TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

DNS-over-HTTPS Policy Requirements for Resolvers

140 点作者 jvehent大约 6 年前

18 条评论

kodablah大约 6 年前
&gt; Our plan is to select a set of Trusted Recursive Resolvers (TRRs) that we will use for DoH resolution in Firefox. Those resolvers will be required to conform to a specific set of policies that put privacy first.<p>So can I manually set one myself to my local pi-hole instance? I have already been setting the TRR about:config values (ala [0]), will that remain?<p>I am wary of Mozilla becoming the arbiter of acceptable DNS providers for me, so I should be able to override it if I want.<p>0 - <a href="https:&#x2F;&#x2F;blog.stackpath.com&#x2F;serverless-dns-over-https-at-the-edge-doh" rel="nofollow">https:&#x2F;&#x2F;blog.stackpath.com&#x2F;serverless-dns-over-https-at-the-...</a>
评论 #19626266 未加载
评论 #19628105 未加载
nykolasz大约 6 年前
I replied sub-thread, but adding here to give some more visibility to some of the issues DoH is causing and will cause:<p>I work at a k12 school and I am involved on many k12 IT communities.<p>Some schools already removed Firefox from the students computers because it was being used as a &quot;VPN&quot; by some elementary students to access porn - at school. Guess what this VPN was? Just DNS over HTTPS.<p>There is a fine line between protecting yourself from your ISP and local network operators that NEED to apply some security policies to their traffic. Even Google offers &quot;Safe Search&quot; for schools and libraries that removes porn content.<p>Unfortunately, on our school network, we also allow BYOD (students with their own laptops and ipads), so we will have to have some strict rules to block DoH, the same way we block proxies and vpns.<p>The only other option is going to full HTTPS MITM, forcing a root SSL cert to all computers that use our network, which is the last thing that anyone wants to do.<p><i>Summary: This may lead to more HTTPS MITM or schools forbidding BYOD AND removing Firefox from their computers.</i>
评论 #19626293 未加载
评论 #19625356 未加载
评论 #19625175 未加载
评论 #19624927 未加载
评论 #19625197 未加载
评论 #19625334 未加载
评论 #19625034 未加载
评论 #19624911 未加载
评论 #19636630 未加载
评论 #19624885 未加载
评论 #19625228 未加载
评论 #19630078 未加载
评论 #19625686 未加载
评论 #19631076 未加载
评论 #19628069 未加载
评论 #19629603 未加载
评论 #19627642 未加载
评论 #19626800 未加载
rmdoss大约 6 年前
Note that with DoH on Firefox, your intranet domains do not work. Had issues with it before and had to disable DoH just to access our company printer. Also causes issues with DC.<p>That goes into the argument that DNS (domain name lookup) should be a system and network-level setting, not an App-based setting.
评论 #19626090 未加载
评论 #19626088 未加载
评论 #19626779 未加载
EvanAnderson大约 6 年前
I hadn&#x27;t been paying much attention to DNS-over-HTTPS, but I recently listened to a talk that Dr. Paul Vixie (of BIND fame) gave that where DNS-over-HTTPS was discussed:<p><a href="https:&#x2F;&#x2F;youtu.be&#x2F;OxFFTxJv1L4?t=2799" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;OxFFTxJv1L4?t=2799</a><p>After hearing Dr. Vixie discuss DNS-over-HTTPS from a network operator perspective I&#x27;m a lot more wary of the protocol.
评论 #19624606 未加载
评论 #19624500 未加载
评论 #19624273 未加载
评论 #19624262 未加载
bluejekyll大约 6 年前
I’ve begun to think that differences of opinion on the benefits and&#x2F;or negatives of DoH come from two different perspectives on what DNS is for.<p>What I perceive from the debate is generally that people who dislike DoH tend to perceive it as a network plane protocol, one that is designed for network operations and nothing more (layer 3&#x2F;4 if you will).<p>Whereas people who tend to want privacy and the other features of DoH, perceive it as an application level concern (layer 7). In this context connectivity and discoverability of services is the aim, and knowing that the information for establishing connections to those services is correct is important to the foundations and guarantees of applications being built to utilize DNS.<p>In the application and services context, you may not even want a single set of recursive resolves or authorities for the system. And the reasons are to help ensure the data is focused on what you need in different contexts.<p>I believe that the network level concerns over DoH are a little disingenuous, and this is because there are many ways to circumvent DNS, DoH isn’t necessary, you don’t even need DNS to establish layer3&#x2F;4 connections. Fighting over DoH for security that can’t truly be enforced in DNS, seems misguided.
评论 #19626460 未加载
评论 #19626361 未加载
评论 #19629325 未加载
3xblah大约 6 年前
&quot;To that end, today we are releasing a list of DOH requirements, available on the Mozilla wiki, that we will use to vet potential resolvers for Firefox. The requirements focus on three areas: 1) limiting data collection and retention from the resolver, 2) ensuring transparency for any data retention that does occur, and <i>3) limiting any potential use of the resolver to block access or modify content.</i>&quot;<p>I sometimes use a local resolver bound to localhost that blocks ads by pointing to a custom root.<p>If someone aiming to be on the TRR list sets up a remote resolver that blocks ads (or replaces them with blank images) perhaps using the same technique, it could allow Firefox users to get ad blocking by default, by using DOH.<p>I wonder if that would violate Mozilla&#x27;s requirements?<p>Are ads considered &quot;content&quot;?<p>There is of course precedent for blocking undesirable content via DNS as a &quot;service&quot;.<p>Third party DNS service, for example the famous one that starts with &quot;O&quot;, has been used to block certain content, e,g, at schools.<p>This was offered as a fee-based service.<p>If I remember correctly they also offered &quot;free&quot; service which was subject to redirection of NXDOMAIN to paid placement &quot;search&quot; results&#x2F;ads.
评论 #19625478 未加载
评论 #19625739 未加载
评论 #19629754 未加载
subwindow大约 6 年前
This has negative implications for security. For instance, one reason why DNS resolvers might block or modify requests is to blacklist domains used for malware operation (botnet C&amp;C domains). Other things like DNS sinkholing and poisoning are also frequently used as tools to disrupt malware communication.<p>In addition, collection and analysis of below-the-recursive DNS traffic is one of the primary ways in which security researchers discover the infrastructure of botnet networks.<p>Overall DoH is probably a net positive, but I don&#x27;t see downsides like this being discussed.
评论 #19625212 未加载
评论 #19630678 未加载
AnaniasAnanas大约 6 年前
Still no explanation on why dns-over-https rather than the already widespread dnscrypt or the lesser known dnscurve, dns-over-quic, and dns-over-tor.
评论 #19625210 未加载
评论 #19624510 未加载
评论 #19624663 未加载
评论 #19629362 未加载
kylek大约 6 年前
(It&#x27;s been a long time since I&#x27;ve actually set up a DNS server and am pretty fuzzy on some details - so I&#x27;m going to state this like a real nooby to hopefully get an ELI5 answer)<p>If I were to set up my own DoH server, would its queries to upstream (root??) servers (and subsequent recursed servers) be encrypted? (Simpler: does running a DNS server &quot;on-premise&quot;, or even in the cloud, actually protect you from anything?)
评论 #19629768 未加载
tptacek大约 6 年前
Notice something they&#x27;re not requiring? Mozilla will trust resolvers that don&#x27;t check DNSSEC. Stick a fork in DNSSEC.
LinuxBender大约 6 年前
Has anyone started contributing lists of all the public DoH resolvers on any of the block-lists? e.g. [1] [2]<p>[1] - <a href="https:&#x2F;&#x2F;iplists.firehol.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;iplists.firehol.org&#x2F;</a><p>[2] - <a href="https:&#x2F;&#x2F;github.com&#x2F;firehol&#x2F;blocklist-ipsets" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;firehol&#x2F;blocklist-ipsets</a>
评论 #19629782 未加载
darkhorn大约 6 年前
Also you can encrypt SNI in Firefox, just enable<p>network.security.esni.enabled<p><a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;encrypt-that-sni-firefox-edition&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;encrypt-that-sni-firefox-edition...</a>
zelly大约 6 年前
No data collection? Watch 8.8.8.8, 1.1.1.1, etc. suddenly end their services.
评论 #19625798 未加载
protomyth大约 6 年前
What is the justification for an app to resolve domain names differently than the services the operating system provides? I am really curious why this is a thing.
评论 #19630723 未加载
nykolasz大约 6 年前
Glad that they allowed resolvers that filter content based on the user request in there. So good news that Quad9 and CleanBrowsing will be able to make the list.
lazylizard大约 6 年前
I hope it can respect nsswitch?
localhostdotdev大约 6 年前
pretty cool, I wished chrome did that. firefox is probably going to choose cloudflare (1.1.1.1).<p>I wonder how this plays out with local DNS (e.g. my ISP has some custom domains for me to use, and internal company network addresses)
评论 #19624517 未加载
slim大约 6 年前
tl;dr<p>Firefox will ignore your DNS settings and use his own (DoH)
评论 #19629284 未加载