4 ms·

>the entire point is to make it impossible to block ads the entire point is to make it impossible to modify DNS requests at the network level. this has a lot

>the entire point is to make it impossible to block ads the entire point is to make it impossible to modify DNS requests at the network level. this has a lot more serious consequences than just blocking ads. especially for the parties involved with this, none of whom are advertising companies. phishing and data security are actual big issues with financial implications that companies want to prevent. just because blocking ads is the consequence that will most immediately impact you personally, doesn't make it the whole point. this accusation is especially rich on an article about mozilla, one of the few companies fighting to make sure that advertisers don't control the application level.

ocdtrekkie 5y ago
> phishing and data security are actual big issues with financial implications that companies want to prevent These are issues exacerbated by DoH, not fixed by it. DoH assists in the circumvention of security and monitoring. We block ads because they're security problems.
- josephcsible 5y ago
  Control over DNS is neither necessary nor sufficient to block ads.
  - ocdtrekkie 5y ago
    It's not sufficient in itself, but it bears most of the load of network-wide management of harmful traffic. It's the 99% effective method. Endpoint-level control is no longer possible, since ad companies are skipping the OS network stack and bringing their own. Application-level control is less efficient, and more difficult, particularly when the applications are designed by the same ad companies trying to circumvent DNS control as well. (See Manifest V3.)
- deleted 5y ago
  [deleted]
- notatoad 5y ago
  >DoH assists in the circumvention of ... monitoring yes, that's the point. I understand you want to monitor traffic within your network, but forcing clients to use insecure protocols to enable network-wide monitoring means you're enabling network-wide monitoring. and that's the opposite of security. remember that your browser traffic crosses multiple networks before it hits the website you're trying to connect to. forcing that traffic to be observable and modifiable in your own network means it will also be observable and modifiable by your ISP.
  - ocdtrekkie 5y ago
    > forcing that traffic to be observable and modifiable in your own network means it will also be observable and modifiable by your ISP This is factually false. And represents a key part of the problem in the rollout browser vendors have designed: Browsers should not be implementing their own network stacks. It's the wrong place to begin encrypting network requests, but for the "if you're a hammer" crowd, everything looks like a nail. If the browser respected the OS stack, the OS could decide to encrypt requests, but it isn't given the choice. If the browser respected the network it's in, the network could decide to encrypt requests at the border, but it isn't given the choice. Browser vendors decided the right choice was to build a product purpose-built to bypass nearly every good method of restricting malware, phishing, and, oh of course, ads. Google and their ilk would happily install ransomware on every PC on the planet if it would guarantee Google Ads couldn't be blocked, and that ISPs couldn't compete with their well-established surveillance tools. The latter is why any suggestion DoH is to protect user privacy is silly... the user's privacy was compromised by the browser application pre-encryption. They just need you to believe the ISPs are somehow a bad actor for tracking you, so that only they can track you.
    - deleted 5y ago
      [deleted]
- glennpratt 5y ago
  Any device you didn't have root on was free work around your DNS server already. This is weak security at best. DHCP will catch up too. https://datatracker.ietf.org/doc/html/draft-peterson-doh-dhcp-00 https://datatracker.ietf.org/doc/html/draft-peterson-doh-dhc...
wbl 5y ago
Use MDM and configure the browser. Or block the special probe domain Mozilla has for this purpose.

ocdtrekkie 5y ago

> phishing and data security are actual big issues with financial implications that companies want to prevent These are issues exacerbated by DoH, not fixed by it. DoH assists in the circumvention of security and monitoring. We block ads because they're security problems.

josephcsible 5y ago
Control over DNS is neither necessary nor sufficient to block ads.
- ocdtrekkie 5y ago
  It's not sufficient in itself, but it bears most of the load of network-wide management of harmful traffic. It's the 99% effective method. Endpoint-level control is no longer possible, since ad companies are skipping the OS network stack and bringing their own. Application-level control is less efficient, and more difficult, particularly when the applications are designed by the same ad companies trying to circumvent DNS control as well. (See Manifest V3.)
deleted 5y ago
[deleted]
notatoad 5y ago
>DoH assists in the circumvention of ... monitoring yes, that's the point. I understand you want to monitor traffic within your network, but forcing clients to use insecure protocols to enable network-wide monitoring means you're enabling network-wide monitoring. and that's the opposite of security. remember that your browser traffic crosses multiple networks before it hits the website you're trying to connect to. forcing that traffic to be observable and modifiable in your own network means it will also be observable and modifiable by your ISP.
- ocdtrekkie 5y ago
  > forcing that traffic to be observable and modifiable in your own network means it will also be observable and modifiable by your ISP This is factually false. And represents a key part of the problem in the rollout browser vendors have designed: Browsers should not be implementing their own network stacks. It's the wrong place to begin encrypting network requests, but for the "if you're a hammer" crowd, everything looks like a nail. If the browser respected the OS stack, the OS could decide to encrypt requests, but it isn't given the choice. If the browser respected the network it's in, the network could decide to encrypt requests at the border, but it isn't given the choice. Browser vendors decided the right choice was to build a product purpose-built to bypass nearly every good method of restricting malware, phishing, and, oh of course, ads. Google and their ilk would happily install ransomware on every PC on the planet if it would guarantee Google Ads couldn't be blocked, and that ISPs couldn't compete with their well-established surveillance tools. The latter is why any suggestion DoH is to protect user privacy is silly... the user's privacy was compromised by the browser application pre-encryption. They just need you to believe the ISPs are somehow a bad actor for tracking you, so that only they can track you.
  - deleted 5y ago
    [deleted]
glennpratt 5y ago
Any device you didn't have root on was free work around your DNS server already. This is weak security at best. DHCP will catch up too. https://datatracker.ietf.org/doc/html/draft-peterson-doh-dhcp-00 https://datatracker.ietf.org/doc/html/draft-peterson-doh-dhc...

wbl 5y ago

Use MDM and configure the browser. Or block the special probe domain Mozilla has for this purpose.