5 ms·

> Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP i

> Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox. I have mixed feelings about the issue, but it's not that simple. I run a variety of services on my LAN for my users and guests. That includes Unbound, so even though their browser doesn't know it, their queries are secure from my ISP. But more importantly I have other stuff behind hostnames (which are resolved by Unbound). For example, my guests can navigate to music/ and use a web interface to play any of the music in my library over the stereo. Hopefully it's obvious why this is something useful to have. Now that Firefox is intercepting DNS requests, a conversation with someone might go like this: "Oh, it's not working? Are you using Firefox? Yeah, Firefox broke this recently, let me get the IP address for you." And then I have to log in to a computer, ssh into the relevant system, and get its IP address on the LAN. And that's just the beginning. Last I checked Cloudflare still can't resolve the archive.is / archive.today domains. Even though I use Cloudflare over TLS in Unbound, I fix this for myself and my users by sending these domains to Google instead. Anything as convenient and simplistic as Firefox just sending everything directly to Cloudflare can't do that.

manquer 6y ago
If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered From Mozilla documentation. "localhost" and names in the ".local" TLD will never be resolved via DOH. [1] Lan based services are pretty common use case. Mozilla is hardly going to release this feature without considering this. The Cloudflare / Archive.is point is esoteric debate and not a common occurence, DoH does support other providers than Cloudflare so not sure if this really a major concern [1] https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver
- bscphil 6y ago
  > If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered I don't think PFsense + Unbound supports appending .local to every hostname automatically, so I'd have to change every last one of my hostnames to whatever.local and that seems like a real pain. (Surely most people are not using whatever.local in their /etc/hostname, right?) > The Cloudflare / Archive.is point is esoteric debate and not a common occurence, DoH does support other providers than Cloudflare so not sure if this really a major concern Sure, but my general point is that there's all sorts of different reasons why it can be useful for a LAN administrator to override the remote DNS response in certain specific cases. Given that Firefox is using Cloudflare by default, the fact that you can change it also doesn't really help anything, since after all the thing I'm specifically complaining about is that stuff randomly breaks for any of your guests using Firefox.
  - manquer 6y ago
    It is perhaps reason for you(and others) not wanting migrate, however there is nothing wrong in the way DoH functionality is implemented. Cloudflare broke a lot of traffic when the 1.1.1.1 dns server came up, google broke lot of dev setups when they got the . dev TLD, however it is not theit fault though.
  - shawnz 6y ago
    Yes it does, you set it in System > General Setup: https://docs.netgate.com/pfsense/en/latest/config/general.html https://docs.netgate.com/pfsense/en/latest/config/general.ht... Then it will automatically register them in DNS with that name: https://docs.netgate.com/pfsense/en/latest/services/dns/resolver.html https://docs.netgate.com/pfsense/en/latest/services/dns/reso... > The domain name from System > General Setup is used as the domain name on the hosts. Then in the DHCP configuration, you set the domain name as well (defaults to using the general setting): https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv4.html#general-options https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv... > Specifies the domain name passed to the client to form its fully qualified hostname. If the Domain Name is left blank, then the domain name of the firewall it sent to the client. The client will automatically try adding the domain when looking up hostnames. Normally on Linux the FQDN is not specified in /etc/hostname but only in /etc/hosts.
shawnz 6y ago
The default behaviour is to fallback to the network DNS if DoH doesn't resolve the domain, so your use case would work fine. archive.is didn't work for Cloudflare users because they purposely sabotaged the results for Cloudflare (they did actually return valid, but wrong, results). EDIT: Although you might have a problem if the owners of the ".music" TLD decide to put something else there.

manquer 6y ago

If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered From Mozilla documentation. "localhost" and names in the ".local" TLD will never be resolved via DOH. [1] Lan based services are pretty common use case. Mozilla is hardly going to release this feature without considering this. The Cloudflare / Archive.is point is esoteric debate and not a common occurence, DoH does support other providers than Cloudflare so not sure if this really a major concern [1] https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver

bscphil 6y ago
> If you follow the DNS specs this will not a problem. If you use *.local for local domain names DoH will never be triggered I don't think PFsense + Unbound supports appending .local to every hostname automatically, so I'd have to change every last one of my hostnames to whatever.local and that seems like a real pain. (Surely most people are not using whatever.local in their /etc/hostname, right?) > The Cloudflare / Archive.is point is esoteric debate and not a common occurence, DoH does support other providers than Cloudflare so not sure if this really a major concern Sure, but my general point is that there's all sorts of different reasons why it can be useful for a LAN administrator to override the remote DNS response in certain specific cases. Given that Firefox is using Cloudflare by default, the fact that you can change it also doesn't really help anything, since after all the thing I'm specifically complaining about is that stuff randomly breaks for any of your guests using Firefox.
- manquer 6y ago
  It is perhaps reason for you(and others) not wanting migrate, however there is nothing wrong in the way DoH functionality is implemented. Cloudflare broke a lot of traffic when the 1.1.1.1 dns server came up, google broke lot of dev setups when they got the . dev TLD, however it is not theit fault though.
- shawnz 6y ago
  Yes it does, you set it in System > General Setup: https://docs.netgate.com/pfsense/en/latest/config/general.html https://docs.netgate.com/pfsense/en/latest/config/general.ht... Then it will automatically register them in DNS with that name: https://docs.netgate.com/pfsense/en/latest/services/dns/resolver.html https://docs.netgate.com/pfsense/en/latest/services/dns/reso... > The domain name from System > General Setup is used as the domain name on the hosts. Then in the DHCP configuration, you set the domain name as well (defaults to using the general setting): https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv4.html#general-options https://docs.netgate.com/pfsense/en/latest/services/dhcp/ipv... > Specifies the domain name passed to the client to form its fully qualified hostname. If the Domain Name is left blank, then the domain name of the firewall it sent to the client. The client will automatically try adding the domain when looking up hostnames. Normally on Linux the FQDN is not specified in /etc/hostname but only in /etc/hosts.

shawnz 6y ago

The default behaviour is to fallback to the network DNS if DoH doesn't resolve the domain, so your use case would work fine. archive.is didn't work for Cloudflare users because they purposely sabotaged the results for Cloudflare (they did actually return valid, but wrong, results). EDIT: Although you might have a problem if the owners of the ".music" TLD decide to put something else there.