Hacker News Reader

Comment by supakeen | Hacker News Reader

An update is that on Reddit a Firefox employee has responded on my crosspost to reddit: https://www.reddit.com/r/firefox/comments/9cx8hk/on_firefox_...

Clarifying that this is just an A/B test and there are no plans to continue using CloudFlare for all users.

View on HN

To clarify, only in nightly and previously disclosed [0] (results at [1]).

The article is right to be fearful that FF is pondering a default change, but until that is even on the table, I'm not worried. Now if they wanted to make it really really easy for regular users to change from your default ISP DNS to CloudFlare, I'd actually be OK with that, but I'd expect it to be implemented like search engine providers where anyone could just as easily be the DNS provider chosen (ideally without any CloudFlare favoritism). And it would be clear who your DNS provider is maybe via an icon (if there is real estate for it).

0 - https://blog.nightly.mozilla.org/2018/06/01/improving-dns-pr...

1 - https://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-...

They have a contract with CloudFlare with stronger privacy protections for FF users. This goes beyond the normal CloudFlare privacy policy. https://developers.cloudflare.com/1.1.1.1/commitment-to-priv... They're not just picking providers at random.

I am a bit naive. Who is paying who in this contract? What is either side getting out of it? Why can it not just be a pluggable DNS provider situation and let CloudFlare compete with anyone else for opt-in (including extra privacy features if so desired)? Also curious, why would CloudFlare offer stronger privacy protections for one type of user and not another...what is CloudFlare getting out of the lesser-protected users since it is clear everyone is not given the same treatment?

What Cloudflare wants is the most people/consumers possible using their DNS. Doing so will make lookups and translations faster for their customers than anyone else as the content is basically on the same network as the DNS lookup. When they go sell Enterprise content delivery services to their big customers they can tout a huge base of users tied to their DNS and sell on the performance enhancement these people will see when accessing Cloudflare customers content. CDN is all about shaving milliseconds off of content delivery and having a huge base of consumers using Cloudflare for DNS differentiates them and provides a measurable performance increase.

It will almost certainly be configurable. My point is that you'd have to evaluate the privacy policy of each provider for yourself which is more work than just picking from a drop-down menu. And even if you put in the normal CF endpoint, you would only be covered by the normal CF ToS and not by Firefox's special deal. The "favoritism" has a material impact on privacy.

Surely it can be seen why this comes off as shady. Browser vendor inks deal w/ third party company. Deal includes special provisions company will not otherwise provide users of its service. Browser vendor promises to give preference to third party company. Details of deal, at least to me, are not very transparent.

In general I agree that using other DNS providers besides the ISPs has benefits. But not sure I think it should funnel to a single, preferred company. Nor do I think that they should collect anything at all, reduced compared to their original or not. I think some transparency is deserved here about the contract if/when a regular FF release is shipped encouraging users to use Cloudflare, specifically around the motives of wanting this data. Granted, I am a bit more paranoid than most.

This was a one-off experiment with a really new technology, it makes sense to go with one global provider for that. (If you want to use it already outside that, you can enable it and set a server of your own choice)

If they intended to ship with DoH default-enabled, I'd hope Mozilla would not go with any single provider as a default.

Agreed on all fronts. A single provider for tests makes plenty of sense. Time will tell whether the deal amongst the two companies has legs beyond this test.

eastdakota has stated that no one gets paid: https://twitter.com/eastdakota/status/1031359620961329152

According to the tweet linked from the post: "DoH might become enabled by default at some point, which is what has been said. But no-one has specified exactly how or with which operators (yes, plural). Because we don't know. That's not planned yet. And "might" is still "might [not]" as well." (the [not] was not there, but I think this is what Daniel meant). https://twitter.com/bagder/status/1036364374728953858

Reply on news.ycombinator.com