encourage good judgement and trustworthiness, not lock down everything super aggressively.