4 ms·

This is objectively a terrible decision. Technologically, politically, culturally. We had a very good design in DNS, and people are throwing it away because the

This is objectively a terrible decision. Technologically, politically, culturally. We had a very good design in DNS, and people are throwing it away because they're terrified about the potential that their ISP might use their data. Never mind that Netflix already does it to them when they watch TV, Target does it to them when they buy condoms at the store, Google does it with their mail and search results, ESPN does it to them when they play fantasy football, and Starbucks does it to them when they buy their venti mocha frap. But because Comcast might also know what they do in their private life, we should ditch one of the internet's most important protocols, and give all our data to Cloudflare, a central TCP-based US-owned DNS resolver. Nobody in the world needs DNS over HTTPS. If you actually need to hide your DNS requests, you have bigger problems that you need a real VPN for. This is a unilateral political decision by the people who have the most power over browsers because they have an emotional obsession with privacy, even if it makes technology in general worse.

klntsky 5y ago
I do not agree with you. DoH allows to bypass blocking of HTTPS websites by domain, which is done by a number of authoritarian regimes. > people are throwing it away It is not meant to replace DNS or make it impossible to work.
- rusk 5y ago
  Sounds like what I need is a VPN or Tor in these cases. To such regimes if FF provides a way to bypass their restrictions FF would end up being classed contraband similarly.
  - klntsky 5y ago
    Tor is actually worse in this regard. E.g in Russia public Tor bridges are blocked, so you can't connect to it without extra steps. Some public VPNs are blocked too. But DoH makes the price of blocking a single domain too high, for example, if Cloudflare were to use it, the only way would be to block every service that uses CF.
    - rusk 5y ago
      Okay, so I’m an oppressive state that has the wherewithal to block Tor but I’m not going to block DoH, because “the cost is too high” when I could previously mine DNS for free? I think I’d be blocking it and my citizens use a fork of FF that doesn’t force DoH.
      - josephcsible 5y ago
        You misunderstand what making the cost too high means. The goal is to make it so the only way to block DoH is to block all of Cloudflare and Google, and maybe eventually all of AWS and Azure too.
        rusk 5y ago
        No that’s what I understood you meant by cost alright, and notwithstanding many regimes being able to pay just that, it’s hardly the case that prohibiting the use of DOH you’re going to be blocking those sites.
  - LWIRVoltage 5y ago
    Perhaps, but the idea is to take the lead- and thus when all other browsers ,or most of them ,adopt this, that will be a little trickier to classify every browser in this manner. Overall, this will have an impact in the many regimes- and perhaps is one of the best methods of doing so. While it is still ...having faith in Cloudflare(one could audit them, but of course the question is how by-nature are they built to resist threats from APTs to the US gov coming knocking for info on Snowden or a similar person, looking for possibilities of compromise) - I think of the Ukraine Starlink situation- Overall, the Starlink terminals can be targeted by their signals, - but there's so many ,that Russia would need to do a massive ASAT campaign, or start spam detonating kiloton/megaton warheads in space to really try to disable Ukraine's ability to communicate even when all other networks get cut off, or isolated. And they mgiht be one of the very few capable of that type of escalation, but right now they're getting stymied by groups that are en - masse, accessing something that makes it harder to control, deny info, influence and crush them. Overall a net positive, but with drawbacks- but their overall situation and ability to choose how they want to operate is increased. VPNs and TOR are gaining popularity, but this covers those who wouldn't be able to use or figure out those for whatever reason, but who can use a web browser. I think i've seen the Cloudflare CEO around - i wonder if any cloudflare employees will comment on the risks i mentioned before(centralized source providing availability, US GOV deciding to take interest...) Firefox actually can solve this- by attempting to pursue deals with more than Cloudflare and NextDNS
- kuschku 5y ago
  > I do not agree with you. DoH allows to bypass blocking of HTTPS websites by domain, which is done by a number of authoritarian regimes. And by PiHole. Conspiracy theory I semi-seriously believe: DNS over HTTPS exists so Google Chromecasts can circumvent DNS based adblockers.
  - growse 5y ago
    If Google actually cared about this, why bother going through the faff of making and standardising a new protocol? You don't need a "DNS Standard" to be able to do name resolution between a client and a server you control. Just make up your own, pick a network transport (HTTPS works in most places!) and deploy it without telling anyone.
    - kuschku 5y ago
      Isn’t that how DNS over HTTPS started? As internal research project by Google, deployed on Chromecast before ever being standardized? From what I remember, the standardization happened after they used it to circumvent ad blockers. Before this, Chromecasts already hard-coded 8.8.8.8 regardless of what DHCP assigned.
      - eli 5y ago
        I don't follow what connection that has to Firefox. Seems like Google already comfortably solved their problem with Chromecast without needing a standard or anyone else to implement it.
        tempest_ 5y ago
        Like IBM patenting everything that any of their employees ever stumbled upon there is value to controlling and defining standards (both inside and outside of tech).
  - madeofpalk 5y ago
    PiHole could change to just run their own DoH server, no?
SkeuomorphicBee 5y ago
The big difference between malicious behaviour of the ISP vs malicious behaviour from all those example companies you mentioned is that I can choose not to use Netflix/Google/ESPN/..., while I can't choose ISP. So yes, I need DoH to protect me from my ISP (and no, full blown VPN is not an option, too many compromises).
mschuster91 5y ago
> We had a very good design in DNS, and people are throwing it away because they're terrified about the potential that their ISP might use their data It's more about censorship by governments. Even here in Europe, we have such censorship - against "terrorists", pirates and Russian propaganda. I don't object to censoring Russian propaganda and actual ISIS/AQ-style terrorists away, but censorship against pirates is just enforcement for the ultra-rich.
eli 5y ago
ISPs using DNS data isn't some purely academic concern and "well, there are lots of other privacy issues in the world too" is not a defense.
Barrin92 5y ago
This isn't emotional. People deal with censorship by their ISPs or absurd fines for petty piracy literally every day. It's actually more accurate to say that you have an emotional attachment to a particular internet architecture compared to the practical advantage that most people have if they have their traffic encrypted through an American company, which is a big step up from local ISP snooping in a large chunk of the world. It's also not a 'unilateral decision by people who have the most power', it's an optional offering by Firefox, a non-profit open source browser with less than 5% marketshare. You're making it sound like the Illuminati just came up with this
- thesuitonym 5y ago
  The thing is, DoH doesn't solve either of those problems. Your ISP can still censor your traffic unless you're using a VPN (in which case you don't need DoH to protect from your ISP), and ``piracy'' happens outside the browser, so again, unless you're using a VPN (in which case you don't need DoH to protect from your ISP--and even if you did, DoH in your browser won't do anything) you'll still have to deal with the absurd fines. And let's not forget, ISPs can just block known DoH hosts, and now that weird browser you were trying doesn't work anyway. Oh well, let's go back to the corporate backed spyware we're all familiar with. This is a Bad Idea, and has the potential to make Firefox unusable to exactly the people it's trying to protect.
  - cpncrunch 5y ago
    You cant ban cloudflare without blocking half the internet. Part of the problem is that many ISPs use Akamai for dns, and they have a broken malware filtering algorithm that causes a lot of false positives, resulting in sites being blocked for no reason, and there is no way to get whitelisted [1][2][3]. DoH has been a lifesaver for us. [1] https://community.spiceworks.com/topic/2331415-hosting-isp-dns-and-blacklisting-oh-my-help?page=1#entry-9420746 https://community.spiceworks.com/topic/2331415-hosting-isp-d... [2] https://webmasters.stackexchange.com/questions/120721/how-to-get-a-domain-unblocked-from-akamais-nominum https://webmasters.stackexchange.com/questions/120721/how-to... [3] https://community.akamai.com/customers/s/question/0D50f00005y5jGyCAI/problem-with-akamais-dga-suppobox-blacklist?language=en_US https://community.akamai.com/customers/s/question/0D50f00005...

klntsky 5y ago

I do not agree with you. DoH allows to bypass blocking of HTTPS websites by domain, which is done by a number of authoritarian regimes. > people are throwing it away It is not meant to replace DNS or make it impossible to work.

rusk 5y ago
Sounds like what I need is a VPN or Tor in these cases. To such regimes if FF provides a way to bypass their restrictions FF would end up being classed contraband similarly.
- klntsky 5y ago
  Tor is actually worse in this regard. E.g in Russia public Tor bridges are blocked, so you can't connect to it without extra steps. Some public VPNs are blocked too. But DoH makes the price of blocking a single domain too high, for example, if Cloudflare were to use it, the only way would be to block every service that uses CF.
  - rusk 5y ago
    Okay, so I’m an oppressive state that has the wherewithal to block Tor but I’m not going to block DoH, because “the cost is too high” when I could previously mine DNS for free? I think I’d be blocking it and my citizens use a fork of FF that doesn’t force DoH.
    - josephcsible 5y ago
      You misunderstand what making the cost too high means. The goal is to make it so the only way to block DoH is to block all of Cloudflare and Google, and maybe eventually all of AWS and Azure too.
      - rusk 5y ago
        No that’s what I understood you meant by cost alright, and notwithstanding many regimes being able to pay just that, it’s hardly the case that prohibiting the use of DOH you’re going to be blocking those sites.
- LWIRVoltage 5y ago
  Perhaps, but the idea is to take the lead- and thus when all other browsers ,or most of them ,adopt this, that will be a little trickier to classify every browser in this manner. Overall, this will have an impact in the many regimes- and perhaps is one of the best methods of doing so. While it is still ...having faith in Cloudflare(one could audit them, but of course the question is how by-nature are they built to resist threats from APTs to the US gov coming knocking for info on Snowden or a similar person, looking for possibilities of compromise) - I think of the Ukraine Starlink situation- Overall, the Starlink terminals can be targeted by their signals, - but there's so many ,that Russia would need to do a massive ASAT campaign, or start spam detonating kiloton/megaton warheads in space to really try to disable Ukraine's ability to communicate even when all other networks get cut off, or isolated. And they mgiht be one of the very few capable of that type of escalation, but right now they're getting stymied by groups that are en - masse, accessing something that makes it harder to control, deny info, influence and crush them. Overall a net positive, but with drawbacks- but their overall situation and ability to choose how they want to operate is increased. VPNs and TOR are gaining popularity, but this covers those who wouldn't be able to use or figure out those for whatever reason, but who can use a web browser. I think i've seen the Cloudflare CEO around - i wonder if any cloudflare employees will comment on the risks i mentioned before(centralized source providing availability, US GOV deciding to take interest...) Firefox actually can solve this- by attempting to pursue deals with more than Cloudflare and NextDNS
kuschku 5y ago
> I do not agree with you. DoH allows to bypass blocking of HTTPS websites by domain, which is done by a number of authoritarian regimes. And by PiHole. Conspiracy theory I semi-seriously believe: DNS over HTTPS exists so Google Chromecasts can circumvent DNS based adblockers.
- growse 5y ago
  If Google actually cared about this, why bother going through the faff of making and standardising a new protocol? You don't need a "DNS Standard" to be able to do name resolution between a client and a server you control. Just make up your own, pick a network transport (HTTPS works in most places!) and deploy it without telling anyone.
  - kuschku 5y ago
    Isn’t that how DNS over HTTPS started? As internal research project by Google, deployed on Chromecast before ever being standardized? From what I remember, the standardization happened after they used it to circumvent ad blockers. Before this, Chromecasts already hard-coded 8.8.8.8 regardless of what DHCP assigned.
    - eli 5y ago
      I don't follow what connection that has to Firefox. Seems like Google already comfortably solved their problem with Chromecast without needing a standard or anyone else to implement it.
      - tempest_ 5y ago
        Like IBM patenting everything that any of their employees ever stumbled upon there is value to controlling and defining standards (both inside and outside of tech).
- madeofpalk 5y ago
  PiHole could change to just run their own DoH server, no?

SkeuomorphicBee 5y ago

The big difference between malicious behaviour of the ISP vs malicious behaviour from all those example companies you mentioned is that I can choose not to use Netflix/Google/ESPN/..., while I can't choose ISP. So yes, I need DoH to protect me from my ISP (and no, full blown VPN is not an option, too many compromises).

mschuster91 5y ago

> We had a very good design in DNS, and people are throwing it away because they're terrified about the potential that their ISP might use their data It's more about censorship by governments. Even here in Europe, we have such censorship - against "terrorists", pirates and Russian propaganda. I don't object to censoring Russian propaganda and actual ISIS/AQ-style terrorists away, but censorship against pirates is just enforcement for the ultra-rich.

eli 5y ago

ISPs using DNS data isn't some purely academic concern and "well, there are lots of other privacy issues in the world too" is not a defense.

Barrin92 5y ago

This isn't emotional. People deal with censorship by their ISPs or absurd fines for petty piracy literally every day. It's actually more accurate to say that you have an emotional attachment to a particular internet architecture compared to the practical advantage that most people have if they have their traffic encrypted through an American company, which is a big step up from local ISP snooping in a large chunk of the world. It's also not a 'unilateral decision by people who have the most power', it's an optional offering by Firefox, a non-profit open source browser with less than 5% marketshare. You're making it sound like the Illuminati just came up with this

thesuitonym 5y ago
The thing is, DoH doesn't solve either of those problems. Your ISP can still censor your traffic unless you're using a VPN (in which case you don't need DoH to protect from your ISP), and ``piracy'' happens outside the browser, so again, unless you're using a VPN (in which case you don't need DoH to protect from your ISP--and even if you did, DoH in your browser won't do anything) you'll still have to deal with the absurd fines. And let's not forget, ISPs can just block known DoH hosts, and now that weird browser you were trying doesn't work anyway. Oh well, let's go back to the corporate backed spyware we're all familiar with. This is a Bad Idea, and has the potential to make Firefox unusable to exactly the people it's trying to protect.
- cpncrunch 5y ago
  You cant ban cloudflare without blocking half the internet. Part of the problem is that many ISPs use Akamai for dns, and they have a broken malware filtering algorithm that causes a lot of false positives, resulting in sites being blocked for no reason, and there is no way to get whitelisted [1][2][3]. DoH has been a lifesaver for us. [1] https://community.spiceworks.com/topic/2331415-hosting-isp-dns-and-blacklisting-oh-my-help?page=1#entry-9420746 https://community.spiceworks.com/topic/2331415-hosting-isp-d... [2] https://webmasters.stackexchange.com/questions/120721/how-to-get-a-domain-unblocked-from-akamais-nominum https://webmasters.stackexchange.com/questions/120721/how-to... [3] https://community.akamai.com/customers/s/question/0D50f00005y5jGyCAI/problem-with-akamais-dga-suppobox-blacklist?language=en_US https://community.akamai.com/customers/s/question/0D50f00005...