2 ms·

> browsers try to resolve a particular name with the system DNS and then turn of DoH if it resolves in a particular way I agree that's the wrong way to let DoH

> browsers try to resolve a particular name with the system DNS and then turn of DoH if it resolves in a particular way I agree that's the wrong way to let DoH be turned off, exactly for the reason you describe. It should only be possible for DoH to be disabled by, e.g., the local user manually going into settings or by Group Policy. > What you should have is a router, which hands itself out as the DNS server via DHCP The problem with that is that I don't trust the DHCP server of whatever network I'm on to not be trying to censor or surveil me.

AnthonyMouse 3y ago
> I agree that's the wrong way to let DoH be turned off, exactly for the reason you describe. It should only be possible for DoH to be disabled by, e.g., the local user manually going into settings or by Group Policy. DHCP is group policy for network configuration. If you're connecting to a network where you don't trust the DHCP server then don't use DHCP for DNS or use a VPN. > The problem with that is that I don't trust the DHCP server of whatever network I'm on to not be trying to censor or surveil me. The application default needs to be the system DNS and the device default needs to be DHCP so the device owner can feasibly change them. Then anyone for whom this doesn't work can change it merely by changing one system-wide setting, with the easiest way being to use a VPN and their DNS -- something that should be done on untrusted networks regardless.
- josephcsible 3y ago
  > DHCP is group policy for network configuration. The real Group Policy only affects computers that a local administrator explicitly joined to a domain. DHCP shouldn't have any such control since it's not trusted. > If you're connecting to a network where you don't trust the DHCP server then don't use DHCP for DNS But that's exactly what people are complaining that Firefox enabled. > The application default needs to be the system DNS and the device default needs to be DHCP so the device owner can feasibly change them. Once every common end-user OS has default-on DoH, then that would be better, but until then, I think individual programs using DoH on their own is a net benefit.
  - AnthonyMouse 3y ago
    > The real Group Policy only affects computers that a local administrator explicitly joined to a domain. DHCP shouldn't have any such control since it's not trusted. DHCP only affects computers that a local administrator configures to use DHCP. The fact that it's on by default is why turning it off is a defect -- when you want to change the DNS on all the computers on your LAN, you change the one the DHCP server gives out. If applications start ignoring this then there is no reasonable alternative way to do it. Consider that the reason you want it to be the default is the friction to users of changing the default. Now you see the problem if someone wants to change it from Cloudflare -- only now it's even worse if you remove DHCP as a way to change it. > But that's exactly what people are complaining that Firefox enabled. Because it's for the user to enable, and in particular to choose which DNS server to use instead, not Mozilla. > Once every common end-user OS has default-on DoH, then that would be better, but until then, I think individual programs using DoH on their own is a net benefit. What you need is for consumer routers to do this rather than Mozilla. Have them give out their own address as the DNS via DHCP and then support DoH themselves. The reason endpoint devices don't do this by default, and shouldn't, is where do they get the address of the DoH server to use, if not DHCP?
    - josephcsible 3y ago
      > DHCP only affects computers that a local administrator configures to use DHCP. The fact that it's on by default is why turning it off is a defect -- when you want to change the DNS on all the computers on your LAN, you change the one the DHCP server gives out. If applications start ignoring this then there is no other existing way to do it. With Group Policy, the computer's administrator chooses a specific domain to trust to receive policies from. With DHCP, whatever random network the computer connects to can send whatever settings it wants. This is why it's okay for Group Policy to control security-sensitive settings but not for DHCP to. Imagine if the coffee shop's DHCP server sent an option that meant "the client should open these ports in its firewall". Would you want your computer to respect that? > Because it's for the user to enable, and choose which DNS to use instead, not Mozilla. Why is DHCP-provided DNS okay being the default, but Mozilla-provided DNS not? The user didn't choose the former either. > What you need is for consumer routers to do this rather than Mozilla. Have them give out their own address as the DNS via DHCP and then support DoH themselves. The problem with the router doing it is that clients can't trust the router isn't owned by someone trying to spy on them. > The reason endpoint devices don't do this by default, and shouldn't, is where do they get the address of the DoH server to use, if not DHCP? From a hardcoded default, e.g., Cloudflare, Google, Mullvad, or Quad9. Consider how most computers have a hardcoded default list of NTP servers to use rather than relying on getting that from DHCP.

AnthonyMouse 3y ago

> I agree that's the wrong way to let DoH be turned off, exactly for the reason you describe. It should only be possible for DoH to be disabled by, e.g., the local user manually going into settings or by Group Policy. DHCP is group policy for network configuration. If you're connecting to a network where you don't trust the DHCP server then don't use DHCP for DNS or use a VPN. > The problem with that is that I don't trust the DHCP server of whatever network I'm on to not be trying to censor or surveil me. The application default needs to be the system DNS and the device default needs to be DHCP so the device owner can feasibly change them. Then anyone for whom this doesn't work can change it merely by changing one system-wide setting, with the easiest way being to use a VPN and their DNS -- something that should be done on untrusted networks regardless.

josephcsible 3y ago
> DHCP is group policy for network configuration. The real Group Policy only affects computers that a local administrator explicitly joined to a domain. DHCP shouldn't have any such control since it's not trusted. > If you're connecting to a network where you don't trust the DHCP server then don't use DHCP for DNS But that's exactly what people are complaining that Firefox enabled. > The application default needs to be the system DNS and the device default needs to be DHCP so the device owner can feasibly change them. Once every common end-user OS has default-on DoH, then that would be better, but until then, I think individual programs using DoH on their own is a net benefit.
- AnthonyMouse 3y ago
  > The real Group Policy only affects computers that a local administrator explicitly joined to a domain. DHCP shouldn't have any such control since it's not trusted. DHCP only affects computers that a local administrator configures to use DHCP. The fact that it's on by default is why turning it off is a defect -- when you want to change the DNS on all the computers on your LAN, you change the one the DHCP server gives out. If applications start ignoring this then there is no reasonable alternative way to do it. Consider that the reason you want it to be the default is the friction to users of changing the default. Now you see the problem if someone wants to change it from Cloudflare -- only now it's even worse if you remove DHCP as a way to change it. > But that's exactly what people are complaining that Firefox enabled. Because it's for the user to enable, and in particular to choose which DNS server to use instead, not Mozilla. > Once every common end-user OS has default-on DoH, then that would be better, but until then, I think individual programs using DoH on their own is a net benefit. What you need is for consumer routers to do this rather than Mozilla. Have them give out their own address as the DNS via DHCP and then support DoH themselves. The reason endpoint devices don't do this by default, and shouldn't, is where do they get the address of the DoH server to use, if not DHCP?
  - josephcsible 3y ago
    > DHCP only affects computers that a local administrator configures to use DHCP. The fact that it's on by default is why turning it off is a defect -- when you want to change the DNS on all the computers on your LAN, you change the one the DHCP server gives out. If applications start ignoring this then there is no other existing way to do it. With Group Policy, the computer's administrator chooses a specific domain to trust to receive policies from. With DHCP, whatever random network the computer connects to can send whatever settings it wants. This is why it's okay for Group Policy to control security-sensitive settings but not for DHCP to. Imagine if the coffee shop's DHCP server sent an option that meant "the client should open these ports in its firewall". Would you want your computer to respect that? > Because it's for the user to enable, and choose which DNS to use instead, not Mozilla. Why is DHCP-provided DNS okay being the default, but Mozilla-provided DNS not? The user didn't choose the former either. > What you need is for consumer routers to do this rather than Mozilla. Have them give out their own address as the DNS via DHCP and then support DoH themselves. The problem with the router doing it is that clients can't trust the router isn't owned by someone trying to spy on them. > The reason endpoint devices don't do this by default, and shouldn't, is where do they get the address of the DoH server to use, if not DHCP? From a hardcoded default, e.g., Cloudflare, Google, Mullvad, or Quad9. Consider how most computers have a hardcoded default list of NTP servers to use rather than relying on getting that from DHCP.