4 ms·

Mozilla is literally switching Canadian users to use government's (CIRA) DNS by default. Seriously, how that's a good thing?

by betaby 5y ago

dubcanada 5y ago
First of all, CIRA is not the government, it is an elected public company. Second of all, it is not switching to use CIRA's DNS, it is added CIRA DNS to their revolver so .ca domains get fed through Mozilla's DNS over HTTP, rather then going Mozilla DNS <-> CIRA.
- betaby 5y ago
  No? What does it even mean 'added CIRA DNS to their revolver so .ca domains get fed through Mozilla's DNS over HTTP'. Please explain in technical terms.
  - dubcanada 5y ago
    CIRA is a root domain company (like Verisign for .com), it has root records because it owns the root nameservers for all .ca domains. All they are doing is adding those to Mozilla's existing supply (Cloudflare provides other DNS records). So rather then going Mozilla -> Cloudflare -> CIRA and back, it now just goes Mozilla -> CIRA. I don't have time to explain how DNS works. Look up Mozilla’s Trusted Recursive Resolver and how it works.
    - betaby 5y ago
      No. Mozilla changes is about recursor, not '.ca' domain.
UseStrict 5y ago
CIRA isn't government owned or backed, it's a member-directed not-for-profit organization. The government doesn't have anything beyond a non-voting board seat.
_verandaguy 5y ago
It's not quite that clear cut. CIRA is strictly speaking a public, not-for-profit company, but the DNS servers were built and maintained by CSE (our NSA) for the malicious domain filtering/reporting aspect, the Centre for Cybersecurity (another public service arm mandated with building out our domestic cybersecurity infrastructure), and Shared Services, the federal government's infrastructure backbone. I know many people will stop reading at CSE and draw their own conclusions, but like with every issue there's nuance here. CSE arguably draws some of the foremost information security experts in the country, and their mandate does also include protecting the digital security of Canadians. I'm going to be cautiously optimistic and start looking for transparency resources around Canadian Shield.
- Sunspark 5y ago
  Misleading. "CIRA is providing the threat blocking technology while the CSE's Canadian Centre for Cyber Security is offering its threat intelligence services — basically a who's-who list of every bad actor roaming the web." CIRA has 3 levels much like opendns, private, protected and family. My router has already been using private for awhile mainly because it was the fastest dns. The server for where I am located is hosted at a local ISP. If they were truly nefarious vacuuming up every dns request and providing a printout of my activity to the prime minister every morning they'd just host the server on their own network. If CSE built it themselves as alleged, they did a good job in terms of its performance and I trust the Canadian government more than I trust an ad company.
  - betaby 5y ago
    Good for your. Canadian government did a great job with the recent CRTC decisions, right?
    - Sunspark 5y ago
      Don't try to muddy the waters by conflating the regulatory board's pricing decision with nefarious spooks searching for Newfoundland independence videos in my history.
tristor 5y ago
Every member of the Mozilla TRR program has to abide by the TRR resolver policies, undergo regular audits to ensure compliance, publicly commit to these policies in their own privacy policy, and publish annual transparency reports. CIRA meets these requirements, which provide assurance that they are treating user data with respect. See https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy for more information.

Mozilla is literally switching Canadian users to use government's (CIRA) DNS by default. Seriously, how that's a good thing?

by betaby 5y ago

Mozilla is literally switching Canadian users to use government's (CIRA) DNS by default. Seriously, how that's a good thing?

dubcanada 5y ago

First of all, CIRA is not the government, it is an elected public company. Second of all, it is not switching to use CIRA's DNS, it is added CIRA DNS to their revolver so .ca domains get fed through Mozilla's DNS over HTTP, rather then going Mozilla DNS <-> CIRA.

betaby 5y ago
No? What does it even mean 'added CIRA DNS to their revolver so .ca domains get fed through Mozilla's DNS over HTTP'. Please explain in technical terms.
- dubcanada 5y ago
  CIRA is a root domain company (like Verisign for .com), it has root records because it owns the root nameservers for all .ca domains. All they are doing is adding those to Mozilla's existing supply (Cloudflare provides other DNS records). So rather then going Mozilla -> Cloudflare -> CIRA and back, it now just goes Mozilla -> CIRA. I don't have time to explain how DNS works. Look up Mozilla’s Trusted Recursive Resolver and how it works.
  - betaby 5y ago
    No. Mozilla changes is about recursor, not '.ca' domain.

UseStrict 5y ago

CIRA isn't government owned or backed, it's a member-directed not-for-profit organization. The government doesn't have anything beyond a non-voting board seat.

_verandaguy 5y ago

It's not quite that clear cut. CIRA is strictly speaking a public, not-for-profit company, but the DNS servers were built and maintained by CSE (our NSA) for the malicious domain filtering/reporting aspect, the Centre for Cybersecurity (another public service arm mandated with building out our domestic cybersecurity infrastructure), and Shared Services, the federal government's infrastructure backbone. I know many people will stop reading at CSE and draw their own conclusions, but like with every issue there's nuance here. CSE arguably draws some of the foremost information security experts in the country, and their mandate does also include protecting the digital security of Canadians. I'm going to be cautiously optimistic and start looking for transparency resources around Canadian Shield.

Sunspark 5y ago
Misleading. "CIRA is providing the threat blocking technology while the CSE's Canadian Centre for Cyber Security is offering its threat intelligence services — basically a who's-who list of every bad actor roaming the web." CIRA has 3 levels much like opendns, private, protected and family. My router has already been using private for awhile mainly because it was the fastest dns. The server for where I am located is hosted at a local ISP. If they were truly nefarious vacuuming up every dns request and providing a printout of my activity to the prime minister every morning they'd just host the server on their own network. If CSE built it themselves as alleged, they did a good job in terms of its performance and I trust the Canadian government more than I trust an ad company.
- betaby 5y ago
  Good for your. Canadian government did a great job with the recent CRTC decisions, right?
  - Sunspark 5y ago
    Don't try to muddy the waters by conflating the regulatory board's pricing decision with nefarious spooks searching for Newfoundland independence videos in my history.

tristor 5y ago

Every member of the Mozilla TRR program has to abide by the TRR resolver policies, undergo regular audits to ensure compliance, publicly commit to these policies in their own privacy policy, and publish annual transparency reports. CIRA meets these requirements, which provide assurance that they are treating user data with respect. See https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy for more information.