Inside Firefox’s DNS-over-HTTPS engine

Re:Inside Firefox’s DNS-over-HTTPS engine by niftich on Sunday June 03, 2018 @09:50PM (#17223871)

Firefox's DOH client ignores /etc/hosts, but it shouldn't be too hard to host your own DOH server [1][2] that you could then configure how you see fit. I can see this pattern becoming widespread someday, and with DOH, people can re-use their experience in setting up webservers.

[1] https://github.com/st3fan/tinydoh [2] https://github.com/m13253/dns-over-https

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by peterwwillis on Sunday June 03, 2018 @11:06PM (#17224264)

You think regular end users having to set up and maintain server software in order to force a name for an IP is going to become a widespread pattern? That's horrifying. I don't want to live in that world.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by greglindahl on Sunday June 03, 2018 @11:40PM (#17224412)

Regular users today don't use that feature, so you're choosing a rather odd hill to die on.

To put this another way: it's a significant benefit for my random non-techie friends to be able to use this new feature plus HTTPSEverywhere. And even as a techie, I don't use a hosts file to block anything. So I'm not bothered by how Firefox chose to implement this, like most people.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by da_chicken on Sunday June 03, 2018 @11:56PM (#17224482)

There's plenty of ad blocking, spyware blocking, ransomware blocking, etc. software that absolutely uses the hosts file to blackhole requests. Much of it is free and intended for home computer use.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by notatoad on Monday June 04, 2018 @03:15AM (#17225312)

Regular users use a browser extension like ublock or Adblock to block ads. Not improving DNS security for the sake of a few users obscure Adblock mechanism would be pretty silly.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by da_chicken on Monday June 04, 2018 @12:19PM (#17229384)

Regular users also use Norton, McAfee, and other vendor Internet security suites. Some of those will also use the hosts file.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by caf on Monday June 04, 2018 @12:40AM (#17224708)

OK, but software like that can easily include an internal DOH proxy (or just turn off DOH in Firefox).

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by greglindahl on Monday June 04, 2018 @12:02AM (#17224508)

And what market share do they have? None of my non-techie relatives or friends who've asked me to look at their machines run that kind of software.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by mortenlarsen on Monday June 04, 2018 @12:27AM (#17224632)

Only the use case with the largest market share matters?

That kind of thinking, really irks me.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by greglindahl on Monday June 04, 2018 @12:29AM (#17224644)

No, I don't think like that.

It does bother me when Firefox introduces a feature which covers up a huge hole in TLS, and they get a large number of complaints on HN.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by vetinari on Monday June 04, 2018 @01:52AM (#17225006)

Of course it gets large number of complains, when it creates more problems than it solves, and it is papered over "but mainstream users do not need that".

Mainstream users do not need most software ever made.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by greglindahl on Monday June 04, 2018 @02:01AM (#17225038)

Did you see someone in this discussion suggesting "but mainstream users do not need that"? I just checked again and I don't see anyone making that suggestion.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by vetinari on Monday June 04, 2018 @05:29AM (#17226023)

It is paraphrased. The argument is, that it improves things for the mythical naive mainstream user, and for where it break things, well they are minority anyway.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by greglindahl on Monday June 04, 2018 @07:31PM (#17233605)

I didn't see anyone making that argument, either. Are you trying to summarize what I said? If so, that's not what I said. I'd love to have a discussion about these issues, but it's not going to happen if everyone's talking past each other, plus random downvotes.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by Immortalin on Monday June 04, 2018 @12:14AM (#17224558)

It's easier than ever to host a server transparently for end user software. You don't hear users complaining about node.js running in most Electron apps. A http server for DNS can easily be compiled to binary and ran like any other system daemon.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by toomuchtodo on Sunday June 03, 2018 @09:52PM (#17223888)

I think there’s great value in DOH caching servers running on home routers; all the benefits of DOH but “regular DNS” between clients and your home router.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by chupasaurus on Monday June 04, 2018 @04:14AM (#17225583)

Just run local dnscrypt-proxy (it supports DoH) on your machine/router and everything would be fine.

[ Parent | on HN ]

Re:Inside Firefox’s DNS-over-HTTPS engine by fanf2 on Monday June 04, 2018 @04:04AM (#17225539)

That [1] implements a very old draft so I doubt it is compatible with Firefox.

[ Parent | on HN ]