From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: Should we block DoH by default?
Date: Tue, 03 Mar 2020 17:18:57 +0000
Message-ID: <596BD1FF-1BCB-4184-A92C-86F19E6104FD@ipfire.org>
In-Reply-To:
 <trinity-21efe4ee-9c48-4e90-a89d-5fe5f7bad82b-1583251584840@3c-app-gmx-bap01>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8838991035421059601=="
List-Id: <development.lists.ipfire.org>

--===============8838991035421059601==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Thank you everyone for this lively discussion.

So I guess just blocking isn=E2=80=99t acceptable for everyone.

What we could do instead is adding a checkbox to the new DNS settings section=
 and call it =E2=80=9CEnforce using IPFire as DNS resolver=E2=80=9D.

That could then activate the following:

* Filter the domain name that Firefox uses to auto-enable DoH (*)

* Reject any client connecting to any other DNS server on the internet

Then, the only way to get DNS is to use the IPFire resolver. How is that?

-Michael

(*) I have absolutely no idea what they were thinking to entirely throw DHCP =
out of the window and decide that they can configure clients. That is an abso=
lute no go. I think Mozilla opened a very very bad can of worms here and ther=
e is no chance to put the lid back on. I find this absolutely ridiculous what=
 we are considering doing, but Mozilla clearly had other priorities. I do get=
 the idea of it, that everyone has access to a free internet, but that is alr=
eady the case on my network. I have a DNS resolver that does things for me th=
at I want, and they are simply breaking common practise here. And that not ev=
en for all users, but only for a random selection. And on top of all of this =
they partnered up with Cloudflare after self-hosting everything for privacy r=
easons for years. Absolute bollocks.

> On 3 Mar 2020, at 16:06, Bernhard Bitsch <Bernhard.Bitsch(a)gmx.de> wrote:
>=20
>=20
>=20
>> Gesendet: Dienstag, 03. M=C3=A4rz 2020 um 16:55 Uhr
>> Von: "Tapani Tarvainen" <ipfire(a)tapanitarvainen.fi>
>> An: development(a)lists.ipfire.org
>> Betreff: Re: Re: Should we block DoH by default?
>>=20
>> That is different: again, as sysadmin I may want to enforce such
>> rules inside my net, one way or the other.
>>=20
>> Perhaps I should also note that Firefox allows you to choose your own
>> DoH server, you don't have to use Mozilla or Cloudflare or whatever,
>> and at some point it might be good to have DoH server built into
>> IPFire.
>>=20
>=20
> To clarify from my side. It's not DoH that brought up the discussion, but t=
he decision of Mozilla to enable it by default "silently".
>=20
> - Bernhard=20
>=20


--===============8838991035421059601==--