5 ms·

Genuine question, what is Mozilla doing that's so bad? I know stuff like pocket etc but can't you turn this stuff off? Interested so I know what I'm missing and

Genuine question, what is Mozilla doing that's so bad? I know stuff like pocket etc but can't you turn this stuff off? Interested so I know what I'm missing and can make an informed decision.

Ansil849 5y ago
> what is Mozilla doing that's so bad? Automatically enabling Cloudflare to monitor DNS queries is my biggest current pet peeve. The whole reason I used to use Firefox was that it wasn't a corporate product. Allowing a corporation to monitor DNS resolutions is undesirable, as is having to trust their privacy policy, or that they will abide by Mozilla's policy (I don't, and more importantly, shouldn't have to trust Cloudflare). And yes, you can opt-out, but the fact that it is enabled by default in some regions is offensive.
- progval 5y ago
  To be fair, there is almost always a corporation able to monitor your DNS resolutions. If not Cloudflare, then your ISP or proxy/VPN provider. It's a tradeoff based on the relative risks of leaking them to Cloudflare vs ISPs
  - Ansil849 5y ago
    I would a thousand times over rather have my local ISP monitor DNS than Cloudflare. But the choice isn't ISP or Cloudflare. There are many options for secure DNS resolvers [1]. [1] https://dnscrypt.info/public-servers/ https://dnscrypt.info/public-servers/
    - ShamelessC 5y ago
      It's not like ISP's aren't shady af when it comes to this. I can appreciate your concern w.r.t. cloudflare but, at least in the US, ISP's are often more ostensibly dangerous than cloudflare. To suggest that Cloudflare is "thousand times" worse is a bit of a stretch, I guess.
    - progval 5y ago
      Mozilla must have had other criteria: 1. how reliable are these resolvers, right now and in the long term? can Mozilla get an SLA in contract? 2. what is the latency to them? (Cloudflare has PoPs everywhere, so it is likely very hard to beat) 3. what is their privacy policy? can Mozilla get assurances of this? 4. will they be crushed under load if all Firefox browsers on the planet starts using them? etc. I am no fan of Cloudflare myself; and avoid it whenever I can. But it is not that bad as a default, for users who don't understand any of these.
      - throwawayt215 5y ago
        // 3. what is their privacy policy? can Mozilla get assurances of this? // 4 providers have contractually agreed to abide by Mozilla’s Trusted Recursive Resolver (TRR) program's policy requirements, so far. https://wiki.mozilla.org/Security/DOH-resolver-policy#Conforming_Resolvers/ https://wiki.mozilla.org/Security/DOH-resolver-policy#Confor... CIRA Canadian Shield Cloudflare NextDNS Comcast I think you need to use the specific DoH URL in the above link to get the contract benefits, but maybe I'm wrong
        ttybird2 5y ago
        Cloudflare's DNS violates this: https://wiki.mozilla.org/Security/DOH-resolver-policy#Blocking_.26_Modification_Prohibitions https://wiki.mozilla.org/Security/DOH-resolver-policy#Blocki... I had a user of my email server complain about not being able to receive emails from "cock.li". Turns out that this happened because I was using dnscrypt-proxy with cloudflare's dns (as it is the default in my distro) and thus the DKIM check was failing because it was not able to resolve the domain as it is being filtered by cloudflare. I changed to NextDNS after that.
        throwawayt215 5y ago
        I guess it's because the contract is valid only for Mozilla Firefox. cock.li resolves perfectly fine on Firefox with Cloudflare DoH.
    - cyberlurker 5y ago
      What’s wrong with cloudflare? Are they worse than Google for some reason?
      - ShamelessC 5y ago
        Some people, perhaps correctly, see them as a centralizing entity for the internet with a profit motive. That they are also currently kind of "eating the world" gives cause for concern. They currently haven't yet betrayed their users but many see it as a matter of time before they begin selling user data. Happy to be corrected on that last bit by the way if they have done anything egregious.
        Ansil849 5y ago
        > if they have done anything egregious. The way they tried to downplay the significance of Cloudbleed, for starters.
    - Vinnl 5y ago
      > But the choice isn't ISP or Cloudflare. It is when you're talking about the default being offensive to you. The other options haven't been taken away from you.
    - throwawayt215 5y ago
      So far, only 4 providers have contractually agreed to abide by Mozilla’s Trusted Recursive Resolver (TRR) program's policy requirements. https://wiki.mozilla.org/Security/DOH-resolver-policy#Conforming_Resolvers/ https://wiki.mozilla.org/Security/DOH-resolver-policy#Confor... Maybe it's better to choose one among the 4 CIRA Canadian Shield Cloudflare NextDNS Comcast I think you need to use the specific DoH URL in the above link to get the contract benefits, but maybe I'm wrong
    - claudiawerner 5y ago
      Forgive me if you will, but I don't really understand the idea behind privacy on DNS. If you're not using a VPN, even if the DNS resolution is private, the ISP can still see what IP you're connecting to. It's trivial to do a reverse lookup on that. And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too. So why is there so much focus on proxying DNS?
      - commoner 5y ago
        While encrypted DNS does conceal the domain name from the ISP, it also prevents the ISP from intentionally returning an incorrect IP address in response to a DNS request. This behavior is known as DNS cache poisoning[1] (or DNS spoofing) and has been used by governments to censor websites and perform DDoS attacks on other websites.[2] [1] https://en.wikipedia.org/wiki/DNS_spoofing https://en.wikipedia.org/wiki/DNS_spoofing [2] https://www.crowdstrike.com/blog/cyber-kung-fu-great-firewall-art-dns-poisoning/ https://www.crowdstrike.com/blog/cyber-kung-fu-great-firewal...
        commoner 5y ago
        > And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too. I originally misread this sentence. Yes, HTTPS requests expose the domain/subdomain name in plaintext to support Server Name Indication, which allows a server to host multiple HTTPS sites.[1] The domain/subdomain name can be concealed from the ISP with Encrypted SNI,[2] which Cloudflare's 1.1.1.1 DNS resolver supports. Firefox used to support ESNI as an about:config option, but in version 85, Firefox replaced it with support for an improved mechanism called Encrypted Client Hello.[3][4] ECH is not widely used yet, though Cloudflare is testing it on some of its servers.[5] With DNS over HTTPS/TLS and ECH, the entire process of connecting to an HTTPS site can be done without leaking the domain/subdomain name to the ISP. The only remaining parts exposed in plaintext are the remote IP address and port. [1] https://https.cio.gov/faq/#why-are-domain-names-unencrypted-over-https-today https://https.cio.gov/faq/#why-are-domain-names-unencrypted-... [2] https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn... [3] https://blog.mozilla.org/security/2021/01/07/encrypted-client-hello-the-future-of-esni-in-firefox/ https://blog.mozilla.org/security/2021/01/07/encrypted-clien... [4] https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/ [5] https://blog.cloudflare.com/handshake-encryption-endgame-an-ech-update/ https://blog.cloudflare.com/handshake-encryption-endgame-an-...
    - wintermutestwin 5y ago
      >I would a thousand times over rather have my local ISP monitor DNS than Cloudflare. ISPs lobbied to be able to sell our data. Cloudflare claims that they don't. I trust neither, but I trust Cloudflare %1 more than my scummy ISP.
- justsomehnguy 5y ago
  It doesn't help what you can't find the list of those regions in FF KB. EDIT: I honestly tried to, though I'm on mobile ATM
  - Ansil849 5y ago
    You're exactly right, the KB entry is infuriatingly vague about both the exact regions and the rationale for this.
- tristor 5y ago
  The alternative is that all of your DNS queries are monitorable by anyone who happens to share a network path or segment with you, because the default behavior of DNS is that it is unencrypted. DoH is a massive security and privacy improvement as a default, and you have many other options besides CloudFlare if you don’t want to use them. Personally I use NextDNS.
webmobdev 5y ago
The browser now includes ads based on your bookmarks and browsing history through Mozilla's "trusted" partners: > “When contextual suggestions are enabled, Firefox Suggest uses your city location and search keywords to make contextual suggestions from Firefox and our partners, while keeping your privacy in mind,” the support post reads. The “relevant suggestions” from “trusted partners” appear at the bottom of the usual search suggestions pulled from your bookmarks, browser history, and open tabs — a less intrusive version of a search ad, but technically still an ad. Source: https://www.theverge.com/2021/10/7/22715179/firefox-suggest-search-ads-browser https://www.theverge.com/2021/10/7/22715179/firefox-suggest-... (It's annoying that the mods unnecessarily removed my parent post that said Firefox is now an adware / spyware - I stand by it. Including ads and using and sharing users data is the definition of an adware / spyware.) For those who ask, why not just turn it off - remember that corporations only have to follow the law. They have no obligation to be ethically good. If your country has lax privacy laws, companies will exploit it because it is legal. Then there is the trust factor - Mozilla has lost a lot of goodwill in selfishly only focusing on making more money from its browser than listening to their users and creating a good browser. That's why it has been losing ground to Chrome, and will continue to do so as long as greed guides all its decisions and makes Firefox worse. You'd think uBlock Origin's popularity would already have given some insight to Firefox on how much people hate unwanted and intrusive ads, especially that try to mine our personal data.

Genuine question, what is Mozilla doing that's so bad? I know stuff like pocket etc but can't you turn this stuff off? Interested so I know what I'm missing and can make an informed decision.

Ansil849 5y ago

> what is Mozilla doing that's so bad? Automatically enabling Cloudflare to monitor DNS queries is my biggest current pet peeve. The whole reason I used to use Firefox was that it wasn't a corporate product. Allowing a corporation to monitor DNS resolutions is undesirable, as is having to trust their privacy policy, or that they will abide by Mozilla's policy (I don't, and more importantly, shouldn't have to trust Cloudflare). And yes, you can opt-out, but the fact that it is enabled by default in some regions is offensive.

progval 5y ago
To be fair, there is almost always a corporation able to monitor your DNS resolutions. If not Cloudflare, then your ISP or proxy/VPN provider. It's a tradeoff based on the relative risks of leaking them to Cloudflare vs ISPs
- Ansil849 5y ago
  I would a thousand times over rather have my local ISP monitor DNS than Cloudflare. But the choice isn't ISP or Cloudflare. There are many options for secure DNS resolvers [1]. [1] https://dnscrypt.info/public-servers/ https://dnscrypt.info/public-servers/
  - ShamelessC 5y ago
    It's not like ISP's aren't shady af when it comes to this. I can appreciate your concern w.r.t. cloudflare but, at least in the US, ISP's are often more ostensibly dangerous than cloudflare. To suggest that Cloudflare is "thousand times" worse is a bit of a stretch, I guess.
  - progval 5y ago
    Mozilla must have had other criteria: 1. how reliable are these resolvers, right now and in the long term? can Mozilla get an SLA in contract? 2. what is the latency to them? (Cloudflare has PoPs everywhere, so it is likely very hard to beat) 3. what is their privacy policy? can Mozilla get assurances of this? 4. will they be crushed under load if all Firefox browsers on the planet starts using them? etc. I am no fan of Cloudflare myself; and avoid it whenever I can. But it is not that bad as a default, for users who don't understand any of these.
    - throwawayt215 5y ago
      // 3. what is their privacy policy? can Mozilla get assurances of this? // 4 providers have contractually agreed to abide by Mozilla’s Trusted Recursive Resolver (TRR) program's policy requirements, so far. https://wiki.mozilla.org/Security/DOH-resolver-policy#Conforming_Resolvers/ https://wiki.mozilla.org/Security/DOH-resolver-policy#Confor... CIRA Canadian Shield Cloudflare NextDNS Comcast I think you need to use the specific DoH URL in the above link to get the contract benefits, but maybe I'm wrong
      - ttybird2 5y ago
        Cloudflare's DNS violates this: https://wiki.mozilla.org/Security/DOH-resolver-policy#Blocking_.26_Modification_Prohibitions https://wiki.mozilla.org/Security/DOH-resolver-policy#Blocki... I had a user of my email server complain about not being able to receive emails from "cock.li". Turns out that this happened because I was using dnscrypt-proxy with cloudflare's dns (as it is the default in my distro) and thus the DKIM check was failing because it was not able to resolve the domain as it is being filtered by cloudflare. I changed to NextDNS after that.
        throwawayt215 5y ago
        I guess it's because the contract is valid only for Mozilla Firefox. cock.li resolves perfectly fine on Firefox with Cloudflare DoH.
  - cyberlurker 5y ago
    What’s wrong with cloudflare? Are they worse than Google for some reason?
    - ShamelessC 5y ago
      Some people, perhaps correctly, see them as a centralizing entity for the internet with a profit motive. That they are also currently kind of "eating the world" gives cause for concern. They currently haven't yet betrayed their users but many see it as a matter of time before they begin selling user data. Happy to be corrected on that last bit by the way if they have done anything egregious.
      - Ansil849 5y ago
        > if they have done anything egregious. The way they tried to downplay the significance of Cloudbleed, for starters.
  - Vinnl 5y ago
    > But the choice isn't ISP or Cloudflare. It is when you're talking about the default being offensive to you. The other options haven't been taken away from you.
  - throwawayt215 5y ago
    So far, only 4 providers have contractually agreed to abide by Mozilla’s Trusted Recursive Resolver (TRR) program's policy requirements. https://wiki.mozilla.org/Security/DOH-resolver-policy#Conforming_Resolvers/ https://wiki.mozilla.org/Security/DOH-resolver-policy#Confor... Maybe it's better to choose one among the 4 CIRA Canadian Shield Cloudflare NextDNS Comcast I think you need to use the specific DoH URL in the above link to get the contract benefits, but maybe I'm wrong
  - claudiawerner 5y ago
    Forgive me if you will, but I don't really understand the idea behind privacy on DNS. If you're not using a VPN, even if the DNS resolution is private, the ISP can still see what IP you're connecting to. It's trivial to do a reverse lookup on that. And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too. So why is there so much focus on proxying DNS?
    - commoner 5y ago
      While encrypted DNS does conceal the domain name from the ISP, it also prevents the ISP from intentionally returning an incorrect IP address in response to a DNS request. This behavior is known as DNS cache poisoning[1] (or DNS spoofing) and has been used by governments to censor websites and perform DDoS attacks on other websites.[2] [1] https://en.wikipedia.org/wiki/DNS_spoofing https://en.wikipedia.org/wiki/DNS_spoofing [2] https://www.crowdstrike.com/blog/cyber-kung-fu-great-firewall-art-dns-poisoning/ https://www.crowdstrike.com/blog/cyber-kung-fu-great-firewal...
      - commoner 5y ago
        > And if I'm not mistaken, even on HTTPS sites, the domain is visible in the request in plaintext too. I originally misread this sentence. Yes, HTTPS requests expose the domain/subdomain name in plaintext to support Server Name Indication, which allows a server to host multiple HTTPS sites.[1] The domain/subdomain name can be concealed from the ISP with Encrypted SNI,[2] which Cloudflare's 1.1.1.1 DNS resolver supports. Firefox used to support ESNI as an about:config option, but in version 85, Firefox replaced it with support for an improved mechanism called Encrypted Client Hello.[3][4] ECH is not widely used yet, though Cloudflare is testing it on some of its servers.[5] With DNS over HTTPS/TLS and ECH, the entire process of connecting to an HTTPS site can be done without leaking the domain/subdomain name to the ISP. The only remaining parts exposed in plaintext are the remote IP address and port. [1] https://https.cio.gov/faq/#why-are-domain-names-unencrypted-over-https-today https://https.cio.gov/faq/#why-are-domain-names-unencrypted-... [2] https://www.cloudflare.com/learning/ssl/what-is-encrypted-sni/ https://www.cloudflare.com/learning/ssl/what-is-encrypted-sn... [3] https://blog.mozilla.org/security/2021/01/07/encrypted-client-hello-the-future-of-esni-in-firefox/ https://blog.mozilla.org/security/2021/01/07/encrypted-clien... [4] https://blog.cloudflare.com/encrypted-client-hello/ https://blog.cloudflare.com/encrypted-client-hello/ [5] https://blog.cloudflare.com/handshake-encryption-endgame-an-ech-update/ https://blog.cloudflare.com/handshake-encryption-endgame-an-...
  - wintermutestwin 5y ago
    >I would a thousand times over rather have my local ISP monitor DNS than Cloudflare. ISPs lobbied to be able to sell our data. Cloudflare claims that they don't. I trust neither, but I trust Cloudflare %1 more than my scummy ISP.
justsomehnguy 5y ago
It doesn't help what you can't find the list of those regions in FF KB. EDIT: I honestly tried to, though I'm on mobile ATM
- Ansil849 5y ago
  You're exactly right, the KB entry is infuriatingly vague about both the exact regions and the rationale for this.
tristor 5y ago
The alternative is that all of your DNS queries are monitorable by anyone who happens to share a network path or segment with you, because the default behavior of DNS is that it is unencrypted. DoH is a massive security and privacy improvement as a default, and you have many other options besides CloudFlare if you don’t want to use them. Personally I use NextDNS.

webmobdev 5y ago

The browser now includes ads based on your bookmarks and browsing history through Mozilla's "trusted" partners: > “When contextual suggestions are enabled, Firefox Suggest uses your city location and search keywords to make contextual suggestions from Firefox and our partners, while keeping your privacy in mind,” the support post reads. The “relevant suggestions” from “trusted partners” appear at the bottom of the usual search suggestions pulled from your bookmarks, browser history, and open tabs — a less intrusive version of a search ad, but technically still an ad. Source: https://www.theverge.com/2021/10/7/22715179/firefox-suggest-search-ads-browser https://www.theverge.com/2021/10/7/22715179/firefox-suggest-... (It's annoying that the mods unnecessarily removed my parent post that said Firefox is now an adware / spyware - I stand by it. Including ads and using and sharing users data is the definition of an adware / spyware.) For those who ask, why not just turn it off - remember that corporations only have to follow the law. They have no obligation to be ethically good. If your country has lax privacy laws, companies will exploit it because it is legal. Then there is the trust factor - Mozilla has lost a lot of goodwill in selfishly only focusing on making more money from its browser than listening to their users and creating a good browser. That's why it has been losing ground to Chrome, and will continue to do so as long as greed guides all its decisions and makes Firefox worse. You'd think uBlock Origin's popularity would already have given some insight to Firefox on how much people hate unwanted and intrusive ads, especially that try to mine our personal data.