3 ms·

> Devices will still be able to ignore you. Yes. But previously by logging requests to port 53 (and 853) I can hunt down those devices quite easy. > However,

> Devices will still be able to ignore you. Yes. But previously by logging requests to port 53 (and 853) I can hunt down those devices quite easy. > However, my perspective is that any network that will MITM my requests or monitor what websites I visit without my permission is malicious IMHO. If you don't like how I've set up my network, blocking your DNS requests, feel free not to use my network. > To argue that my installation of Firefox or that my OS shouldn't be able to ignore network settings anywhere and that I shouldn't be able to choose how my requests are encrypted, just because it makes it easier for you specifically to enforce your network's security policy without explicit opt-in or consent You can set up your devices however you want. But if they're on my network, they play by my rules. > I know that this stuff will make it harder for some network operators to do their jobs but... so did HTTPS. And network owners are free to block port 443 as well. Or any other port. People can choose to use those networks or not.

danShumway 5y ago
> But previously by logging requests to port 53 (and 853) I can hunt down those devices quite easy. And IOT devices are required to use port 53 or 853? They don't have the ability to proxy their DNS requests through another service? DNS even as it exists today is not a mandate, this stuff can be circumvented. > You can set up your devices however you want. But if they're on my network, they play by my rules. I think that's fine. Block DoH on your own network. But don't complain about my browser turning it on. You can block 443 if you want, but I'm not going to be sympathetic if you argue that LetsEncrypt shouldn't exist. There's a big difference between saying that you require every device on your network to plain-text its DNS queries to you for monitoring, vs arguing that it's harmful for Mozilla to make Firefox's DNS queries more secure for everyone else. The only way DoH would be hostile to your network is if needing consent to monitor people's DNS queries when they join your network (via a settings change or confirmation that they're not using DoH) is a problem for you.

danShumway 5y ago

> But previously by logging requests to port 53 (and 853) I can hunt down those devices quite easy. And IOT devices are required to use port 53 or 853? They don't have the ability to proxy their DNS requests through another service? DNS even as it exists today is not a mandate, this stuff can be circumvented. > You can set up your devices however you want. But if they're on my network, they play by my rules. I think that's fine. Block DoH on your own network. But don't complain about my browser turning it on. You can block 443 if you want, but I'm not going to be sympathetic if you argue that LetsEncrypt shouldn't exist. There's a big difference between saying that you require every device on your network to plain-text its DNS queries to you for monitoring, vs arguing that it's harmful for Mozilla to make Firefox's DNS queries more secure for everyone else. The only way DoH would be hostile to your network is if needing consent to monitor people's DNS queries when they join your network (via a settings change or confirmation that they're not using DoH) is a problem for you.