4 ms·

I have mixed feelings about what you wrote. 100% with you that by itself, browser HTTPS-only mode (even by default) is A Good Thing. In isolation, this is a no

by 3np 6y ago

I have mixed feelings about what you wrote. 100% with you that by itself, browser HTTPS-only mode (even by default) is A Good Thing. In isolation, this is a no-brainer and Mozilla's doing the right call. I'm not happy with DoH though, at all. I fall in the crowd who wants to control my own DNS on my own devices (and I do realize that for those less technically knowledgeable, the status quo is putting that in the hands of the network admin or even ISP, but at least in principle they have the means to do so if they just figure out how, which is relatively trivial). DoH effectively completely cripples things like pihole. I'd have to start whitelisting IPs/hostnames for port 443 :/ Another practical negative consequence is the further centralization of TLS termination in (most notably) Cloudflare and Akamai, as I am sure this will de the default for those who are now rushed to TLS-enable currently uncompliant endpoints. Great sieves for XEyes and private tracking industry.

kd913 6y ago
Firefox DoH easily works with DNSCryptProxy. https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH You can easily set it up to contact that, but enable some exclusions for specific domains if you wish to fallback to pihole. It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway.
- 3np 6y ago
  I wasn't aware of this part of dnscrypt-proxy, thanks for sharing. I find network-level blocking and browser extensions work complementary. In a broader sense, I guess the larger concerns is malware and trackware on various devices where DoH is used maliciously. Especially smartphones. Granted there is nothing stopping them today, but the normalization of DoH will put it in arms reach for everyone.
- cptskippy 6y ago
  > It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway. Pihole operates at the network level. It can block Windows Telemetry, ads on your Roku, smart devices trying to phone home, etc. Any guest devices that connect to your network also benefit without you having to install blockers on them. It's not a replacement for ublock, it's used in conjunction with it.
  - josephcsible 6y ago
    Your Pi-hole working on other people's devices is a bad thing. After all, there's nothing stopping you from configuring your Pi-hole to filter political content you disagree with instead of just ads, trackers, and malware.
    - cptskippy 6y ago
      > Your Pi-hole working on other people's devices is a bad thing. No, it isn't. Never mind the fact that that isn't how PiHole works, I'm perfectly within my right to control how my home network functions.
  - kd913 6y ago
    Yea, I understand that which is why I keep pihole. My argument though is in the context of Firefox, in which case the benefit of the pihole bit is dubious when you can install ublock origins. Pihole doesn't provide much additional benefits that can't be achieved with ublock origin advanced filters. Granted someone could argue what would be the benefit of using the dnscrypt-proxy at that point. In that context, you benefit from better privacy (DNS requests aggregated) and caching benefits.
emn13 6y ago
I don't understand this criticism at all; could you clarify what the issue is? None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). If you have some specific wishes; it's trivial to pick a different DNS system, or leave https-only off. Additionally, DoH and https-only aren't really closed or locked in in any way. There's a cloudflare-base DoH option that's used by default, but just as you can pick your own DNS servers, you can also pick your own DoH servers. Sure, it's new (and thus not on by default), so selection is still fairly limited. But even ISPs are starting to offer DoH, and surely others will too. There's no reason to assume that you won't soon be able to pick from several choices for your DoH setup, including local or LAN options. You mention pihole; and though I've never used it, they do have a page on DoH, and a superficial skim doesn't have any huge issues: https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ - and looks like it's based on code described here https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo... - and that supports upstream and downstream DoH, by the looks of it. In other words: all change has some friction, but if you want local control: you still have it. The only thing you really lose is the ability for networks to hijack DNS of devices that don't trust it. And that's a feature, right? If you trust the network; sure, use that DNS if you want. But if you don't: better that its easier to avoid control by that network. What downsides does DoH have?
- zo1 6y ago
  Not OP. Did we ever allow browsers to set their own DNS server for plain DNS requests? (Let's ignore IE and it's mess of mixing OS settings + browser settings a la "Internet Settings"). For me at least, the biggest criticism of DoH is that it's not necessarily a centralized config at the OS level and seems to be a step in the direction of the general theme "Browser As Your OS".
- cptskippy 6y ago
  > None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). I had to disable DoH on all 5 of my machines because it was enabled automatically. > You mention pihole; and though I've never used it, they do have a page on DoH pihole supports using Cloudflare as an upstream DoH provider, not acting as a DoH provider.

by 3np 6y ago

kd913 6y ago

Firefox DoH easily works with DNSCryptProxy. https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH You can easily set it up to contact that, but enable some exclusions for specific domains if you wish to fallback to pihole. It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway.

3np 6y ago
I wasn't aware of this part of dnscrypt-proxy, thanks for sharing. I find network-level blocking and browser extensions work complementary. In a broader sense, I guess the larger concerns is malware and trackware on various devices where DoH is used maliciously. Especially smartphones. Granted there is nothing stopping them today, but the normalization of DoH will put it in arms reach for everyone.
cptskippy 6y ago
> It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway. Pihole operates at the network level. It can block Windows Telemetry, ads on your Roku, smart devices trying to phone home, etc. Any guest devices that connect to your network also benefit without you having to install blockers on them. It's not a replacement for ublock, it's used in conjunction with it.
- josephcsible 6y ago
  Your Pi-hole working on other people's devices is a bad thing. After all, there's nothing stopping you from configuring your Pi-hole to filter political content you disagree with instead of just ads, trackers, and malware.
  - cptskippy 6y ago
    > Your Pi-hole working on other people's devices is a bad thing. No, it isn't. Never mind the fact that that isn't how PiHole works, I'm perfectly within my right to control how my home network functions.
- kd913 6y ago
  Yea, I understand that which is why I keep pihole. My argument though is in the context of Firefox, in which case the benefit of the pihole bit is dubious when you can install ublock origins. Pihole doesn't provide much additional benefits that can't be achieved with ublock origin advanced filters. Granted someone could argue what would be the benefit of using the dnscrypt-proxy at that point. In that context, you benefit from better privacy (DNS requests aggregated) and caching benefits.

emn13 6y ago

I don't understand this criticism at all; could you clarify what the issue is? None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). If you have some specific wishes; it's trivial to pick a different DNS system, or leave https-only off. Additionally, DoH and https-only aren't really closed or locked in in any way. There's a cloudflare-base DoH option that's used by default, but just as you can pick your own DNS servers, you can also pick your own DoH servers. Sure, it's new (and thus not on by default), so selection is still fairly limited. But even ISPs are starting to offer DoH, and surely others will too. There's no reason to assume that you won't soon be able to pick from several choices for your DoH setup, including local or LAN options. You mention pihole; and though I've never used it, they do have a page on DoH, and a superficial skim doesn't have any huge issues: https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ - and looks like it's based on code described here https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo... - and that supports upstream and downstream DoH, by the looks of it. In other words: all change has some friction, but if you want local control: you still have it. The only thing you really lose is the ability for networks to hijack DNS of devices that don't trust it. And that's a feature, right? If you trust the network; sure, use that DNS if you want. But if you don't: better that its easier to avoid control by that network. What downsides does DoH have?

zo1 6y ago
Not OP. Did we ever allow browsers to set their own DNS server for plain DNS requests? (Let's ignore IE and it's mess of mixing OS settings + browser settings a la "Internet Settings"). For me at least, the biggest criticism of DoH is that it's not necessarily a centralized config at the OS level and seems to be a step in the direction of the general theme "Browser As Your OS".
cptskippy 6y ago
> None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). I had to disable DoH on all 5 of my machines because it was enabled automatically. > You mention pihole; and though I've never used it, they do have a page on DoH pihole supports using Cloudflare as an upstream DoH provider, not acting as a DoH provider.