TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Firefox DNS-over-HTTPS

202 点作者 linksbro大约 3 年前

30 条评论

Animats大约 3 年前
<i>Firefox by default directs DoH queries to DNS servers that are operated by a &quot;trusted partner&quot;.</i><p>That&#x27;s what I don&#x27;t want - Firefox offering services.<p>Once you have a centralized server, with a huge number of minor queries passing through it, the operators get uppity. They start thinking they have editorial authority. Someone will decide that the DNS server should censor something. Child porn is the usual excuse, and then, after a while, you can&#x27;t see sites that mention Tienanmen Square or Ukraine any more.<p>I&#x27;m quite happy with Sonic&#x27;s classic DNS server. It just answers DNS queries and forwards requests to the appropriate upstream DNS server as required.
评论 #30955027 未加载
评论 #30954686 未加载
评论 #30954522 未加载
评论 #30956318 未加载
评论 #30956069 未加载
评论 #30955104 未加载
评论 #30956052 未加载
评论 #30956328 未加载
评论 #30956589 未加载
评论 #30960710 未加载
评论 #30957499 未加载
zamadatix大约 3 年前
If you&#x27;re on current macOS&#x2F;Windows&#x2F;Linux&#x2F;Android&#x2F;iOS&#x2F;ChromeOS you probably just want to configure DoH or DoT at the operating system level so it is done system wide. The other half reading this probably want a &quot;how to force disable&quot; guide instead of a &quot;how to&quot; guide. The automatically rolled out browser specific method described in this article is really directed at users that don&#x27;t know this is even a choice and probably wouldn&#x27;t have an opinion one way or the other if they did.<p>Somewhat unrelated but Firefox also supports SOCKS proxying independent of the OS config. Combining this with ssh -D and you can effectively VPN your Firefox traffic out any box you can ssh to, including the DNS requests. This has been both useful for me as a troubleshooting tool and as a simple internet VPN.
评论 #30953109 未加载
评论 #30953360 未加载
评论 #30952803 未加载
评论 #30954940 未加载
评论 #30953078 未加载
评论 #30955400 未加载
评论 #30955113 未加载
throwaway892238大约 3 年前
This is objectively a terrible decision. Technologically, politically, culturally. We had a very good design in DNS, and people are throwing it away because they&#x27;re terrified about the potential that their ISP might use their data. Never mind that Netflix already does it to them when they watch TV, Target does it to them when they buy condoms at the store, Google does it with their mail and search results, ESPN does it to them when they play fantasy football, and Starbucks does it to them when they buy their venti mocha frap. But because Comcast might <i>also</i> know what they do in their private life, we should ditch one of the internet&#x27;s most important protocols, and give all our data to Cloudflare, a central TCP-based US-owned DNS resolver.<p>Nobody in the world needs DNS over HTTPS. If you actually need to hide your DNS requests, you have bigger problems that you need a real VPN for. This is a unilateral political decision by the people who have the most power over browsers because they have an emotional obsession with privacy, even if it makes technology in general worse.
评论 #30956517 未加载
评论 #30954466 未加载
评论 #30955191 未加载
评论 #30955222 未加载
评论 #30956413 未加载
iamevn大约 3 年前
I think encrypted DNS as a default is a good thing and swapping (with a notification to let you know what they did, why, and an easy button to revert the setting) in an update would be great.<p>&gt; We completed our rollout of DoH by default to all United States Firefox desktop users in 2019<p>Why did this setting change for me today mid-session? Did someone malicious use this functionality to change my settings outside of the context of an update? I don&#x27;t want anyone to be able to remotely change my privacy settings. Knowing this feature exists makes me extremely uncomfortable and has broken my trust in my browser.
评论 #30955855 未加载
评论 #30955118 未加载
michaelje大约 3 年前
I went to the effort of setting up a pihole, and pointing all the devices on my network to it.<p>When I saw this notification for the first time yesterday I was a bit annoyed - do I now have to think about every application ignoring OS level settings and using its own?
评论 #30956337 未加载
boesboes大约 3 年前
I see a lot of people who do no like this. And that is totaly fair. I do not want or need this either, I have my own resolver on my pi-hole and why the f whould I want FF to mess with that.<p>However, for &#x27;normal&#x27; users, this is actually an important an big improvement imo. You cannot expect everyone to understand how it all works and how to run a dns server. If you can, you might not be the target audience for such features.<p>That being said, I&#x27;d prefer my FF without all the &#x27;services&#x27; and bullshit. I tried Librefox, but couldn&#x27;t get it to run. Gave up after 30s. Guess I&#x27;m not the target audience for that and I&#x27;ll deal with disabling mozilla&#x27;s spam ;)
iggldiggl大约 3 年前
One problem I&#x27;ve found when trying to switch to an alternative DNS provider is that e.g. different parts of Akamai&#x27;s CDN servers have different peering arrangement with ISPs and Akamai uses DNS for directing you to a server that is well-connected to your current ISP.<p>So when using an alternative DNS server, download speeds for anything hosted by Akamai would always slow to a crawl in the evening because I got directed to the wrong set of Akamai servers.
评论 #30956304 未加载
评论 #30957558 未加载
throwaway81523大约 3 年前
I just got this automatic up&#x2F;down&#x2F;side-grade. DNS to be handled by a partner service provider, so they get all my data instead of my ISP getting it? Doesn&#x27;t seem like an improvement. I think I will turn this off.
评论 #30952930 未加载
评论 #30955756 未加载
评论 #30953034 未加载
lovelearning大约 3 年前
If you&#x27;re a dev who uses curl &#x2F; requests &#x2F; HTTP libraries, just browser-level DoH isn&#x27;t enough for ISP privacy or govt censorship evasion.<p>On Ubuntu 18, I installed &quot;dnss&quot; at the OS-level to send <i>all</i> DNS requests as DoH. Currently, it just forwards them to CloudFlare&#x27;s DoH URL. But I can also install it as a DoH proxy on my remote server if I want to move away from CloudFlare.<p>It works fine and is easily installed without any builds or PPAs. The only problem with it is that I had to disable systemd-resolved first to reserve port 53 for dnss.
FreeHugs大约 3 年前
It is amusing that in Europe, there is this big DGPR drama playing out about websites embedding resources from US companies. Like Google Fonts, Tweets and Facebook like buttons.<p>Yet the browser sends each and every website the user visits to a US company.<p>All in all, I tend to think that it is a net positive.<p>Downside: Now one US companies gets all my DNS queries. But can they stitch them together? I tend to think they can&#x27;t easily. And will hopefully not keep enough logs to do so later.<p>Upside: My ISP and the cafes and hotels I visit do not get the info which websites I visit.<p>The protection could be made even stronger if the browser would send 5 DNS requests for every IP it needs. So if you visit news.ycombinator.com it additionally sends 4 random hostnames to cloudflare.
评论 #30954221 未加载
评论 #30956887 未加载
评论 #30954055 未加载
评论 #30954280 未加载
评论 #30954372 未加载
msravi大约 3 年前
I use pihole configured with nextdns DoH as primary upstream server and cloudflare as backup. So all devices connected to the network end up using DoH. Works very well.<p>In addition, if you configure tailscale on your mobole devices, they can still use your pihole+nextdns&#x2F;cloudflare even when roaming over 4g.
snthpy大约 3 年前
I have a Pihole set up as my DNS resolver on my home network. My understanding is that this blocks ads at the DNS level. So if I it anyone in my family enabled DoH this would defeat the Pihole services? Can someone confirm this?
评论 #30954183 未加载
评论 #30954144 未加载
评论 #30954142 未加载
评论 #30954127 未加载
sublimefire大约 3 年前
DoH creates a precedent where parents are not able to easily control the internet access for their kids. It is fairly easy to setup the router these days and block porn,gambling,malware,social media. Not to mention the OS level config on devices to use a particular DNS server.<p>Now, we (parents) need some remote management OSS (like in a corporate world). I want to ensure the config of the laptops,tablets,phones does not use DoH but only the DNS of the PiHole.<p>DoH is great but I feel the pain.
josephcsible大约 3 年前
The point of DNS-over-HTTPS is to protect users from censorship and surveillance by their network operators. Does anyone have any reason to try to block it on their networks (not just wanting to turn it off on their own devices), other than that they&#x27;re network operators who want to be able to censor and surveil traffic from other people&#x27;s computers?
评论 #30953381 未加载
评论 #30953805 未加载
pabs3大约 3 年前
I wonder when the DNS root servers are going to adopt DoT or DoH, or something that isn&#x27;t plaintext.
markoutso大约 3 年前
How hard can it be for Firefox to embed its own recursive resolver that talks only to the root servers? If you are really concerned about privacy that’s the only way to go. Other than that it makes little sense to me to trust one company over another.
评论 #30955921 未加载
评论 #30955951 未加载
评论 #30957162 未加载
legrande大约 3 年前
Funny, I reported a bug to Mozilla about their NextDNS offering being mis-configured, and it leaked DNS queries. I turned it on by going to Preferences &gt; General &gt; Network Setting and then fired up Wireshark, and all the queries were sent in the clear, even with NextDNS set to &#x27;Enabled&#x27;. They seem to have fixed it. Lesson here: sniff your network traffic and don&#x27;t blindly trust that DoH is configured properly.
lizardactivist大约 3 年前
Forget Cloudflare and Google DNS, and use an independent and private resolver. Both uncensoreddns.org and mullvad.net offer DoH and DoT.
评论 #30956153 未加载
beagle3大约 3 年前
Does anyone know how well modern DoH infrastructure works with geographically specific results? E.g., google.com on any &quot;real&quot; DNS points me to a google proxy on a nearby ISP, usually mine -- netflix also has local ISP boxes.<p>Don&#x27;t see how this can work unless Cloudflare&#x2F;NextDNS is all knowing about the world DNS infrastructure.
评论 #30956200 未加载
billpg大约 3 年前
&quot;Are parental controls enabled?&quot;<p>I wonder how it does that. Will the browser be making DNS requests for playboy every so often?
评论 #30955331 未加载
guu13456789大约 3 年前
... and the DNS-over-HTTPS providers that come with Firefox &#x2F; Chrome censure DNS as they like, very obvious now due to our east friends news sites being blocked<p>that being said, I use this at my work machine so that the local IT agent cannot access the DNS resolver cache
slim大约 3 年前
burried lede :<p>&gt; We began our rollout by default to Russia and Ukraine Firefox desktop users in March 2022.
flerchin大约 3 年前
I donate $10 a month to the Mozilla foundation, and I see this as: Good, not perfect.
jbirer大约 3 年前
I had problems accessing RT from Romania because our ISPs blocked it (something that is uncommon in this country). I chose a DNS server from the Firefox config page and managed to get it. Really great feature.
Beta-7大约 3 年前
I am surprised Mozilla is pushing for DoH. I was expecting Google to lead the front since most of their revenue comes from ads and the DNS-level ad blockers are easily defeated by DoH.
harry8大约 3 年前
How does this work with pi-hole? Or it basically doesn&#x27;t because it bypasses any blocking of the malicious you&#x27;re performing like that?
评论 #30954195 未加载
daneel_w大约 3 年前
I prefer to avoid Mozilla as much as Google. I use DoT (which I think is a better alternative than DoH) against uncensoreddns.org and Quad9.
评论 #30957213 未加载
评论 #30957801 未加载
rythmshifter大约 3 年前
Is it possible to configure this to use the same cloudflared redirection I am using for my pi hole?
nuker大约 3 年前
What is the latest on use of http cookies in DoH?
denkmoon大约 3 年前
DNS over HTTPS is a trojan horse to allow application developers to subvert the system administrator&#x27;s DNS policy. Specifically, so that companies like Google, Microsoft, Amazon can ensure that you cannot prevent ads being displayed in their little black boxes (hardware or software).<p>This is dangerous, anti-user, and should be avoided at all costs.<p>DNS over TLS is the correct and appropriate solution here.<p>You can ensure your (Firefox) browser does not use DNS over HTTPS by configuring a canary domain: <a href="https:&#x2F;&#x2F;support.mozilla.org&#x2F;en-US&#x2F;kb&#x2F;canary-domain-use-application-dnsnet" rel="nofollow">https:&#x2F;&#x2F;support.mozilla.org&#x2F;en-US&#x2F;kb&#x2F;canary-domain-use-appli...</a> but let&#x27;s be clear here, nobody besides Firefox is going to respect user choice about using DoH.
评论 #30952293 未加载
评论 #30952594 未加载
评论 #30952297 未加载
评论 #30952789 未加载
评论 #30952702 未加载
评论 #30952359 未加载
评论 #30952616 未加载
评论 #30952473 未加载
评论 #30952983 未加载
评论 #30952561 未加载
评论 #30952590 未加载
评论 #30952348 未加载