Comcast, Mozilla strike privacy deal to encrypt DNS lookups in Firefox

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by tssva on Thursday June 25, 2020 @10:46AM (#23641349)

Not forwarding EDNS client subnet is a requirement for Mozilla TRR partners. NextDNS also doesn't forward EDNS subnet client since it is a partner and soon Comcast will be joining that list. Although not currently a member of the program Quad9 also by default doesn't forward EDNS subnet info.

[ Parent | on HN ]

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by rydre on Thursday June 25, 2020 @11:05AM (#23641562)

I host my name server's myself. If Mozilla is really doing this, they're misguided. All this does is make it impossible to serve requests from nearest webserver. You are getting the ip address anyways, so why do this? This means if I get someone from netherlands I'd have to redirect their requests from www.example.com to nl.example.com or buy an ipv4 block, set up anycast and then serve from the closest ipaddress/server. The end result is same. I'll always get the end user's ip address unless they use a VPN or something.

This is a stupid decision by Mozilla. Too bad Firefox users when visiting websites making their own CDN's without anycast/country level redirects will see much slower sites.

[ Parent | on HN ]

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by presumably on Thursday June 25, 2020 @11:54AM (#23642080)

What you're claiming is false.

Cloudflare has over 200 PoPs; in your own name servers, you can use the Cloudflare Resolver's IP (which will be a "close to the user" IP, not 1.1.1.1) to do geotargeting and serve from your closest IP address/server.

[ Parent | on HN ]

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by rydre on Thursday June 25, 2020 @12:23PM (#23642417)

>What you're claiming is false. Cloudflare has over 200 PoPs; in your own name servers, you can use the Cloudflare Resolver's IP (which will be a "close to the user" IP, not 1.1.1.1) to do geotargeting and serve from your closest IP address/server.

What if my server is closer than cloudflare? Why is cloudflare artificially limiting?

[ Parent | on HN ]

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by willcipriano on Thursday June 25, 2020 @02:04PM (#23643612)

I use cloudflare precisely because I don't want clients hitting the server directly. That's its entire purpose. For both caching and anti-ddos reasons.

[ Parent | on HN ]

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by sprayk on Thursday June 25, 2020 @05:48PM (#23646161)

rydre is specifically talking about the perspective of someone running a non-cloudflare CDN or possibly a site that does their own CDN with DNS rather than anycast because they explicitly don't want to use cloudflare for whatever reason. They are not talking about someone just hosting a site.

[ Parent | on HN ]

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by ViViDboarder on Thursday June 25, 2020 @12:29PM (#23642469)

You will always get the IP because you host the nameserver and the web server. In many cases, the nameserver is hosted by a third party. Doesn’t what Mozilla and Cloudflare have done prevent the nameserver from receiving the originating IP, thus preventing large nameservers from generating user traffic histories? This is an honest question. I’m not fully familiar with the process of running a nameserver.

[ Parent | on HN ]