3 ms·

> You don't get to control what my devices do just because you control a network they're transiting through. And if I run a guest wifi in one of the many count

> You don't get to control what my devices do just because you control a network they're transiting through. And if I run a guest wifi in one of the many countries where I have legal obligations to take steps to block illegal traffic because I am ultimately responsible for the emissions of my network, what would you suggest I do? > DNS doesn't have a rich error vocabulary. For your ad-blocked domains, a traditional DNS server has to either lie (bogus answer) or claim no answer exists (NXDOMAIN or OK 0 answers) but HTTP has a rich variety of error codes. It's a good thing that DNS has a limited vocabulary of error codes. I want the garbage website to think it couldn't load the ad because of a mysterious DNS issue. Having a reason like "DNSHTTP 486: Blocked by Client" would just make it that much easier for the site to deny you access/track you/detect your blocking activity.

stinkytaco 5y ago
> And if I run a guest wifi in one of the many countries where I have legal obligations to take steps to block illegal traffic because I am ultimately responsible for the emissions of my network, what would you suggest I do? This is an oft overlooked part of these discussions. I manage a public network at a library (which is still the only access point for many people, unfortunately). DNS blacklisting certainly isn't the only tool in the toolkit, but it is one that DoH takes out. I'm genuinely conflicted on DoH because on one hand, I am a privacy advocate, but on the other I run a public network and that comes with certain obligations, both legal (we need to block filesharing) and to customers (we do traffic shaping because the budget it limited and bandwidth isn't cheap).
- SilverRed 5y ago
  You do what every company does. Deploy industry standard methods and record your processes. And then when someone comes asking, you show them you did everything right and that is usually the end of it.
  - stinkytaco 5y ago
    That's not the case in the US. Our ISP will absolutely be within their rights to cancel our service if someone on our network is violating their TOS. And we don't really have the money or the standing to fight it.
tialaramex 5y ago
As with steps someone might have a legal obligation to take to prevent people from thinking negative things about the King or to prevent six from being an even number, you should do whatever you feel is appropriate. It might even make a difference. Perhaps you could put up a notice which says "I run guest WiFi here and I have legal obligations to block illegal traffic so, don't do anything illegal". It's certainly weird to insist it's everybody's else's problem that you're subject to legal obligations that may be impossible to fulfil. If the purpose of this "obligation" is to ensure nobody is technically compliant and so they can arrest, imprison or even execute whoever they want, it doesn't seem like that's my fault, or Mozilla's fault, or any of the authors and acknowledged contributors for RFC 8484. Any more than it's Giuseppe Peano's fault that six is even. And if (as seems most likely) they're just covering their backside, the notice is probably sufficient.
Spivak 5y ago
A world where it’s the local public network operator’s problem to filter client traffic came and went with TLS. You already live in a world where someone who wants to bypass your restrictions can do so trivially. So if you’re not in legal hot water today you won’t be tomorrow with DoH. You deploy whatever non-functional product your country requires for filtering and wash your hands of the responsibility.

stinkytaco 5y ago

> And if I run a guest wifi in one of the many countries where I have legal obligations to take steps to block illegal traffic because I am ultimately responsible for the emissions of my network, what would you suggest I do? This is an oft overlooked part of these discussions. I manage a public network at a library (which is still the only access point for many people, unfortunately). DNS blacklisting certainly isn't the only tool in the toolkit, but it is one that DoH takes out. I'm genuinely conflicted on DoH because on one hand, I am a privacy advocate, but on the other I run a public network and that comes with certain obligations, both legal (we need to block filesharing) and to customers (we do traffic shaping because the budget it limited and bandwidth isn't cheap).

SilverRed 5y ago
You do what every company does. Deploy industry standard methods and record your processes. And then when someone comes asking, you show them you did everything right and that is usually the end of it.
- stinkytaco 5y ago
  That's not the case in the US. Our ISP will absolutely be within their rights to cancel our service if someone on our network is violating their TOS. And we don't really have the money or the standing to fight it.

tialaramex 5y ago

As with steps someone might have a legal obligation to take to prevent people from thinking negative things about the King or to prevent six from being an even number, you should do whatever you feel is appropriate. It might even make a difference. Perhaps you could put up a notice which says "I run guest WiFi here and I have legal obligations to block illegal traffic so, don't do anything illegal". It's certainly weird to insist it's everybody's else's problem that you're subject to legal obligations that may be impossible to fulfil. If the purpose of this "obligation" is to ensure nobody is technically compliant and so they can arrest, imprison or even execute whoever they want, it doesn't seem like that's my fault, or Mozilla's fault, or any of the authors and acknowledged contributors for RFC 8484. Any more than it's Giuseppe Peano's fault that six is even. And if (as seems most likely) they're just covering their backside, the notice is probably sufficient.

Spivak 5y ago

A world where it’s the local public network operator’s problem to filter client traffic came and went with TLS. You already live in a world where someone who wants to bypass your restrictions can do so trivially. So if you’re not in legal hot water today you won’t be tomorrow with DoH. You deploy whatever non-functional product your country requires for filtering and wash your hands of the responsibility.