DOH on by default now on Firefox

[He Who Points And Laughs]

Mozilla enables DOH by default for all Firefox users in the US || Archive

Mozilla announced plans today to enable DNS-over-HTTPS (DoH) support for all Firefox users in the US.

DoH is DNS over HTTPS. It is improved privacy, so of course ISPs and "LAW ENFORCEMENT" don't like it.

 

[George Orson Welles]

Holy shit, I didn't know they were finally pushing this after how many issues caused by it in the UK?
EDIT: I'm an idiot and just realized it's been in development for approx. 2 years.

 

[byuu]

DoH is shit.
It makes the internet more centralized because now Firefox makes everyone use Cloudflare's server to resolve DNS requests instead of their respective ISPs (or alternate ones like OpenDNS).

It's also an overcomplicated protocol for webshits (JSON encoded data over an HTTPS connection).
DoT encrypts DNS requests too but doesn't require you to implement a HTTPS server and JSON parser to do so.

 

[George Orson Welles]

DoH is shit.
It makes the internet more centralized because now Firefox makes everyone use Cloudflare's server to resolve DNS requests instead of their respective ISPs (or alternate ones like OpenDNS).

It's also an overcomplicated protocol for webshits (JSON encoded data over an HTTPS connection).
DoT encrypts DNS requests too but doesn't require you to implement a HTTPS server and JSON parser to do so.

I mean, they also allow you to use NextDNS which is better than Cloudflare by a long shot, you can also use your own custom one, so OpenDNS is probably able to be used as well.

 

[He Who Points And Laughs]

DoH is shit.
It makes the internet more centralized because now Firefox makes everyone use Cloudflare's server to resolve DNS requests instead of their respective ISPs (or alternate ones like OpenDNS).

Cloudflare is just the default.

 

[byuu]

I mean, they also allow you to use NextDNS which is better than Cloudflare by a long shot, you can also use your own custom one, so OpenDNS is probably able to be used as well.

You can also just disable it completely. The story is about how it's default now and most people will just leave it at that.

 

[George Orson Welles]

You can also just disable it completely. The story is about how it's default now and most people will just leave it at that.

Ah I get your point now, it's defeating it's purpose if it's CloudFlare who's in charge of the default DoH.

 

[Stock Image Photographer]

DoH is shit.
It makes the internet more centralized because now Firefox makes everyone use Cloudflare's server to resolve DNS requests instead of their respective ISPs (or alternate ones like OpenDNS).

It's also an overcomplicated protocol for webshits (JSON encoded data over an HTTPS connection).
DoT encrypts DNS requests too but doesn't require you to implement a HTTPS server and JSON parser to do so.

Definitely agree. People should disable it and use something like dnscrypt-proxy instead.

 

[George Orson Welles]

Definitely agree. People should disable it and use something like dnscrypt-proxy instead.

Dude it's not even that bad.

 

[Coffee Shits]

They are touting this as a victory for privacy when all it does is shift who can peek into your DNS requests from your ISP to Cloudflare. Drilling down from a handful of companies (99% of people use their ISP's DNS servers) to one. How much is Mozilla getting paid from Cloudflare for this? We know that Mozilla took a big chunk of change from Google to make it the default search engine once upon a time. No one switches from the default settings and they know this. If you do, you're probably smart enough to have switched to a FF fork sometime between Australis and Quantum.

Look at this shit:

Nine out of ten users just want the popup box to go away and will slam the big blue button to do so, and the remaining person who actually reads it will see "more secure" and ignore the rest. Great job Mozilla, you've fully perverted your original cause. Very frustrating.

 

[He Who Points And Laughs]

Nine out of ten users just want the popup box to go away and will slam the big blue button to do so, and the remaining person who actually reads it will see "more secure" and ignore the rest. Great job Mozilla, you've fully perverted your original cause. Very frustrating.

That's essentially the argument that Linux people use. Most end users just don't put in the time to learn.

 

[The Fool]

Imagine using Trannyfox in the year of the God-Emperor Two Thousand and a Score.

Accept your Cloudflare DNS and eat the bugs

 

[Coffee Anon]

Why did Namecoin fail again? DNS seems like one of the few areas where a blockchain would actually be usefull.

 

[George Orson Welles]

Why did Namecoin fail again? DNS seems like one of the few areas where a blockchain would actually be usefull.

It failed because of all the malware being spread if I'm correct, such a shame since .bit is a cool ass TLD.

 

[George Orson Welles]

Apologies for rebumping this thread but I recently found out that DoH when it's defaulted to Cloudflare, you can't connect to our main archiving service at all since it apparently has a "bad certificate".

Here's a direct excerpt from what happens when you go to archive.fo;
"Warning: Potential Security Risk Ahead:
Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for archive.fo. The certificate is only valid for the following names: cloudflare-dns.com, *.cloudflare-dns.com, one.one.one.one, 1.1.1.1, 1.0.0.1, 162.159.132.53, 2606:4700:4700::1111, 2606:4700:4700::1001, 2606:4700:4700::64, 2606:4700:4700::6400, 162.159.36.1, 162.159.46.1"

So yes, if you're using DoH, for the love of god change it to NextDNS or a custom one.

EDIT: Fixed the wording.

 

[Citation Checking Project]

Apologies for rebumping this thread but I recently found out that DoH when it's defaulted to Cloudflare, you can't connect to our main archiving service at all since it apparently has a "bad certificate".

Here's a direct excerpt from what happens when you go to archive.fo;
"Warning: Potential Security Risk Ahead:
Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for archive.fo. The certificate is only valid for the following names: cloudflare-dns.com, *.cloudflare-dns.com, one.one.one.one, 1.1.1.1, 1.0.0.1, 162.159.132.53, 2606:4700:4700::1111, 2606:4700:4700::1001, 2606:4700:4700::64, 2606:4700:4700::6400, 162.159.36.1, 162.159.46.1"

So yes, if you're using DoH, for the love of god change it to NextDNS or a custom one.

EDIT: Fixed the wording.

Wow this is peculiar. If you forgo SSL certificates or if you visit the http version, you get attachment below. (and for the record, 185.220.101.71 is a Tor exit node)

It seems like cloudflare's DNS server, whether it be over HTTPS or over UDP likes to resolve archive.is, .fo, and .today (but not .li) to

archive.fo. 2376 IN A 1.1.1.1
archive.fo. 2376 IN A 1.0.0.1
archive.fo. 2376 IN A 203.28.246.15

the two first addresses are cloudflare's DNS itself, the last one belongs to VanwaNet CDN.

I will shoot archive.is an e-mail, they need to know about this.

EDIT: That's a long-standing wontfix issue

Well, actually, further research reveals that this has been the case for years and that archive.today and CF are in a technical disagreement over DNS best practices. (Not too sure how to put it.) So this is most likely not getting fixed soon @Blondie. Only remaining question: will the webmaster jersh out at me or just ignore my e-mail?

archive.today on Twitter

“@xxdesmus @mattjpark @Cloudflare "Having to do" is not so direct here. Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come from causes so many troubles so I consider EDNS-less requests from Cloudflare as...

twitter.com

 

[George Orson Welles]

Wow this is peculiar. If you forgo SSL certificates or if you visit the http version, you get attachment below. (and for the record, 185.220.101.71 is a Tor exit node)
View attachment 1165084
It seems like cloudflare's DNS server, whether it be over HTTPS or over UDP likes to resolve archive.is, .fo, and .today (but not .li) to

archive.fo. 2376 IN A 1.1.1.1
archive.fo. 2376 IN A 1.0.0.1
archive.fo. 2376 IN A 203.28.246.15

the two first addresses are cloudflare's DNS itself, the last one belongs to VanwaNet CDN.

I will shoot archive.is an e-mail, they need to know about this.

It seems .li is the only one with the "correct" certificate in Cloudflare's book, I'm hoping for this to be resolved and it mostly will be in the coming hours, one can only hope.
Cheers.

 

[Citation Checking Project]

Wow this is peculiar. If you forgo SSL certificates or if you visit the http version, you get attachment below. (and for the record, 185.220.101.71 is a Tor exit node)
View attachment 1165084
It seems like cloudflare's DNS server, whether it be over HTTPS or over UDP likes to resolve archive.is, .fo, and .today (but not .li) to

archive.fo. 2376 IN A 1.1.1.1
archive.fo. 2376 IN A 1.0.0.1
archive.fo. 2376 IN A 203.28.246.15

the two first addresses are cloudflare's DNS itself, the last one belongs to VanwaNet CDN.

I will shoot archive.is an e-mail, they need to know about this.

Well, actually, further research reveals that this has been the case for years and that archive.today and CF are in a technical disagreement over DNS best practices. (Not too sure how to put it.) So this is most likely not getting fixed soon @Blondie. Only remaining question: will the webmaster jersh out at me or just ignore my e-mail?

archive.today on Twitter

“@xxdesmus @mattjpark @Cloudflare "Having to do" is not so direct here. Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come from causes so many troubles so I consider EDNS-less requests from Cloudflare as...

twitter.com

 

[⠠⠠⠅⠑⠋⠋⠁⠇⠎ ⠠⠠⠊⠎ ⠠⠠⠁ ⠠⠠⠋⠁⠛]

Well, actually, further research reveals that this has been the case for years and that archive.today and CF are in a technical disagreement over DNS best practices. (Not too sure how to put it.) So this is most likely not getting fixed soon @Blondie. Only remaining question: will the webmaster jersh out at me or just ignore my e-mail?

archive.today on Twitter

“@xxdesmus @mattjpark @Cloudflare "Having to do" is not so direct here. Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come from causes so many troubles so I consider EDNS-less requests from Cloudflare as...

twitter.com

I assume he just ignores these emails at this point. Cloudflare are in the wrong.

 

[George Orson Welles]

Well, actually, further research reveals that this has been the case for years and that archive.today and CF are in a technical disagreement over DNS best practices. (Not too sure how to put it.) So this is most likely not getting fixed soon @Blondie. Only remaining question: will the webmaster jersh out at me or just ignore my e-mail?

archive.today on Twitter

“@xxdesmus @mattjpark @Cloudflare "Having to do" is not so direct here. Absence of EDNS and massive mismatch (not only on AS/Country, but even on the continent level) of where DNS and related HTTP requests come from causes so many troubles so I consider EDNS-less requests from Cloudflare as...

twitter.com

Aw dang, most likely ignore, maybe jersh out at you since they probs get a lot of these emails all the time, I apologize for basically throwing you into that kind of position.