Cloudflare has a legally binding contract with Mozilla to this effect. So you’ve traded up from a number of companies that have never promised to not sniff or tamper with your traffic (and often do, and don’t really have any positive brand image to protect) up to a single company that has a legal commitment not to tamper with your traffic (and has some form of brand image to protect). I too, would prefer if DoH had more technical features to prevent sniffing/tampering, but this is an upgrade.

See, IMHO a "binding contract" isn't worth the paper it's written on if violations of the contract are undetectable. There's no brand image impact if there's no evidence.

And if I was an intelligence agency trying place spies, Cloudflare would be among the first tech companies I'd target.

This feature seems almost exclusively a feature for people in the ISP-monopoly-friendly United States.

>And if I was an intelligence agency trying place spies, Cloudflare would be among the first tech companies I'd target.

This seems like a threat model swap in the conversation. The subject threat model here is (1) defending against companies stealing and selling my data. You swapped in the threat of (2) state level agencies spying on you through these companies.

The problem is that #2 seems to be an intractable problem. (but not so much because of an infiltrated DNS provider, more like cable taps and infiltrated hardware manufacturers)

#1 seems to be a more solvable problem (albeit at increasing levels of complexity). When you bring #2 into the conversation, it defocuses on the solution to #1 and gets to a point where we all throw up our hands and admit helplessness and defeat.

I see this happen often and I think every conversation should be clearly grounded in the threat model that is being addressed.

In some countries ISPs work closely with the government and block certain websites the government asks them to etc. In these cases I would trust cloudflare over my ISP

In some countries (USA) tech companies (Cloudflare) work closely with the government (see Snowdon revelations). I trust my ISP, which I chose, more than a foreign company (Cloudflare).

^ This is what I don't get..

Everyday people who are worried about state-actor threats - an incredibly targeted and unlikely scenario for the average person - but are less concerned about their personal information being harvested for marketing purposes - something that happens all the time to everyone.

> Everyday people who are worried about state-actor threats - an incredibly targeted and unlikely scenario for the average person -

I agree with you that people should be more worried about companies collecting their personal info, but we know now that the state collecting your data isn't incredibly targeted or at all unlikely. They just take everything. It's happening to every last one of us every single day. It's been going on for decades.

https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Russ_Tice

And i don't get how one would think that I, as a European, would want an overseas company to handle my data. If my ISP is breaching GDPR, all i have to do is to go to data protection agency (at least i have that option on the table), good luck doing that with an overseas company... I have zero indications that my ISP is selling data for marketing purposes (unlike some US ISPs which even inject ads).

Because if the situation is reversed and e.g. the local police subpoenas your ISP to find people that are "illegally torrenting" or whatever they won't include you. That's happened a lot within Europe.

Even if the foreign government spies more nether jurisdiction is likely to care enough about you specifically to make an international case of it.

In other words I'd think most Americans would be better off proxying through Europe, and most Europeans would be better off proxying through the US.

Even better would be to proxy through a third country that your own country is unlikely to cooperate with, and which won't care about you personally.

E.g. I wouldn't want to live in Iran or North Korea, but I'd think proxying DNS through them would in some way maximize my privacy if I was living in Europe or the US.

I'll never travel to either of them, and my authorities are vanishingly unlikely to cooperate with either of them for anything short of murder.

Except proxying through Iran or North Korea literally puts a target on you locally. Not really the brightest idea. As for other things - it is not black or white, depends where you are and from that you choose the best option for you. The "copyright" cartels are mostly American so it kinda does not even make sense to use US in order to avoid that, just makes it easier for them.