You could block your guest's VPN connections, but you don't do that.. why not? Aren't they subverting your protection by using VPNs?
> nor would I subject them to centralized DNS. Both are equally dangerous in my view.
I would argue that large providers like Cloudflare are the only ones who realistically have the resources to stand up to threats like government intervention (where it is possible). They have strong legal and financial incentives to maintain their privacy guarantees which smaller providers don't have.
Also you have the advantage of your data "hiding in plain sight" due to the high volume they deal with.
I certainly wish there were more providers available than just Cloudflare and Google though.
For my technical friends, that would be true. They can adjust their settings and be on their way. I won't block their choices aside from intercepting requests to the ISP DNS.
Most of my friends are not technical, have no idea how to tweak the settings in their browser and would not know they even need to care. So I think it is fair to say that a choice is being taken away. It isn't like browsers are going to prompt people and explain what is occurring. The masses will experience centralized DNS without any idea this is happening. I think we will fundamentally disagree here.
You could block your guest's VPN connections, but you don't do that.. why not?
My guests can choose to use a VPN if they wish, I would not take that choice away. That is an intentional move to protect their traffic. DoH is not an intentional choice. They did not choose this. If a technical friend chooses a DoH server, their laptop won't work and I will explain, if I had not already, that DoH servers are blocked. Anyone that knows me, would expect this behavior. Anyone that is my friend would accept this. We probably just have very different circles of friends.
Although if the only concern is that Firefox defaults to a poor choice (in your opinion), why not just block Firefox's default specifically? Why other public DoH servers too? Or why not just block the Firefox DoH canary domain which prevents it from defaulting to DoH unless the user specifically turns it on?
At work, we already control these settings in the browser and can easily control any future settings in the OS so it is not an issue there.