I agree that's the wrong way to let DoH be turned off, exactly for the reason you describe. It should only be possible for DoH to be disabled by, e.g., the local user manually going into settings or by Group Policy.
> What you should have is a router, which hands itself out as the DNS server via DHCP
The problem with that is that I don't trust the DHCP server of whatever network I'm on to not be trying to censor or surveil me.
DHCP is group policy for network configuration. If you're connecting to a network where you don't trust the DHCP server then don't use DHCP for DNS or use a VPN.
> The problem with that is that I don't trust the DHCP server of whatever network I'm on to not be trying to censor or surveil me.
The application default needs to be the system DNS and the device default needs to be DHCP so the device owner can feasibly change them. Then anyone for whom this doesn't work can change it merely by changing one system-wide setting, with the easiest way being to use a VPN and their DNS -- something that should be done on untrusted networks regardless.
The real Group Policy only affects computers that a local administrator explicitly joined to a domain. DHCP shouldn't have any such control since it's not trusted.
> If you're connecting to a network where you don't trust the DHCP server then don't use DHCP for DNS
But that's exactly what people are complaining that Firefox enabled.
> The application default needs to be the system DNS and the device default needs to be DHCP so the device owner can feasibly change them.
Once every common end-user OS has default-on DoH, then that would be better, but until then, I think individual programs using DoH on their own is a net benefit.
DHCP only affects computers that a local administrator configures to use DHCP. The fact that it's on by default is why turning it off is a defect -- when you want to change the DNS on all the computers on your LAN, you change the one the DHCP server gives out. If applications start ignoring this then there is no reasonable alternative way to do it.
Consider that the reason you want it to be the default is the friction to users of changing the default. Now you see the problem if someone wants to change it from Cloudflare -- only now it's even worse if you remove DHCP as a way to change it.
> But that's exactly what people are complaining that Firefox enabled.
Because it's for the user to enable, and in particular to choose which DNS server to use instead, not Mozilla.
> Once every common end-user OS has default-on DoH, then that would be better, but until then, I think individual programs using DoH on their own is a net benefit.
What you need is for consumer routers to do this rather than Mozilla. Have them give out their own address as the DNS via DHCP and then support DoH themselves.
The reason endpoint devices don't do this by default, and shouldn't, is where do they get the address of the DoH server to use, if not DHCP?
With Group Policy, the computer's administrator chooses a specific domain to trust to receive policies from. With DHCP, whatever random network the computer connects to can send whatever settings it wants. This is why it's okay for Group Policy to control security-sensitive settings but not for DHCP to. Imagine if the coffee shop's DHCP server sent an option that meant "the client should open these ports in its firewall". Would you want your computer to respect that?
> Because it's for the user to enable, and choose which DNS to use instead, not Mozilla.
Why is DHCP-provided DNS okay being the default, but Mozilla-provided DNS not? The user didn't choose the former either.
> What you need is for consumer routers to do this rather than Mozilla. Have them give out their own address as the DNS via DHCP and then support DoH themselves.
The problem with the router doing it is that clients can't trust the router isn't owned by someone trying to spy on them.
> The reason endpoint devices don't do this by default, and shouldn't, is where do they get the address of the DoH server to use, if not DHCP?
From a hardcoded default, e.g., Cloudflare, Google, Mullvad, or Quad9. Consider how most computers have a hardcoded default list of NTP servers to use rather than relying on getting that from DHCP.
Computers don't connect to random networks. The user chooses to, and has the ability to not use the DNS from DHCP for any given network.
> Imagine if the coffee shop's DHCP server sent an option that meant "the client should open these ports in its firewall". Would you want your computer to respect that?
It already does this. The client gets its gateway via DHCP, which is not only the device that typically firewalls local networks from the rest of the internet, it's the device that can see and modify all of your traffic.
> Why is DHCP-provided DNS okay being the default, but Mozilla-provided DNS not? The user didn't choose the former either.
Because of what is necessary to change it. There has to be some default, but it should be possible for the user to change it all in one place for their entire LAN or device.
> The problem with the router doing it is that clients can't trust the router isn't owned by someone trying to spy on them.
They certainly can when it's their own router, and they can manually configure a DNS server of their choosing when it isn't.
Meanwhile, how can the user trust that Cloudflare isn't trying to spy on them?
> From a hardcoded default, e.g., Cloudflare, Google, Mullvad, or Quad9. Consider how most computers have a hardcoded default list of NTP servers to use rather than relying on getting that from DHCP.
NTP servers see that your computer wants to know what time it is. DNS servers see all kinds of privacy-sensitive information, so centralizing this in any way is inherently dangerous and so is making it more difficult for the user to change the default.
What you need for this is some kind of encrypted DNS. What you don't need is for it to be implemented in the way DoH commonly does it.
What you should have is a router, which hands itself out as the DNS server via DHCP, takes the client's plaintext DNS request and does an encrypted query -- ideally directly to the authoritative servers for that domain, but at least to something of your choosing. Or, you configure your device to do this itself for every application using the system DNS. These all work fine, because the device owner can reasonably change them -- you configure it in one place for every application or your whole LAN at once.
The problem with DoH is that it puts it into each individual application, and then its infeasible for the device owner to change it because it's a million settings in a million places and some applications don't support changing it at all. Worse, you get evil applications where the endpoint device is the thing controlled by Evil Corp and the local network is the thing the device owner is using to block spyware. At which point "the network" needs to be able to block this or malware and evil IoS garbage can operate with impunity.
The claimed workaround is that browsers try to resolve a particular name with the system DNS and then turn of DoH if it resolves in a particular way, but now you're back to this:
> It's a case of "can't, because even if you change the setting, $evil_isp will hijack the queries anyway".
Because then $evil_isp can just resolve that name in that way to go back to doing the MITM. At which point you've lost any benefit of the device doing this against a truly malicious ISP, or it becomes an excuse to remove this "feature" and then the device owner can't do it either.
This is the wrong way to do it.