Actually not only does Comcast say they don't do that (https://www.xfinity.com/privacy/policy/dns) but now has signed a contract to this effect as well, thereby meeting the same level of commitment as the other TRR operators. This means IMO that Mozilla is doing a good job leading the industry on DNS privacy and convincing many of the merits of a strong pro-privacy philosophy.
(disclosure: I work for Comcast and have been working on encrypted DNS)
Just like they said they didn't forcibly reset BitTorrent connections (until they did).
Just like they said they didn't silently institute bandwidth caps (until they did).
Just like they said they didn't hijack NXDOMAIN responses (until they did).
Just like they said they didn't intercept plain-text HTTP connections and inject their own traffic into them (until they did).
---
With all due respect, I have personally had contracts with Comcast in the past and have experienced firsthand how well they honor those -- and I am certainly not the only one!
Surely you can understand why, to me and many others, their little agreement with Mozilla doesn't really mean a damn thing?
---
(I know that none of this is your fault and it's obviously nothing personal! I'm sure you're a smart, decent person but I'm also sure that you are well aware of your employer's reputation, their past "misdeeds", and, of course, the generally unfavorable opinion that many, many customers have of them.)
Their limited use of HTTP interception is a published RFC, and I've thought about ways to get around this, and for the use cases they use it for, it seems like the only viable option.
I knew a few of folks who were involved in the BT RST thing, the whole org learned a lot from that, and internal opinions changed.
Consumer contracts? Because Mozilla having a business contract with Comcast is certainly not the same as you having a consumer contract - Mozilla has the resources to drag Comcast to court should they be found to ignore the agreement.
Comcast has proven themselves to be uninterested in adhering to their contractual obligations. You bet your ass they are 1) figuring out how to work around their contract with Mozilla without attracting legal attention, and 2) making contingency plans for winning any resulting lawsuit.
It looks like the punishment for violating mozilla policies would simply be to remove Comcast from the trusted provider group...maybe. Not very impressive.
They do not. Look at Mozilla's 1099 for proof.
https://wiki.mozilla.org/index.php?title=User_talk:Wthayer&a...
You, the end-user, will not get to see Mozilla's contracts. Policies are not contracts.
There seems to be some common misunderstandings about "policies" and tech companies are exploiting them. There is nothing legally binding in a policy and in the case the company deviates from the policy, there is no way for an affected user to "enforce" the policy she thought was being adhered to. This is of course assuming anyone outside the company actually discovers that a policy is being violated. Usually policy violations are non-detectable from outside the company.
Can you imagine Mozilla CEO depleting her own compensation in order to sue a company the size of Comcast? What exactly are the claimed damages in this hypothetical lawsuit? The damages to Mozilla are _____ ? (This PR piece in Ars suggests the deal is solely to protect users. No financial details.) How about the damages suffered by users? (Whoops, they are not parties to the agreement.)
Quite the vivid imagination!
Maybe the "white knight" narrative really does work on some people.
> "BREAKING: Firefox default DNS provider tracks what sites you visit"
^damage to reputation
Why fight Mozilla to let them provide a service which is only going to cost them money to run?
Your employer actively and repeatedly abuses the privacy and trust of its customers. It also lobbies for damaging policies.
I do not trust Comcast. Firefox associating itself with Comcast makes me trust Firefox significantly less.
[1] https://oag.ca.gov/news/press-releases/attorney-general-kama...
[2] https://www.king5.com/article/news/local/comcast-fined-9-mil...
[3] https://consumerist.com/2016/04/01/comcast-says-fcc-privacy-...
To be sure, jlivingood isn't just some enterprise grunt with an opinion, but VP of Technology Policy & Standards.
Compare the username to the "Vice President, Technology Policy and Standards at Comcast Cable" in this blog post.
To save people the click.
User name in question: jlivingood
> Jason Livingood, Vice President, Technology Policy and Standards at Comcast Cable.
Some things that make me trust this claim:
- That privacy policy
- That contract
- Association with trustworthy brands like Mozilla
- Work on encrypted DNS
- Consumer trust could theoretically be financially valuable to them
- Basic morals of Comcast employees
Some things that make me distrust it:
- Cultivated an infamous litany of consumer abuses
- Lobbied for regulations to harm consumers
- Engaged in regulatory capture with the FTC/FCC
- Have continually profited from their abusive business practices, and continue to profit in spite of atrocious levels of consumer trust
I believe that Comcast only wants to respect user privacy insofar as it helps them maintain a facade of trustworthiness and retain customers. If they ever get the opportunity to back out of that privacy-conscious posturing and turn it into money, I think history has proven that the winner of those two internal groups is clearly going to be the money side not the moral side.
I appreciate your comment as you clearly and accurately frame that good people work there, Comcast earned its reputation with its actions, and that there may be competing interests / morals at play.
I can’t predict the future to say what wins out, but I feel like there are competing interests at play internal to the org. There are the business/markets, and then there is technology, products and experience pieces too.
an aside: I am somewhat disappointed to see a HN thread so populated with groupthink “Comcast is bad!” I’d expect that on theVerge comment board or YouTube comments. sigh
Anyways, I hear that the wake up call was probably about the time that the time warner merger fell through. I haven’t worked for them that long. It takes time to shift an org as large as Comcast to come to terms with the public’s resentment. I can say that, in my experience on the inside, the fundamental attitudes are very consumer friendly. I’m on the tech/product side of the house and we just want to make great stuff. Reliable, scalable entertainment and home automation kind of things, ya know? Comcast strives to be an admired company. So yeah, guess its work is cut out for it! Everything is designed today with accessibility and privacy at the outset. There’s a massive amount of truly brilliant engineers, developers, QA folks etc. working there. Not saying your distrust in Comcast wasn’t earned, however I believe conditions are not what they once were, thus some negative sentiments may be outdated today.
> I am somewhat disappointed to see a HN thread so populated with groupthink “Comcast is bad!”.
What I see in many comments is specific reference to cases where Comcast betrayed the public's trust. You can call it groupthink, but I get the impression the bad rep is well-earned.
Trust leaves on horseback, and comes back on foot. More work to do to convince those who doubt you. Happy to hear you are working on that.
Is this really surprising? You do go on to acknowledge the “public resentment.” In the tech industry—HN’s specialty—Comcast certainly seems to be widely regarded as an evil beast with no conscience.
That’s an entirely anecdotal observation, but many of the comments in this HN thread are not: they frequently link to evidence, while Comcast employees chime in to say, “internally, it’s not like that anymore.” It’s great to hear that’s what it looks like on the inside, but given Comcast’s history and HN’s general skepticism, that’s going to be a hard sell without solid evidence.
I personally was impacted by this behavior after having my internet service deactivated due to going over bandwidth caps (which reportedly didn't yet exist) and it was one of the most Kafka-esque corporate experiences in my life. My internet was being deactivated because I violated a policy which they repeatedly stated didn't exist. Several months later those caps actually became policy.
I ask this with all sincerity: why should we believe Comcast?
It's a weird way to phrase "I work on this, we don't capture any information about customers site visits" or "I work on this we don't capture any information about domain lookups" or whatever.
When a customer gets a contract with Comcast are you saying the contract includes that Comcast will not filter/log their domain lookups in any way?
To others: what's the penalty of they breech that contract? Do they actual have anything at risk?
In UK ISPs couldn't make such a contract as the gov obliges DNS filtering of some domains, AIUI.
1. The deal major "as seen on TV" ISPs struck was that they would offer a configurable child protection style filtering to their users. Mozilla permits users to opt in to filtering, you just aren't allowed to filter by default, so an ISP provided DoH server which can be configured explicitly to filter would meet this requirement. NextDNS offers this, yet is in Mozilla's programme. If you just pick NextDNS from the drop-down in Firefox you get no filtering, if you sign up and pay them (or take the free offer) you get filtering of your choice, and DoH, with instructions on how to tell your Firefox about this (basically paste a per-user URL into a preferences window, the nice thing about DoH compared to plain DNS or even DoT is that in a URL your user identifier will be encrypted, improving privacy)
2. The government did not legislate a requirement. They've been burned before on the difference between public appeals to think of the children (generally broadly accepted by the populace, no legal fallout) and censorship laws (likely to be destroyed in the courts because it turns out people don't like being told what to read). All those famous ISPs chose to voluntarily censor the Internet (mustn't let kids see porn) and then since they had the capability to censor courts told them to also obey Hollywood's instructions (no Pirate Bay either).
A small ISP like Andrews & Arnold isn't censored. During sign-up it says "Do you need child friendly filtering as part of this product?" or something. If you click "Yes" it says sorry they don't want you as a customer, good bye and the sign-up process is over.
I'd heard A&A were an outlier here but didn't know they actively stopped users from choosing their service if they want filtering. That seems weirdly fascist: like a supermarket that won't let you choose not to have Coca Cola on your shopping list, if you don't want it you have to actively remove it yourself.
Porn, yes to some extent, but super-violence, torture, malware, gambling, prostitution, ... these are all things I choose to attempt not to pipe in to my home via OpenDNS/pihole/uBlock/direct instruction to local users!
I would suggest instead that demanding other people figure out whatever weird quirks you have and then cater to them under the guise of being "child friendly" is at best weirdly fascist.
And it seems you at least reluctantly agree this that can't work even if you wish A&A would try to do it anyway, since all the systems you listed involve you explicitly configuring what you want blocked, allowing you to take responsibility for the inevitable under/overblocking. This approach works fine† with A&A since it doesn't ask anything of them.
† Well, as "fine" as can be expected, no worse than at other providers.
I would say this Mozilla changing the overall ecosystem for the better.
Additionally, I think it's safe to say that Comcast has years and years of experience in finding "loopholes" and/or other "workarounds" in its agreements.
> I would say this Mozilla changing the overall ecosystem for the better.
You obviously have much more faith in Comcast than I do. Let's hope you're right.
So long as the penalty is less than the value they derive from violating the agreement, they will abuse it.
- NBC
- Telemundo
- USA Network
- SyFy
- Universal Pictures
- Sky Group
And the fact that Comcast doesn’t allow users to change the DNS settings of xfinity routers leads me to believe they have some monetary incentive to go in and disable that functionality in their equipment.
Mozilla is a company and needs to compensate its CEO and staff. The CEO received $2,458,350 in 2018.^1 Everything Mozilla does cannot be solely for users' benefit. Mozilla, the people behind it, have their own financial interests.
1. https://assets.mozilla.net/annualreport/2018/mozilla-2018-fo...
what if the are your dns server?
Mozilla introduce a privacy feature in a free, open-source browser. Comcast bitches about it because it prevents them from doing shenanigans, essentially incriminating themselves and proving that the feature is both working as expected and necessary.
Why does Mozilla need to care about Comcast's opinion on this, and try to work out an "agreement" with them? It's equivalent to antivirus software actually working, and then the antivirus developer does a deal with the virus makers because the antivirus is actually effective and the virus makers are complaining.
I am really disappointed in Mozilla's recent features, poor focus and nonsensical management.
Money.
Those who don't are subjected to the whims of either the foundation or corproation of Mozilla.
Because Comcast has Washington in its pocket?
If it's anything like their CloudFlare deals, then Mozilla did this because they were able to secure contracts that provide additional privacy protections for Mozilla's customers that the parent company doesn't normally provide to end-users.
In theory, those contracts should be enforceable in court. Whether or not you think the companies Mozilla contracts with will find ways to snoop on the private data anyway is a different story.
Good point, CloudFlare have earned a good reputation, but a monoculture is still something to avoid.
Who would be your ideal DNS provider? Perhaps someone like the EFF? FSF? Mozilla themselves?
Certifying an ISP that ran a NXDOMAIN hijack scheme while no doubt also selling DNS data for DoH is beyond the pale.
They could (and can) do that regardless of DNS. Most websites and other services are uniquely identifiable by their IP(-range).
Encrypted SNI is still a draft so not applicable here.
You are very correct about that:
"What can you learn from an IP?" https://irtf.org/anrw/2019/slides-anrw19-final44.pdf
Basically Encrypted Client Hello (the new name for eSNI) and DoH/DoT are only useful for websites hosted on global CDN providers like Akamai, Cloudflare and so on.
> Comcast's version of DNS over HTTPS (DoH) will be turned on by default for Firefox users on Comcast's broadband network
> Comcast is the first ISP to join Firefox's Trusted Recursive Resolver (TRR) program
> Cloudflare and NextDNS were already in Mozilla's program
> which requires encrypted-DNS providers to meet privacy and transparency criteria and pledge not to block or filter domains by default
I believe Firefox must not turn on Comcast's DoH as default even for Comcast ISP users. They ought to show some kind of first time prompt.
If I’m going to use a spyware browser, I may as well use Chrome, because it’s way more secure thanks to Google’s industry-leading security team.
Mozilla needs to fix the internal incentives that lead to this situation.
* Comcast sniffs / records / tracks their user's DNS traffic
* Mozilla announced they would enable DoH by default, to protect end user's DNS data from shady ISPs like Comcast
* Comcast then raised hell about Mozilla's decision (presumably because they would no longer have access to this data)
* Now, Comcast and Mozilla come to some sort of agreement which effectively restores Comcast's access to their customer's DNS traffic?
---
I'm really confused why Mozilla would agree to this. I really hope this isn't one of the ways they're exploring to "diversify" their revenue streams but, in the last few years, Mozilla has made a lot of decisions that I don't agree with so I suppose I really wouldn't be all that surprised.