5 ms·

I don't understand this criticism at all; could you clarify what the issue is? None of this - DoH, nor HTTPS-only - is required. It's not even on by default (

by emn13 6y ago

I don't understand this criticism at all; could you clarify what the issue is? None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). If you have some specific wishes; it's trivial to pick a different DNS system, or leave https-only off. Additionally, DoH and https-only aren't really closed or locked in in any way. There's a cloudflare-base DoH option that's used by default, but just as you can pick your own DNS servers, you can also pick your own DoH servers. Sure, it's new (and thus not on by default), so selection is still fairly limited. But even ISPs are starting to offer DoH, and surely others will too. There's no reason to assume that you won't soon be able to pick from several choices for your DoH setup, including local or LAN options. You mention pihole; and though I've never used it, they do have a page on DoH, and a superficial skim doesn't have any huge issues: https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ - and looks like it's based on code described here https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo... - and that supports upstream and downstream DoH, by the looks of it. In other words: all change has some friction, but if you want local control: you still have it. The only thing you really lose is the ability for networks to hijack DNS of devices that don't trust it. And that's a feature, right? If you trust the network; sure, use that DNS if you want. But if you don't: better that its easier to avoid control by that network. What downsides does DoH have?

zo1 6y ago
Not OP. Did we ever allow browsers to set their own DNS server for plain DNS requests? (Let's ignore IE and it's mess of mixing OS settings + browser settings a la "Internet Settings"). For me at least, the biggest criticism of DoH is that it's not necessarily a centralized config at the OS level and seems to be a step in the direction of the general theme "Browser As Your OS".
cptskippy 6y ago
> None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). I had to disable DoH on all 5 of my machines because it was enabled automatically. > You mention pihole; and though I've never used it, they do have a page on DoH pihole supports using Cloudflare as an upstream DoH provider, not acting as a DoH provider.
- emn13 6y ago
  > I had to disable DoH on all 5 of my machines because it was enabled automatically. Some googling: it's on by default in the US now, not yet globally. > pihole supports using Cloudflare as an upstream DoH provider, not acting as a DoH provider. That's unfortunate; are you sure it's not just a little poorly documentend? At least the underlying software they link to https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo... clearly mentions a proxy functionality, but maybe that's not on yet? In any case: the point is that just as DNS proxying became easier over time, so will DoH proxying. There's nothing wrong with sticking to old tech as you chose to if it's not yet convenient for you to switch; especially if pihole supports upstream DoH, since presumably you trust the network between your device and your pihole ;-) - rendering the rest of the DoH benefits moot. I'm sure time will resolve issues like that, but in the meantime, the vast majority of people that didn't customize their DNS and don't choose at all, or choose based on privacy or performance get a more private & secure option by default. I mean, it's transition pains are annoying, but it sounds like a good idea in general, so I suppose the transition costs are worth it in the long run, especially since the vast majority of users won't even notice. It's annoying to be in the camp that gets to bear the burden, for sure.
  - cptskippy 6y ago
    My objection is that the change was made without notice or explicit permission, and changed the chain of trust. Mozilla decided that I should trust Cloudfare and that I should not trust my own network or the corporate network.
    - emn13 6y ago
      Yeah, the rollout (as opposed to the feature) sounds poor. Since I didn't experience this - you're saying you upgraded FF and without notice your DNS settings were replaced? I.e. anything only resolvable on your LAN suddenly stopped working? That's pretty annoying to debug!
      - 6y ago

by emn13 6y ago

zo1 6y ago

Not OP. Did we ever allow browsers to set their own DNS server for plain DNS requests? (Let's ignore IE and it's mess of mixing OS settings + browser settings a la "Internet Settings"). For me at least, the biggest criticism of DoH is that it's not necessarily a centralized config at the OS level and seems to be a step in the direction of the general theme "Browser As Your OS".

cptskippy 6y ago

> None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). I had to disable DoH on all 5 of my machines because it was enabled automatically. > You mention pihole; and though I've never used it, they do have a page on DoH pihole supports using Cloudflare as an upstream DoH provider, not acting as a DoH provider.

emn13 6y ago
> I had to disable DoH on all 5 of my machines because it was enabled automatically. Some googling: it's on by default in the US now, not yet globally. > pihole supports using Cloudflare as an upstream DoH provider, not acting as a DoH provider. That's unfortunate; are you sure it's not just a little poorly documentend? At least the underlying software they link to https://developers.cloudflare.com/1.1.1.1/dns-over-https/cloudflared-proxy https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo... clearly mentions a proxy functionality, but maybe that's not on yet? In any case: the point is that just as DNS proxying became easier over time, so will DoH proxying. There's nothing wrong with sticking to old tech as you chose to if it's not yet convenient for you to switch; especially if pihole supports upstream DoH, since presumably you trust the network between your device and your pihole ;-) - rendering the rest of the DoH benefits moot. I'm sure time will resolve issues like that, but in the meantime, the vast majority of people that didn't customize their DNS and don't choose at all, or choose based on privacy or performance get a more private & secure option by default. I mean, it's transition pains are annoying, but it sounds like a good idea in general, so I suppose the transition costs are worth it in the long run, especially since the vast majority of users won't even notice. It's annoying to be in the camp that gets to bear the burden, for sure.
- cptskippy 6y ago
  My objection is that the change was made without notice or explicit permission, and changed the chain of trust. Mozilla decided that I should trust Cloudfare and that I should not trust my own network or the corporate network.
  - emn13 6y ago
    Yeah, the rollout (as opposed to the feature) sounds poor. Since I didn't experience this - you're saying you upgraded FF and without notice your DNS settings were replaced? I.e. anything only resolvable on your LAN suddenly stopped working? That's pretty annoying to debug!
    - 6y ago