News for hackers. Stuff that matters.
Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by jlgaddis on Thursday June 25, 2020 @02:53PM (#23644149)
> Actually not only does Comcast say they don't do that...

Just like they said they didn't forcibly reset BitTorrent connections (until they did).

Just like they said they didn't silently institute bandwidth caps (until they did).

Just like they said they didn't hijack NXDOMAIN responses (until they did).

Just like they said they didn't intercept plain-text HTTP connections and inject their own traffic into them (until they did).

---

With all due respect, I have personally had contracts with Comcast in the past and have experienced firsthand how well they honor those -- and I am certainly not the only one!

Surely you can understand why, to me and many others, their little agreement with Mozilla doesn't really mean a damn thing?

---

(I know that none of this is your fault and it's obviously nothing personal! I'm sure you're a smart, decent person but I'm also sure that you are well aware of your employer's reputation, their past "misdeeds", and, of course, the generally unfavorable opinion that many, many customers have of them.)

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by virtuallynathan on Thursday June 25, 2020 @06:06PM (#23646308)
After the NXDomain redirection stuff, they invested a ton in doing DNS right, deploying DNSSEC and Anycast. They are a major participant in the IETF, DNS OARC, and many other industry working groups, if you attend these things, go talk to the Comcast folks!

Their limited use of HTTP interception is a published RFC, and I've thought about ways to get around this, and for the use cases they use it for, it seems like the only viable option.

I knew a few of folks who were involved in the BT RST thing, the whole org learned a lot from that, and internal opinions changed.

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by tptacek on Friday June 26, 2020 @05:08PM (#23657070)
Why does it matter, at all, that Comcast documented their traffic interception system in an RFC?
Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by roblabla on Thursday June 25, 2020 @05:03PM (#23645675)
> With all due respect, I have personally had contracts with Comcast in the past and have experienced firsthand how well they honor those -- and I am certainly not the only one!

Consumer contracts? Because Mozilla having a business contract with Comcast is certainly not the same as you having a consumer contract - Mozilla has the resources to drag Comcast to court should they be found to ignore the agreement.

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by nerdponx on Thursday June 25, 2020 @05:29PM (#23645938)
This is a wildly bad take in my opinion.

Comcast has proven themselves to be uninterested in adhering to their contractual obligations. You bet your ass they are 1) figuring out how to work around their contract with Mozilla without attracting legal attention, and 2) making contingency plans for winning any resulting lawsuit.

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by wrkronmiller on Thursday June 25, 2020 @09:17PM (#23647752)
IANAL but I'm not even sure there would be a lawsuit, based on this policy document linked from the article: https://wiki.mozilla.org/Security/DOH-resolver-policy#Enforc...

It looks like the punishment for violating mozilla policies would simply be to remove Comcast from the trusted provider group...maybe. Not very impressive.

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by nvr219 on Thursday June 25, 2020 @09:16PM (#23647745)
> Mozilla has the resources to drag Comcast to court

They do not. Look at Mozilla's 1099 for proof.

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by muizelaar on Thursday June 25, 2020 @10:23PM (#23648066)
Mozilla took Verizon to court.
Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by partdavid on Thursday June 25, 2020 @11:31PM (#23648395)
Link? When was this? I'm only aware of Verizon suing Mozilla in 2017.
Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by muizelaar on Friday June 26, 2020 @08:36AM (#23651265)
Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by pbhjpbhj on Thursday June 25, 2020 @05:19PM (#23645819)
Where can we read the contract?
Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by wrkronmiller on Thursday June 25, 2020 @09:16PM (#23647740)
The policy linked by the article is here: https://wiki.mozilla.org/Security/DOH-resolver-policy#Enforc...
Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by pwdisswordfish2 on Thursday June 25, 2020 @10:18PM (#23648042)
This just leads to a wiki page listing two TRR's, where someone admits that whatever "privacy policies" TRR's provide are not "contracts". Then someone replies that "there are legal contracts between Mozilla and those two listed providers". That does not mean those contracts relate to protecting user privacy. If you dig, there will be nothing there. There is nothing in any contract to protect any user. Neither Mozilla nor TRR's are "on the hook" for protecting user privacy. What I mean by that is that if some user's privacy is breached, there is absolutely zero liability accruing to Mozilla or TRR's.

https://wiki.mozilla.org/index.php?title=User_talk:Wthayer&a...

You, the end-user, will not get to see Mozilla's contracts. Policies are not contracts.

There seems to be some common misunderstandings about "policies" and tech companies are exploiting them. There is nothing legally binding in a policy and in the case the company deviates from the policy, there is no way for an affected user to "enforce" the policy she thought was being adhered to. This is of course assuming anyone outside the company actually discovers that a policy is being violated. Usually policy violations are non-detectable from outside the company.

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by pwdisswordfish2 on Thursday June 25, 2020 @05:55PM (#23646222)
When pigs fly!

Can you imagine Mozilla CEO depleting her own compensation in order to sue a company the size of Comcast? What exactly are the claimed damages in this hypothetical lawsuit? The damages to Mozilla are _____ ? (This PR piece in Ars suggests the deal is solely to protect users. No financial details.) How about the damages suffered by users? (Whoops, they are not parties to the agreement.)

Quite the vivid imagination!

Maybe the "white knight" narrative really does work on some people.

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by smichel17 on Friday June 26, 2020 @07:04AM (#23650661)
Hypothetically, I imagine they'd sue for damage to their brand. Mozilla has been pushing Firefox as the privacy browser, and if Comcast were to break the deal it would hurt users' trust in Mozilla. I agree it is unclear what the consideration from each party is, though.
Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by pwdisswordfish2 on Friday June 26, 2020 @04:31PM (#23656656)
Comcast does not appear to be using the Mozilla brand. Am I missing something?
Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by smichel17 on Tuesday July 07, 2020 @11:32AM (#23760258)
"We, Mozilla, are a privacy-first company. Firefox is powered by DNS services that respect your privacy. You can trust that your browsing history is safe with us."

> "BREAKING: Firefox default DNS provider tracks what sites you visit"

^damage to reputation

Re:Comcast, Mozilla strike privacy deal to encrypt DNS looku... by bscphil on Thursday June 25, 2020 @09:38PM (#23647867)
On top of that, I'm totally mystified by what would cause this sudden change of heart from Comcast. Why do they want to provide this "service" to users, if they supposedly don't get anything out of it? If they're not profiting off the data, why not just let Firefox users connect to Cloudflare for DNS, as they're already doing to access 50% of the popular sites out there?

Why fight Mozilla to let them provide a service which is only going to cost them money to run?