4 ms·

Yep. The entire point is to make it impossible to block ads at the network level. And since ad companies control the application level too, they then have a com

Yep. The entire point is to make it impossible to block ads at the network level. And since ad companies control the application level too, they then have a complete end-to-end ad delivery stack that you can't tamper with.

donmcronald 5y ago
Yep. Everything's going to be locked from the bootloader to the screen and you WILL watch the ads. What I think will really happen is the same thing as everything else. They'll use tech to take away features / abilities we have right now and then rent it back to us as a subscription. "OpenDNS is now part of Cisco" Add it up.
- tomjen3 5y ago
  We are talking about Firefox, a web browser, that allows you the most control over your computer, has the best adblock technology, on which the author of Ublock origin has said his software runs the best, which comes with built-in anti tracking, which now comes with technology making it harder for public wifi to trick your computer into going to captive portals, often with ads. And somehow you ad this up to making it impossible not to see ads and locked down computers. How?
  - ocdtrekkie 5y ago
    Firefox's primary sponsor is still Google. And whether they are pushing it because of malice or just incompetence, DoH was designed and built by Google to protect ad companies from network security. Implementing it by default is a hostile act, and one Mozilla should reconsider.
    - slashdot2008 5y ago
      i have a pihole and have been worried that DoH would break it. i checked the network settings in firefox and the DoH setting is there but it is disabled. I doubt that chrome will allow one to disable DoH but at least firefox does for now.
      - iso1210 5y ago
        For now. This is one step in the boiling-the-frog process.
      - ocdtrekkie 5y ago
        I believe Pihole automatically put in the NXDOMAIN entry needed to disable DoH on Firefox for you. But who knows how long Firefox will respect that, since there's nothing stopping ISPs from employing the same strategy to disable DoH.
        josephcsible 5y ago
        Even if Firefox stops respecting that due to malicious ISPs using it, you'll always be able to turn off DoH in Firefox's preferences.
hulitu 5y ago
Yes unfortunately this seems to be the reason. Earlier you could tell the resolver to look at files first and filter with your hosts file the ad and other sites. Now you have to do packet inspection. We are living on a planet that's revolving and evolving ...
JoshTriplett 5y ago
> The entire point is to make it impossible to block ads at the network level. The entire point is to make DNS secure. For every 1 person who uses DNS to block ads, there are many thousands who just use their ISP's DNS servers, and thus remain subject to surveillance, ads, redirects, and other malice. You can't possibly believe in good faith that the entire point or even the primary point of DoH is to hurt the small fraction of people who use DNS to block ads, rather than to protect the much larger set of people who are subject to the whims and financial interests of their ISP.
- ocdtrekkie 5y ago
  ISPs do not inject malware and phishing scams, Google Ads does. The benefit of blocking ISP tampering is vastly outweighed by protecting the bad behavior of a far more malevolent party.
  - JoshTriplett 5y ago
    Google ads (like most ads) are hosted by websites that intentionally put them there; install an adblocker. Google doesn't MITM sites; ISPs and malicious networks do. ISPs are also known to surveil traffic on their networks. I'm not disputing that Google ads and tracking, like all other ads and tracking, should be blocked. Run a browser you trust, and run an adblocker. But the widespread use of unencrypted DNS is a problem that needs fixing. And DoH provides the most viable solution for that problem, by running DNS over an ordinary HTTPS connection.
    - rightbyte 5y ago
      > Google doesn't MITM sites AMP.
      - josephcsible 5y ago
        There's legitimate complaints about AMP, but it's not a MITM.
notatoad 5y ago
>the entire point is to make it impossible to block ads the entire point is to make it impossible to modify DNS requests at the network level. this has a lot more serious consequences than just blocking ads. especially for the parties involved with this, none of whom are advertising companies. phishing and data security are actual big issues with financial implications that companies want to prevent. just because blocking ads is the consequence that will most immediately impact you personally, doesn't make it the whole point. this accusation is especially rich on an article about mozilla, one of the few companies fighting to make sure that advertisers don't control the application level.
- ocdtrekkie 5y ago
  > phishing and data security are actual big issues with financial implications that companies want to prevent These are issues exacerbated by DoH, not fixed by it. DoH assists in the circumvention of security and monitoring. We block ads because they're security problems.
  - josephcsible 5y ago
    Control over DNS is neither necessary nor sufficient to block ads.
    - ocdtrekkie 5y ago
      It's not sufficient in itself, but it bears most of the load of network-wide management of harmful traffic. It's the 99% effective method. Endpoint-level control is no longer possible, since ad companies are skipping the OS network stack and bringing their own. Application-level control is less efficient, and more difficult, particularly when the applications are designed by the same ad companies trying to circumvent DNS control as well. (See Manifest V3.)
  - deleted 5y ago
    [deleted]
  - notatoad 5y ago
pitaj 5y ago
All you need is to point DoH at your own DNS server
- ocdtrekkie 5y ago
  You can't do that with a Chromecast. The goal here is to sell devices which can ensure they always talk to their own DoH endpoint with no ability to secure it.
  - shawnz 5y ago
    Chromecast was already bypassing local DNS for years before DoH was even conceived. Blocking people from using DoH isn't going to solve the problem you are describing, it will just weaken users' privacy. Big vendors like Google will just create their own workarounds.
    - akersten 5y ago
      > Chromecast was already bypassing local DNS for years before DoH was even conceived. Before DoH though, my understanding is a good gateway appliance could just overwrite those DNS requests as it sees them. Now they'll be encrypted, and you'll have no way to tell the Chromecast where to connect (or even to where it is connecting).
      - shawnz 5y ago
        If the possibility of having the DNS packets rewritten was a concern for them, any junior developer could have easily implemented a proprietary REST web service to get the IPs over HTTPS just like DoH. Standardization of DoH in browsers isn't really furthering that issue.
        slashdot2008 5y ago
        How would they get the first IP for the REST client to contact?
vbezhenar 5y ago
Blocking ads at network level is very easy to circumvent. Just serve ads from your domain. It's impossible to block youtube video ads using DNS, for example, you must intercept their API queries and modify them on-the-fly which requires browser extensions or custom apps.
- ocdtrekkie 5y ago
  It's easy to circumvent if your ads are first party, as in YouTube's case. Most ads are not. Even most Google websites serve ads from ad-specific endpoints, as opposed to their own domain.
  - vbezhenar 5y ago
    I think that's because those who care about blocking ads, will block them anywhere. And percentage of those who're using pihole or similar methods to block ads is negligible, so they don't really care about that.
    - katbyte 5y ago
      And if your blocking ads your probably not the desired audience of them anyways.

donmcronald 5y ago

Yep. Everything's going to be locked from the bootloader to the screen and you WILL watch the ads. What I think will really happen is the same thing as everything else. They'll use tech to take away features / abilities we have right now and then rent it back to us as a subscription. "OpenDNS is now part of Cisco" Add it up.

tomjen3 5y ago
We are talking about Firefox, a web browser, that allows you the most control over your computer, has the best adblock technology, on which the author of Ublock origin has said his software runs the best, which comes with built-in anti tracking, which now comes with technology making it harder for public wifi to trick your computer into going to captive portals, often with ads. And somehow you ad this up to making it impossible not to see ads and locked down computers. How?
- ocdtrekkie 5y ago
  Firefox's primary sponsor is still Google. And whether they are pushing it because of malice or just incompetence, DoH was designed and built by Google to protect ad companies from network security. Implementing it by default is a hostile act, and one Mozilla should reconsider.
  - slashdot2008 5y ago
    i have a pihole and have been worried that DoH would break it. i checked the network settings in firefox and the DoH setting is there but it is disabled. I doubt that chrome will allow one to disable DoH but at least firefox does for now.
    - iso1210 5y ago
      For now. This is one step in the boiling-the-frog process.
    - ocdtrekkie 5y ago
      I believe Pihole automatically put in the NXDOMAIN entry needed to disable DoH on Firefox for you. But who knows how long Firefox will respect that, since there's nothing stopping ISPs from employing the same strategy to disable DoH.
      - josephcsible 5y ago
        Even if Firefox stops respecting that due to malicious ISPs using it, you'll always be able to turn off DoH in Firefox's preferences.

hulitu 5y ago

Yes unfortunately this seems to be the reason. Earlier you could tell the resolver to look at files first and filter with your hosts file the ad and other sites. Now you have to do packet inspection. We are living on a planet that's revolving and evolving ...

JoshTriplett 5y ago

> The entire point is to make it impossible to block ads at the network level. The entire point is to make DNS secure. For every 1 person who uses DNS to block ads, there are many thousands who just use their ISP's DNS servers, and thus remain subject to surveillance, ads, redirects, and other malice. You can't possibly believe in good faith that the entire point or even the primary point of DoH is to hurt the small fraction of people who use DNS to block ads, rather than to protect the much larger set of people who are subject to the whims and financial interests of their ISP.

ocdtrekkie 5y ago
ISPs do not inject malware and phishing scams, Google Ads does. The benefit of blocking ISP tampering is vastly outweighed by protecting the bad behavior of a far more malevolent party.
- JoshTriplett 5y ago
  Google ads (like most ads) are hosted by websites that intentionally put them there; install an adblocker. Google doesn't MITM sites; ISPs and malicious networks do. ISPs are also known to surveil traffic on their networks. I'm not disputing that Google ads and tracking, like all other ads and tracking, should be blocked. Run a browser you trust, and run an adblocker. But the widespread use of unencrypted DNS is a problem that needs fixing. And DoH provides the most viable solution for that problem, by running DNS over an ordinary HTTPS connection.
  - rightbyte 5y ago
    > Google doesn't MITM sites AMP.
    - josephcsible 5y ago
      There's legitimate complaints about AMP, but it's not a MITM.

notatoad 5y ago

>the entire point is to make it impossible to block ads the entire point is to make it impossible to modify DNS requests at the network level. this has a lot more serious consequences than just blocking ads. especially for the parties involved with this, none of whom are advertising companies. phishing and data security are actual big issues with financial implications that companies want to prevent. just because blocking ads is the consequence that will most immediately impact you personally, doesn't make it the whole point. this accusation is especially rich on an article about mozilla, one of the few companies fighting to make sure that advertisers don't control the application level.

ocdtrekkie 5y ago
> phishing and data security are actual big issues with financial implications that companies want to prevent These are issues exacerbated by DoH, not fixed by it. DoH assists in the circumvention of security and monitoring. We block ads because they're security problems.
- josephcsible 5y ago
  Control over DNS is neither necessary nor sufficient to block ads.
  - ocdtrekkie 5y ago
    It's not sufficient in itself, but it bears most of the load of network-wide management of harmful traffic. It's the 99% effective method. Endpoint-level control is no longer possible, since ad companies are skipping the OS network stack and bringing their own. Application-level control is less efficient, and more difficult, particularly when the applications are designed by the same ad companies trying to circumvent DNS control as well. (See Manifest V3.)
- deleted 5y ago
  [deleted]
- notatoad 5y ago

pitaj 5y ago

All you need is to point DoH at your own DNS server

ocdtrekkie 5y ago
You can't do that with a Chromecast. The goal here is to sell devices which can ensure they always talk to their own DoH endpoint with no ability to secure it.
- shawnz 5y ago
  Chromecast was already bypassing local DNS for years before DoH was even conceived. Blocking people from using DoH isn't going to solve the problem you are describing, it will just weaken users' privacy. Big vendors like Google will just create their own workarounds.
  - akersten 5y ago
    > Chromecast was already bypassing local DNS for years before DoH was even conceived. Before DoH though, my understanding is a good gateway appliance could just overwrite those DNS requests as it sees them. Now they'll be encrypted, and you'll have no way to tell the Chromecast where to connect (or even to where it is connecting).
    - shawnz 5y ago
      If the possibility of having the DNS packets rewritten was a concern for them, any junior developer could have easily implemented a proprietary REST web service to get the IPs over HTTPS just like DoH. Standardization of DoH in browsers isn't really furthering that issue.
      - slashdot2008 5y ago
        How would they get the first IP for the REST client to contact?

vbezhenar 5y ago

Blocking ads at network level is very easy to circumvent. Just serve ads from your domain. It's impossible to block youtube video ads using DNS, for example, you must intercept their API queries and modify them on-the-fly which requires browser extensions or custom apps.

ocdtrekkie 5y ago
It's easy to circumvent if your ads are first party, as in YouTube's case. Most ads are not. Even most Google websites serve ads from ad-specific endpoints, as opposed to their own domain.
- vbezhenar 5y ago
  I think that's because those who care about blocking ads, will block them anywhere. And percentage of those who're using pihole or similar methods to block ads is negligible, so they don't really care about that.
  - katbyte 5y ago
    And if your blocking ads your probably not the desired audience of them anyways.