Re: Should we block DoH by default?

["Sorin-Mihai Vârgolici" <sorin-mihai@blockgemini.com>]

[-- Attachment #1: Type: text/plain, Size: 1496 bytes --]

EHLO

On 03/03/2020 17:17, Michael Tremer wrote:
> I do not want DoH. I do not like it. Mozilla is doing something really really bad here.

TL;DR, I saw some mention of cloudflare, so I already don't like this at 
all, no matter how good others might think it is, for technical reasons 
or privacy concerns or whatnot .

Does it actually mean that Firefox will try to use cloudflare's DNS by 
default regardless of the system's resolv.conf cluttering my LAN traffic 
with denied requests until I patch the firefox config(s)? I'm not 
directly affected for now, so I have some time to prepare for the next 
updates. This to me sounds like forcing all users to use a proxy even if 
the users don't want to and even have the right to decline. They 
should've stick to pushing Google as default search engine, it really 
was enough...

What if I use private DNS server(s) in IPFire, or in systems' 
resolv.conf (especially for privacy concerns)? What if i do that even in 
systems which are not connected directly behind IPFire or are connected 
to some VPN that is supposed to push the DNS settings to the clients 
(again, especially for privacy concerns, but also because behind a VPN 
you expect to use internal resolving also; I wonder who will benefit 
from a huge list of internal records if DoH is being used).

I get the need to encrypt the DNS traffic, but this is already done 
properly with DNSCrypt, but forcing DoH in browser is a bad and wrong 
decision.