Hacker News Reader

Comment by notatoad | Hacker News Reader

>the entire point is to make it impossible to block ads

the entire point is to make it impossible to modify DNS requests at the network level. this has a lot more serious consequences than just blocking ads. especially for the parties involved with this, none of whom are advertising companies. phishing and data security are actual big issues with financial implications that companies want to prevent. just because blocking ads is the consequence that will most immediately impact you personally, doesn't make it the whole point.

this accusation is especially rich on an article about mozilla, one of the few companies fighting to make sure that advertisers don't control the application level.

View on HN

> phishing and data security are actual big issues with financial implications that companies want to prevent

These are issues exacerbated by DoH, not fixed by it. DoH assists in the circumvention of security and monitoring. We block ads because they're security problems.

Control over DNS is neither necessary nor sufficient to block ads.

It's not sufficient in itself, but it bears most of the load of network-wide management of harmful traffic. It's the 99% effective method.

Endpoint-level control is no longer possible, since ad companies are skipping the OS network stack and bringing their own. Application-level control is less efficient, and more difficult, particularly when the applications are designed by the same ad companies trying to circumvent DNS control as well. (See Manifest V3.)

>DoH assists in the circumvention of ... monitoring

yes, that's the point. I understand you want to monitor traffic within your network, but forcing clients to use insecure protocols to enable network-wide monitoring means you're enabling network-wide monitoring. and that's the opposite of security.

remember that your browser traffic crosses multiple networks before it hits the website you're trying to connect to. forcing that traffic to be observable and modifiable in your own network means it will also be observable and modifiable by your ISP.

> forcing that traffic to be observable and modifiable in your own network means it will also be observable and modifiable by your ISP

This is factually false. And represents a key part of the problem in the rollout browser vendors have designed: Browsers should not be implementing their own network stacks. It's the wrong place to begin encrypting network requests, but for the "if you're a hammer" crowd, everything looks like a nail.

If the browser respected the OS stack, the OS could decide to encrypt requests, but it isn't given the choice. If the browser respected the network it's in, the network could decide to encrypt requests at the border, but it isn't given the choice.

Browser vendors decided the right choice was to build a product purpose-built to bypass nearly every good method of restricting malware, phishing, and, oh of course, ads. Google and their ilk would happily install ransomware on every PC on the planet if it would guarantee Google Ads couldn't be blocked, and that ISPs couldn't compete with their well-established surveillance tools.

The latter is why any suggestion DoH is to protect user privacy is silly... the user's privacy was compromised by the browser application pre-encryption. They just need you to believe the ISPs are somehow a bad actor for tracking you, so that only they can track you.

Any device you didn't have root on was free work around your DNS server already. This is weak security at best.

DHCP will catch up too. https://datatracker.ietf.org/doc/html/draft-peterson-doh-dhc...

Use MDM and configure the browser. Or block the special probe domain Mozilla has for this purpose.

Reply on news.ycombinator.com