<story><title>Firefox’s Trusted Recursive Resolver DNS feature is dangerous</title><url>https://blog.ungleich.ch/en-us/cms/blog/2018/08/04/mozillas-new-dns-resolution-is-dangerous/</url></story><parent_chain><item><author>nebulous1</author><text>The article doesn&amp;#x27;t suggest there&amp;#x27;s something sneaky going on. The article is suggesting that Mozilla are choosing to share your DNS queries with a third party service by default, which is exactly what they&amp;#x27;re doing.  It&amp;#x27;s not about them choosing Cloudflare in particular, it&amp;#x27;s about them choosing any particular service by default.  And the article&amp;#x27;s argument that, if you have to choose somebody to share this data with, it might as well be the people you already share it with, seems pretty valid to me.&lt;p&gt;edit: I have to point out that the article has backed away from the claim that this will be enabled by default in September.  Looking at the Mozilla blog, they mention wanting to enable this by default but have no actual plan to do so (and more crucially doesn&amp;#x27;t discuss at all what sort of form it would have to be in for them to enable it by default, it may look nothing like the cloudflare-default we&amp;#x27;re discussing here).</text></item><item><author>jillesvangurp</author><text>DNS over HTTPS is a great idea. There&amp;#x27;s nothing wrong with the protocol or Mozilla&amp;#x27;s implementation of it. This article is all about Mozilla&amp;#x27;s default choice for a DNS provider. I think Cloudflare is actually a reasonable choice though I&amp;#x27;m not a big fan of their annoying captchas that I get served whenever I use vpns.&lt;p&gt;There&amp;#x27;s nothing sneaky going on here; which the article seems to imply.&lt;p&gt;Currently there is no UI to configure any of this yet (other than about:config) but you can trivially select any DNS provider that implements this in the same place where you turn this on. The relevant setting is network.trr.uri. Also, you need to opt in to this to turn it on so you&amp;#x27;d be reviewing this setting as well.  Also you can configure how this is used, how and when it falls back to normal DNS, etc.&lt;p&gt;You can run your own server if you want; or use the one from your provider if&amp;#x2F;when they implement this. For obvious reasons, there are not a lot of usable servers yet but it seems Google has implemented this as well. So I assume they plan to roll this out for Chrome at some point.&lt;p&gt;The premise of this article seems to be that you should trust your provider to do DNS and do it well. I&amp;#x27;m sorry to say but for the vast majority of providers I have experience with the opposite is the case. I&amp;#x27;ve had providers redirect dns failures to advertising pages in the past, shitty performance (600 ms or worse), and generally trying to rip me off with bad network infrastructure related outages while charging me a premium for bandwidth clearly not delivered via obviously very congested infrastructure. I have no reason whatsoever to trust them, at all. The less they can learn from my traffic the better.</text></item></parent_chain><comment><author>oxymoron</author><text>That’s simply not true. Mozilla is not sharing DNS queries with Cloudfare by default, nor are they overriding your configured DNS servers per default. This is an experimental opt-in feature, and they are also running an opt-in study. There has been no announcement of an ”on by default” for DOH. If you enable the experimental feature there is no default provided and you have to set your own server, but if you opt in to the study, you’ll get Cloudfare. This is almost pure FUD at this point.</text></comment>
<story><title>Firefox’s Trusted Recursive Resolver DNS feature is dangerous</title><url>https://blog.ungleich.ch/en-us/cms/blog/2018/08/04/mozillas-new-dns-resolution-is-dangerous/</url></story><parent_chain><item><author>nebulous1</author><text>The article doesn&amp;#x27;t suggest there&amp;#x27;s something sneaky going on. The article is suggesting that Mozilla are choosing to share your DNS queries with a third party service by default, which is exactly what they&amp;#x27;re doing.  It&amp;#x27;s not about them choosing Cloudflare in particular, it&amp;#x27;s about them choosing any particular service by default.  And the article&amp;#x27;s argument that, if you have to choose somebody to share this data with, it might as well be the people you already share it with, seems pretty valid to me.&lt;p&gt;edit: I have to point out that the article has backed away from the claim that this will be enabled by default in September.  Looking at the Mozilla blog, they mention wanting to enable this by default but have no actual plan to do so (and more crucially doesn&amp;#x27;t discuss at all what sort of form it would have to be in for them to enable it by default, it may look nothing like the cloudflare-default we&amp;#x27;re discussing here).</text></item><item><author>jillesvangurp</author><text>DNS over HTTPS is a great idea. There&amp;#x27;s nothing wrong with the protocol or Mozilla&amp;#x27;s implementation of it. This article is all about Mozilla&amp;#x27;s default choice for a DNS provider. I think Cloudflare is actually a reasonable choice though I&amp;#x27;m not a big fan of their annoying captchas that I get served whenever I use vpns.&lt;p&gt;There&amp;#x27;s nothing sneaky going on here; which the article seems to imply.&lt;p&gt;Currently there is no UI to configure any of this yet (other than about:config) but you can trivially select any DNS provider that implements this in the same place where you turn this on. The relevant setting is network.trr.uri. Also, you need to opt in to this to turn it on so you&amp;#x27;d be reviewing this setting as well.  Also you can configure how this is used, how and when it falls back to normal DNS, etc.&lt;p&gt;You can run your own server if you want; or use the one from your provider if&amp;#x2F;when they implement this. For obvious reasons, there are not a lot of usable servers yet but it seems Google has implemented this as well. So I assume they plan to roll this out for Chrome at some point.&lt;p&gt;The premise of this article seems to be that you should trust your provider to do DNS and do it well. I&amp;#x27;m sorry to say but for the vast majority of providers I have experience with the opposite is the case. I&amp;#x27;ve had providers redirect dns failures to advertising pages in the past, shitty performance (600 ms or worse), and generally trying to rip me off with bad network infrastructure related outages while charging me a premium for bandwidth clearly not delivered via obviously very congested infrastructure. I have no reason whatsoever to trust them, at all. The less they can learn from my traffic the better.</text></item></parent_chain><comment><author>Xylakant</author><text>The default applies currently if you enable an experimental feature. They hammered out a tight privacy agreement for one service and use that as default while this is stabilized. You can pick any other resolver if you prefer. Seems a legit way of handling this.&lt;p&gt;&amp;gt; And the article&amp;#x27;s argument that, if you have to choose somebody to share this data with, it might as well be the people you already share it with, seems pretty valid to me.&lt;p&gt;The whole point of HTTPS and DNS-over-HTTPS is to not share any data at all with your provider. It’s not entirely working right now due to SNI being plaintext, but work is being done on that, too. So that’s really not a good argument.</text></comment>