Hacker News Reader

Comment by josteink | Hacker News Reader

> Silently changing the DNS servers trusted to do Windows resolutions could inadvertently bypass these controls and frustrate our users. We believe device administrators have the right to control where their DNS traffic goes.

What Google and Mozilla seems not to get, Microsoft gets 100%.

Good on them. Thanks for sticking up for the user, MS. At least someone did.

View on HN

Mozilla is being more aggressive here than Google. My understanding about how Chrome will work, if the DNS servers configured on your machine support DoH, they will silently upgrade to use DoH. But it is entirely based on what your system DNS server is set to.

https://9to5google.com/2019/10/28/chrome-encrypt-dns/

Mozilla (I believe) is doing rolling out DoH to users (in the US) to use CloudFlare's DoH server. This will bypass the system configured DNS servers. This can be disabled in settings. And if the DoH DNS lookup fails, it'll fallback to the system configured DNS.

https://support.mozilla.org/en-US/kb/firefox-dns-over-https

(I'm a googler, opinions are my own)

Additionally (for Mozilla, not sure about chrome) there are a couple of checks to allow system administrators to force Firefox to fall back to the system DNS if desired. Either they can return NXDOMAIN (or some other options) to queries for use-application-dns.net, or they can use the usual group policy/active directory/policies.json methods to configure users' Firefox to not use DoH or use their internal DNS server with DoH if supported.

https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

https://support.mozilla.org/en-US/kb/customizing-firefox-usi...

https://github.com/mozilla/policy-templates/blob/master/READ...

With the admins having to userride use-application-dns.net, they have to break DNSSEC for the .net root.

Classy move, Mozilla.

They don't have to, that's one of the options. If they're corporate admins they likely have Active Directory or the ability to require the profiles.json, which also disables it.

It's intended as a way to allow DNS filtering software to work when admins aren't involved with user devices. DNS filtering software breaks DNSSEC anyway. So using it doesn't break anything extra.

I believe you meant Group Policies, as Active Directory in itself won't solve any Firefox configuration problems. With policies.json, we have such experience that random Firefox updates wipe it out and we have to redeploy.

With the DNSSEC breackage, the issue is the scope. With a little bit of thought, they could break just .application-dns.net instead of entire .net, if they used use.application-dns.net instead of use-application-dns.net. But I guess collateral damage wasn't in the mind of whoever suggested that.

The whole point of this feature is to ensure DNS filtering keeps working. Since DNS filtering already conflicts with DNSSEC, what does it matter that one of Firefox's mechanisms for signaling that you want DNS filtering also conflicts with DNSSEC?

No, the point of this feature is to use the resolver configured by the network administrator. DNS filtering might be one of the reasons, but there might be others, like resolving zones behind ACL, which by definition won't be resolvable by public resolvers.

Also, it is a difference, when a single second level domain has broken DNSSEC (especially one used only by single application that won't use DNSSEC anyway), and when entire top level domain is broken (which will be used by other applications, which do validate DNSSEC).

I know that DNSSEC is not favoured by browser makers; I'm personally not a big fan either. But just ignoring it as they were all the years is something different, than actively trying to undermine it and damaging other users of it.

> Mozilla is being more aggressive here than Google.

This is true. Nothing has shaken my faith in Mozilla more than their efforts with DoH.

Chrome is doing literally the same thing as Microsoft: https://www.chromium.org/developers/dns-over-https

Not really, Windows is handling DoH as a system service, which is great

Chrome (and firefox) are providing their own DNS, away form the system. This means that loading www.blah.com in chrome, firefox and opera will result in 3 different DNS lookups, and potentially 3 different results.

Windows is doing it right.

Reply on news.ycombinator.com