13 ms·

There's a lot of lament that this bypasses the operating system level config, but I feel like we wouldn't be here if the operating system had stepped up their D

There's a lot of lament that this bypasses the operating system level config, but I feel like we wouldn't be here if the operating system had stepped up their DNS any time in the last several years. This is a workaround for the fact that many networks are hostile to DNS lookups (injecting ads, tracking, captive portals), and operating systems continue to just default to the ISPs DNS provider, which is often hostile. OS's could have switched to running their own local caching resolver ala unbound years ago, could have integrated DNSCrypt or DoT years ago. But instead the defaults are still horribly unsecure for the average user. For the techie user who's running PiHole or some custom local DNS, yeah this will be annoying, but for the average user who's just delegating to their ISP that is then tracking their DNS lookups and injecting ads if they mistype a domain, this is a win.

floatingatoll 5y ago
Release (not beta) macOS already lets you configure your system to use DNS-over-HTTPS, if you know the magic incantation to chant at it. Apple hasn't added UI for it yet, but it's available and works when enabled.
vbezhenar 5y ago
How OS is going to circumvent local DNS? Hardcode 1.1.1.1? It's very easy for ISP to block this address.
TurningCanadian 5y ago
I didn't realize that Fedora dropped that proposal https://pagure.io/fesco/issue/1511 https://pagure.io/fesco/issue/1511 May have been related to IPv6? Not sure. I remember trying it out at the time (https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver#How_to_get_Unbound_and_dnssec-trigger_running.3F https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Res...) and not running in to issues
elric 5y ago
So the fact that some ISPs are apparently untrustworthy is enough to blow up the whole thing which has worked pretty well for the past 30 years? There are plenty of valid use cases for captive portals. But yes, injecting ads and tracking are obviously messed up, but DNS is only a tiny part of that problem, and I don't see how using DoH will help with them. If you want to get rid those, then get rid of shitty ISPs. This is throwing out the baby with the bathwater. This will simply lead to ISPs and network operators blocking DoH. And instead of a wonderfully decentralized DNS, we'll end up with centralized DoH in the hands of Cloudflare and their ilk. Who have been shown repeatedly to be user hostile; especially towards privacy conscious users.
- kadoban 5y ago
  Can they block DoH, with reasonable tradeoffs? How? And will they care enough? I get the sense that they don't really gain that much from messing with DNS, relatively.
  - Hizonner 5y ago
    They couldn't necessarily block all DoH, but they could destroy its prevalence by just blocking all of the default resolvers and all of the resolvers that the browsers suggest to users. Those are public lists. I suspect you're right that they don't get that much value from messing with DNS, though... not enough to deal with the user complaints they'd get. So they probably wouldn't bother unless pressured. However, they might decide to "play chicken" with Mozilla and other sources of DoH apps by seeing who yielded to the user complaints first. There'd be a big temptation for Mozilla to fall back to "regular" DNS if DoH failed, and then the ISP would effectively win.
    - kadoban 5y ago
      They'd have to block by domain name, right, and block all HTTPS traffic to those domains? I somehow suspect that browers can win that particular cat and mouse game just by making the domains too important to block (share the domain with something users care about). Maybe I'm missing something there though, it probably is more complicated than just that.
      - Hizonner 5y ago
        In the end, DoH has to either start with some kind of seed IP address, even if it's a cache-priming DNS A record, or use a (presumably attackable) non-DoH lookup to find its server. You can't start with a domain name for the server that you use to resolve all domain names. But I don't think that's very important, because domain names always resolve to IP addresses anyhow, and you can't change the IP addresses that fast. So you would have to share an IP address with something "too important to block". The political problem with that tends to be that the operators of things that might be too important to block tend to think that those things are too important to expose to any risk of being blocked, say by sharing them with something that somebody might want to block. It's also not always administratively or technically trivial to share the domain name or IP address(es) of some giant public Web service with another fundamentally unrelated service like DoH. I mean, sure, in the end, if enough large organizations tried hard enough, they could eventually come up with ways to make it pretty painful to block... but those large organizations tend to have overriding commercial concerns... and not to want to overtly taunt large governments...
Hizonner 5y ago
If Mozilla cared about preventing DNS tampering, they could have done DNSSEC 10 years ago. That would have totally killed ads, ISP typosquatting, and captive portals. They, like all browsers, rejected that source of end-to-end security. The fact is that they want to enable DNS tampering, because they want to use it as a way of enforcing their idea of "safety". So they're building this giant, highly centralized, and easily pressured, infrastructure of "trusted resolvers" that can mess with your DNS results to their heart's content. This will, of course, be a huge attractant for bad actors who want to do things even more harmful than injecting obnoxious advertizing. As for privacy, the only way that can work, even with something like DNSCrypt, is if the individual user chooses the resolver from among a very large set of possibilities.. which Mozilla is not enabling. Either that, or relatively exotic anonymization stuff that's not actually worked out, and that Mozilla has shown zero interest in working out. "Trusted resolvers" just move the privacy problem to a different place, and, again, it's a highly centralized place that's easy to subvert. And DNS-over-TCP is desirable for sure, but it does nothing about tampering or privacy. It's just irrelevant, except maybe as a preliminary step making it easier to deploy some of the stuff that might actually help.
- kadoban 5y ago
  How could Mozilla have "done" DNSSEC 10 years ago? Isn't that pretty much just not in their control?
  - Hizonner 5y ago
    If TLDs are signed (which they have been for a long time), and if the browser checks DNSSEC, you can't typosquat, because you can't spoof the TLD server's signature on the typo. That requires no cooperation from anybody but the browser and the TLD. WIth DNSSEC enabled, somebody can still impersonate an unsigned domain, but the whole reason that there are so many unsigned zones to begin with is that nothing checks the signatures, so there's no incentive to sign. By actually doing the checks, browsers, including Firefox, could have created an incentive for widespread DNSSEC signing. So they could have both unilaterally gotten a lot of benefit for their users, and encouraged wider DNSSEC deployment that would have produced further benefit. Add in DANE, and it would also have given a much more satisfying fix for a bunch of CA issues that they've chosen to band-aid with stuff that only half works. You could probably even have gotten to a world with zero-cost TLS certs well before enough pressure built up to make Lets Encrypt come along.
nimbius 5y ago
>There's a lot of lament that this bypasses the operating system level config systemd-resolved has the clandestine ability to forward all your DNS traffic to google in many distributions of Linux. I would say the state of resolution in general is getting uncomfortably sketchy. many wireless routers from Asus and others due to a buggy (or perhaps intentional) implementation of Dnsmasq will quietly intercept your DNS requests using their own built-in resolver. RT-ARCH13 is notorious for it even if NAT mode is disabled. for my pihole implementation I block 53 outbound and do DoH resolution using cloudflared on the pi. finally it bears remembering that the number one largest opposition to the use of DoH was ISP's who were (and still are) making a killing selling your search history. they went so far as to lobby congress to stop DoH. Now the very same ISP's we tried to protect users from are part of the DoH club anyway because, well, money talks. https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-strike-privacy-deal-to-encrypt-dns-lookups-in-firefox/ https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-...
- danudey 5y ago
  I recently tried setting up microk8s, since Ubuntu was pushing it pretty hard and it seemed useful, but a lot of stuff wouldn't work at all. Turns out that the microk8s config uses cloudflare DNS by default, and not your currently configured DNS or any kind of local DNS proxy. This was hugely frustrating because it's not the configuration that I would expect, it's not obvious why things are failing, and, in our case, it's sending internal DNS names to an external DNS server, unencrypted, over the public internet. Surely it's convenient, but definitely not trustworthy.
- yrro 5y ago
  "clandestine"? Please, don't be ridiculous. The choice of fallback DNS server is a default that is only used in the absence of any other configured DNS resolver. If you are compiling systemd yourself then this is one of many defaults that you need to be aware of. Everyone else will get the defaults that their distribution has chosen.
slim 5y ago
Mozilla wants to be the gatekeeper to their users. Every company and it's dog wants to do this. "If you are not paying for the product, you are the product" should become "if you are a customer/user, you are also a product".
ignoramous 5y ago
> There's a lot of lament that this bypasses the operating system level config, but I feel like we wouldn't be here if the operating system had stepped up their DNS any time in the last several years. OSes are relegated to support myriad environments with adhoc yet byzantine configuration. A browser's primary objective is to be a "user-agent" (as opposed to, say, subscribing to the whims of ISPs / Governments / anti-digital-rights-companies-masking-as-cyber-security-firms). > For the techie user who's running PiHole or some custom local DNS, yeah this will be annoying, but for the average user who's just delegating to their ISP that is then tracking their DNS lookups and injecting ads if they mistype a domain, this is a win. Internet censorship, which most of the population in the West isn't subject to or even aware of, is the primary reason DoH-in-a-browser is widely lauded. It just works, and thwarts all cheaper attempts at surveillance and censorship. Though, the likely effect would be, deep-packet-inspection becomes common place, but the imminent ESNI standard has that one covered, too. As someone who builds and maintains an open-source DoH resolver, I have come to fully appreciate the control and power a resolver running over HTTP/S puts in the hands of the users, both in the client and on the resolver-side.
- Hizonner 5y ago
  > the imminent ESNI standard has that one covered, too. Too slow, I'm afraid. Word on the street is that any hello containing ESNI will be blocked from day one in too many places for it to ever get traction, including all of China. I believe draft ESNI is blocked by the GFOC today. To even have a chance of making ESNI/ECH widespread, you'd have to make it mandatory for all TLS. That wouldn't fly politically in the working group, because the "enterprise" people have at least some influence there, and they want to do exactly the same kinds of DPI that North Korea would want to do. Even if it came out mandatory on the standards track, it would probably still fail at this point. It might have worked if it'd been mandatory in TLS 1.2 or even TLS 1.3, but it seems too late now. We'll see if they also disrupt DoH to the point of making it unusable. I bet they at least give it a try.
  - josephcsible 5y ago
    If Microsoft, Apple, and Google all agreed to make ECH mandatory on the same future date, wouldn't that basically force the hands of every other enterprise?
throw0101a 5y ago
> This is a workaround for the fact that many networks are hostile to DNS lookups (injecting ads, tracking, captive portals), and operating systems continue to just default to the ISPs DNS provider, which is often hostile. This workaround is hostile to my own network (home or work) being able to track requests. I control my router / DCHP server, and I should be able to tell devices where to send DNS requests. Anything that does not do what I tell it to do is malware IMHO.
- cle 5y ago
  You can’t track all requests anyway, as they can be trivially tunneled through encrypted streams with bundled certs. This is the tradeoff of running arbitrary Turing-complete programs. If you don’t like what a program is doing, or that it doesn’t use libc or some standard way to do DNS resolution, your only options are to either change the program to do what you want, or don’t run it.
  - throw0101a 5y ago
    > You can’t track all requests anyway, as they can be trivially tunneled through encrypted streams with bundled certs. Previously I can track devices (a) making DNS requests, and then (b) make TCP and/or UDP requests. Anything that made a data request without a DNS request was probably using a hard-coded IP, which would be suspicious. With DoH, it's all-HTTPS all-the-time: > DoH is an over the top bypass of enterprise and other private networks. But DNS is part of the control plane, and network operators must be able to monitor and filter it. Use DoT, never DoH. * https://twitter.com/paulvixie/status/1053886628832382977 https://twitter.com/paulvixie/status/1053886628832382977 > or don’t run it. So Firefox further circles the drain with regards to market share? Is this part of some grand 4D chess plan by Mozilla that is perhaps beyond my intellect?
    - SilverRed 5y ago
      The cat is out of the bag regardless of what Firefox does. Even without firefox any bit of malware could bundle their own DoH library.
thayne 5y ago
On Linux there is systemd-resolved which is enabled installed and enabled on the most popular distros. It is a caching resolver that supports DoT (although it isn't enabled by default). Having the pre-select a DNS resolver some of the same problems as having the application selecting the resolver. Specifically, it doesn't work as expected in networks with a local DNS server.
tumblewit 5y ago
This is where iOS wins I think. According to Apple documentation, no app can override a systemwide DNS setting in iOS14. So if you were to apply a dns profile, it is guaranteed that apps cannot use their own dns resolver.
- comex 5y ago
  Which documentation? I searched the App Store Review Guidelines for "DNS" and didn't find anything.
smnrchrds 5y ago
> ISPs DNS provider, which is often hostile Exactly which Canadian ISP does this? I don't think that's an issue in Canada, where this feature is being enabled.
eptcyka 5y ago
Having had the joy of writing code to manage system wide DNS config for all 3 of the major desktop operating systems, it's very clear that nobody cares about DNS - the users just want it to work and the systems developers also just want it to work. On macOS, if you don't have an IPv6 enabled primary adapter, even if you have a working IPv6 VPN connection, you just won't be able to get AAAA responses regardless of your configuration. Watching for config changes is also a race ridden mess, applying DNS on Linux on major distros is also a crapshoot of which specific NM (NetworkManager) version the user is using (this can differ between a fresh Ubuntu 16.04 install and one which has been upgraded to 16.04 from 14.04), and which specific DNS mode NM is configured for. There's also systemd-resolved, with multiple versions and capabilities, and there's also resolvconf. In some cases, there's a notion of a global config, in others, the config is always bound to a specific interface. Windows is somewhat better in this regard. But at least the developers of NM and systemd-resolved are receptive and incredibly helpful.
gsich 5y ago
They have, will Firefox respect the settings made there? ie Windows 10 has it, macOS, Linux with systemd-resolver has it, Android too.

floatingatoll 5y ago

Release (not beta) macOS already lets you configure your system to use DNS-over-HTTPS, if you know the magic incantation to chant at it. Apple hasn't added UI for it yet, but it's available and works when enabled.

vbezhenar 5y ago

How OS is going to circumvent local DNS? Hardcode 1.1.1.1? It's very easy for ISP to block this address.

TurningCanadian 5y ago

I didn't realize that Fedora dropped that proposal https://pagure.io/fesco/issue/1511 https://pagure.io/fesco/issue/1511 May have been related to IPv6? Not sure. I remember trying it out at the time (https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver#How_to_get_Unbound_and_dnssec-trigger_running.3F https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Res...) and not running in to issues

elric 5y ago

So the fact that some ISPs are apparently untrustworthy is enough to blow up the whole thing which has worked pretty well for the past 30 years? There are plenty of valid use cases for captive portals. But yes, injecting ads and tracking are obviously messed up, but DNS is only a tiny part of that problem, and I don't see how using DoH will help with them. If you want to get rid those, then get rid of shitty ISPs. This is throwing out the baby with the bathwater. This will simply lead to ISPs and network operators blocking DoH. And instead of a wonderfully decentralized DNS, we'll end up with centralized DoH in the hands of Cloudflare and their ilk. Who have been shown repeatedly to be user hostile; especially towards privacy conscious users.

kadoban 5y ago
Can they block DoH, with reasonable tradeoffs? How? And will they care enough? I get the sense that they don't really gain that much from messing with DNS, relatively.
- Hizonner 5y ago
  They couldn't necessarily block all DoH, but they could destroy its prevalence by just blocking all of the default resolvers and all of the resolvers that the browsers suggest to users. Those are public lists. I suspect you're right that they don't get that much value from messing with DNS, though... not enough to deal with the user complaints they'd get. So they probably wouldn't bother unless pressured. However, they might decide to "play chicken" with Mozilla and other sources of DoH apps by seeing who yielded to the user complaints first. There'd be a big temptation for Mozilla to fall back to "regular" DNS if DoH failed, and then the ISP would effectively win.
  - kadoban 5y ago
    They'd have to block by domain name, right, and block all HTTPS traffic to those domains? I somehow suspect that browers can win that particular cat and mouse game just by making the domains too important to block (share the domain with something users care about). Maybe I'm missing something there though, it probably is more complicated than just that.
    - Hizonner 5y ago
      In the end, DoH has to either start with some kind of seed IP address, even if it's a cache-priming DNS A record, or use a (presumably attackable) non-DoH lookup to find its server. You can't start with a domain name for the server that you use to resolve all domain names. But I don't think that's very important, because domain names always resolve to IP addresses anyhow, and you can't change the IP addresses that fast. So you would have to share an IP address with something "too important to block". The political problem with that tends to be that the operators of things that might be too important to block tend to think that those things are too important to expose to any risk of being blocked, say by sharing them with something that somebody might want to block. It's also not always administratively or technically trivial to share the domain name or IP address(es) of some giant public Web service with another fundamentally unrelated service like DoH. I mean, sure, in the end, if enough large organizations tried hard enough, they could eventually come up with ways to make it pretty painful to block... but those large organizations tend to have overriding commercial concerns... and not to want to overtly taunt large governments...

Hizonner 5y ago

If Mozilla cared about preventing DNS tampering, they could have done DNSSEC 10 years ago. That would have totally killed ads, ISP typosquatting, and captive portals. They, like all browsers, rejected that source of end-to-end security. The fact is that they want to enable DNS tampering, because they want to use it as a way of enforcing their idea of "safety". So they're building this giant, highly centralized, and easily pressured, infrastructure of "trusted resolvers" that can mess with your DNS results to their heart's content. This will, of course, be a huge attractant for bad actors who want to do things even more harmful than injecting obnoxious advertizing. As for privacy, the only way that can work, even with something like DNSCrypt, is if the individual user chooses the resolver from among a very large set of possibilities.. which Mozilla is not enabling. Either that, or relatively exotic anonymization stuff that's not actually worked out, and that Mozilla has shown zero interest in working out. "Trusted resolvers" just move the privacy problem to a different place, and, again, it's a highly centralized place that's easy to subvert. And DNS-over-TCP is desirable for sure, but it does nothing about tampering or privacy. It's just irrelevant, except maybe as a preliminary step making it easier to deploy some of the stuff that might actually help.

kadoban 5y ago
How could Mozilla have "done" DNSSEC 10 years ago? Isn't that pretty much just not in their control?
- Hizonner 5y ago
  If TLDs are signed (which they have been for a long time), and if the browser checks DNSSEC, you can't typosquat, because you can't spoof the TLD server's signature on the typo. That requires no cooperation from anybody but the browser and the TLD. WIth DNSSEC enabled, somebody can still impersonate an unsigned domain, but the whole reason that there are so many unsigned zones to begin with is that nothing checks the signatures, so there's no incentive to sign. By actually doing the checks, browsers, including Firefox, could have created an incentive for widespread DNSSEC signing. So they could have both unilaterally gotten a lot of benefit for their users, and encouraged wider DNSSEC deployment that would have produced further benefit. Add in DANE, and it would also have given a much more satisfying fix for a bunch of CA issues that they've chosen to band-aid with stuff that only half works. You could probably even have gotten to a world with zero-cost TLS certs well before enough pressure built up to make Lets Encrypt come along.

nimbius 5y ago

>There's a lot of lament that this bypasses the operating system level config systemd-resolved has the clandestine ability to forward all your DNS traffic to google in many distributions of Linux. I would say the state of resolution in general is getting uncomfortably sketchy. many wireless routers from Asus and others due to a buggy (or perhaps intentional) implementation of Dnsmasq will quietly intercept your DNS requests using their own built-in resolver. RT-ARCH13 is notorious for it even if NAT mode is disabled. for my pihole implementation I block 53 outbound and do DoH resolution using cloudflared on the pi. finally it bears remembering that the number one largest opposition to the use of DoH was ISP's who were (and still are) making a killing selling your search history. they went so far as to lobby congress to stop DoH. Now the very same ISP's we tried to protect users from are part of the DoH club anyway because, well, money talks. https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-strike-privacy-deal-to-encrypt-dns-lookups-in-firefox/ https://arstechnica.com/tech-policy/2020/06/comcast-mozilla-...

danudey 5y ago
I recently tried setting up microk8s, since Ubuntu was pushing it pretty hard and it seemed useful, but a lot of stuff wouldn't work at all. Turns out that the microk8s config uses cloudflare DNS by default, and not your currently configured DNS or any kind of local DNS proxy. This was hugely frustrating because it's not the configuration that I would expect, it's not obvious why things are failing, and, in our case, it's sending internal DNS names to an external DNS server, unencrypted, over the public internet. Surely it's convenient, but definitely not trustworthy.
yrro 5y ago
"clandestine"? Please, don't be ridiculous. The choice of fallback DNS server is a default that is only used in the absence of any other configured DNS resolver. If you are compiling systemd yourself then this is one of many defaults that you need to be aware of. Everyone else will get the defaults that their distribution has chosen.

slim 5y ago

Mozilla wants to be the gatekeeper to their users. Every company and it's dog wants to do this. "If you are not paying for the product, you are the product" should become "if you are a customer/user, you are also a product".

ignoramous 5y ago

> There's a lot of lament that this bypasses the operating system level config, but I feel like we wouldn't be here if the operating system had stepped up their DNS any time in the last several years. OSes are relegated to support myriad environments with adhoc yet byzantine configuration. A browser's primary objective is to be a "user-agent" (as opposed to, say, subscribing to the whims of ISPs / Governments / anti-digital-rights-companies-masking-as-cyber-security-firms). > For the techie user who's running PiHole or some custom local DNS, yeah this will be annoying, but for the average user who's just delegating to their ISP that is then tracking their DNS lookups and injecting ads if they mistype a domain, this is a win. Internet censorship, which most of the population in the West isn't subject to or even aware of, is the primary reason DoH-in-a-browser is widely lauded. It just works, and thwarts all cheaper attempts at surveillance and censorship. Though, the likely effect would be, deep-packet-inspection becomes common place, but the imminent ESNI standard has that one covered, too. As someone who builds and maintains an open-source DoH resolver, I have come to fully appreciate the control and power a resolver running over HTTP/S puts in the hands of the users, both in the client and on the resolver-side.

Hizonner 5y ago
> the imminent ESNI standard has that one covered, too. Too slow, I'm afraid. Word on the street is that any hello containing ESNI will be blocked from day one in too many places for it to ever get traction, including all of China. I believe draft ESNI is blocked by the GFOC today. To even have a chance of making ESNI/ECH widespread, you'd have to make it mandatory for all TLS. That wouldn't fly politically in the working group, because the "enterprise" people have at least some influence there, and they want to do exactly the same kinds of DPI that North Korea would want to do. Even if it came out mandatory on the standards track, it would probably still fail at this point. It might have worked if it'd been mandatory in TLS 1.2 or even TLS 1.3, but it seems too late now. We'll see if they also disrupt DoH to the point of making it unusable. I bet they at least give it a try.
- josephcsible 5y ago
  If Microsoft, Apple, and Google all agreed to make ECH mandatory on the same future date, wouldn't that basically force the hands of every other enterprise?

throw0101a 5y ago

> This is a workaround for the fact that many networks are hostile to DNS lookups (injecting ads, tracking, captive portals), and operating systems continue to just default to the ISPs DNS provider, which is often hostile. This workaround is hostile to my own network (home or work) being able to track requests. I control my router / DCHP server, and I should be able to tell devices where to send DNS requests. Anything that does not do what I tell it to do is malware IMHO.

cle 5y ago
You can’t track all requests anyway, as they can be trivially tunneled through encrypted streams with bundled certs. This is the tradeoff of running arbitrary Turing-complete programs. If you don’t like what a program is doing, or that it doesn’t use libc or some standard way to do DNS resolution, your only options are to either change the program to do what you want, or don’t run it.
- throw0101a 5y ago
  > You can’t track all requests anyway, as they can be trivially tunneled through encrypted streams with bundled certs. Previously I can track devices (a) making DNS requests, and then (b) make TCP and/or UDP requests. Anything that made a data request without a DNS request was probably using a hard-coded IP, which would be suspicious. With DoH, it's all-HTTPS all-the-time: > DoH is an over the top bypass of enterprise and other private networks. But DNS is part of the control plane, and network operators must be able to monitor and filter it. Use DoT, never DoH. * https://twitter.com/paulvixie/status/1053886628832382977 https://twitter.com/paulvixie/status/1053886628832382977 > or don’t run it. So Firefox further circles the drain with regards to market share? Is this part of some grand 4D chess plan by Mozilla that is perhaps beyond my intellect?
  - SilverRed 5y ago
    The cat is out of the bag regardless of what Firefox does. Even without firefox any bit of malware could bundle their own DoH library.

thayne 5y ago

On Linux there is systemd-resolved which is enabled installed and enabled on the most popular distros. It is a caching resolver that supports DoT (although it isn't enabled by default). Having the pre-select a DNS resolver some of the same problems as having the application selecting the resolver. Specifically, it doesn't work as expected in networks with a local DNS server.

tumblewit 5y ago

This is where iOS wins I think. According to Apple documentation, no app can override a systemwide DNS setting in iOS14. So if you were to apply a dns profile, it is guaranteed that apps cannot use their own dns resolver.

comex 5y ago
Which documentation? I searched the App Store Review Guidelines for "DNS" and didn't find anything.

smnrchrds 5y ago

> ISPs DNS provider, which is often hostile Exactly which Canadian ISP does this? I don't think that's an issue in Canada, where this feature is being enabled.

eptcyka 5y ago

Having had the joy of writing code to manage system wide DNS config for all 3 of the major desktop operating systems, it's very clear that nobody cares about DNS - the users just want it to work and the systems developers also just want it to work. On macOS, if you don't have an IPv6 enabled primary adapter, even if you have a working IPv6 VPN connection, you just won't be able to get AAAA responses regardless of your configuration. Watching for config changes is also a race ridden mess, applying DNS on Linux on major distros is also a crapshoot of which specific NM (NetworkManager) version the user is using (this can differ between a fresh Ubuntu 16.04 install and one which has been upgraded to 16.04 from 14.04), and which specific DNS mode NM is configured for. There's also systemd-resolved, with multiple versions and capabilities, and there's also resolvconf. In some cases, there's a notion of a global config, in others, the config is always bound to a specific interface. Windows is somewhat better in this regard. But at least the developers of NM and systemd-resolved are receptive and incredibly helpful.

gsich 5y ago

They have, will Firefox respect the settings made there? ie Windows 10 has it, macOS, Linux with systemd-resolver has it, Android too.