Hacker News Reader

Comment by niftich | Hacker News Reader

Firefox's DOH client ignores /etc/hosts, but it shouldn't be too hard to host your own DOH server [1][2] that you could then configure how you see fit. I can see this pattern becoming widespread someday, and with DOH, people can re-use their experience in setting up webservers.

[1] https://github.com/st3fan/tinydoh [2] https://github.com/m13253/dns-over-https

View on HN

You think regular end users having to set up and maintain server software in order to force a name for an IP is going to become a widespread pattern? That's horrifying. I don't want to live in that world.

Regular users today don't use that feature, so you're choosing a rather odd hill to die on.

To put this another way: it's a significant benefit for my random non-techie friends to be able to use this new feature plus HTTPSEverywhere. And even as a techie, I don't use a hosts file to block anything. So I'm not bothered by how Firefox chose to implement this, like most people.

There's plenty of ad blocking, spyware blocking, ransomware blocking, etc. software that absolutely uses the hosts file to blackhole requests. Much of it is free and intended for home computer use.

And what market share do they have? None of my non-techie relatives or friends who've asked me to look at their machines run that kind of software.

Only the use case with the largest market share matters?

That kind of thinking, really irks me.

No, I don't think like that.

It does bother me when Firefox introduces a feature which covers up a huge hole in TLS, and they get a large number of complaints on HN.

Of course it gets large number of complains, when it creates more problems than it solves, and it is papered over "but mainstream users do not need that".

Mainstream users do not need most software ever made.

Did you see someone in this discussion suggesting "but mainstream users do not need that"? I just checked again and I don't see anyone making that suggestion.

It is paraphrased. The argument is, that it improves things for the mythical naive mainstream user, and for where it break things, well they are minority anyway.

I didn't see anyone making that argument, either. Are you trying to summarize what I said? If so, that's not what I said. I'd love to have a discussion about these issues, but it's not going to happen if everyone's talking past each other, plus random downvotes.

OK, but software like that can easily include an internal DOH proxy (or just turn off DOH in Firefox).

Regular users use a browser extension like ublock or Adblock to block ads. Not improving DNS security for the sake of a few users obscure Adblock mechanism would be pretty silly.

Regular users also use Norton, McAfee, and other vendor Internet security suites. Some of those will also use the hosts file.

It's easier than ever to host a server transparently for end user software. You don't hear users complaining about node.js running in most Electron apps. A http server for DNS can easily be compiled to binary and ran like any other system daemon.

I think there’s great value in DOH caching servers running on home routers; all the benefits of DOH but “regular DNS” between clients and your home router.

Just run local dnscrypt-proxy (it supports DoH) on your machine/router and everything would be fine.

That [1] implements a very old draft so I doubt it is compatible with Firefox.

Reply on news.ycombinator.com