From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: Should we block DoH by default? Date: Tue, 03 Mar 2020 17:18:57 +0000 Message-ID: <596BD1FF-1BCB-4184-A92C-86F19E6104FD@ipfire.org> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8838991035421059601==" List-Id: --===============8838991035421059601== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Thank you everyone for this lively discussion. So I guess just blocking isn=E2=80=99t acceptable for everyone. What we could do instead is adding a checkbox to the new DNS settings section= and call it =E2=80=9CEnforce using IPFire as DNS resolver=E2=80=9D. That could then activate the following: * Filter the domain name that Firefox uses to auto-enable DoH (*) * Reject any client connecting to any other DNS server on the internet Then, the only way to get DNS is to use the IPFire resolver. How is that? -Michael (*) I have absolutely no idea what they were thinking to entirely throw DHCP = out of the window and decide that they can configure clients. That is an abso= lute no go. I think Mozilla opened a very very bad can of worms here and ther= e is no chance to put the lid back on. I find this absolutely ridiculous what= we are considering doing, but Mozilla clearly had other priorities. I do get= the idea of it, that everyone has access to a free internet, but that is alr= eady the case on my network. I have a DNS resolver that does things for me th= at I want, and they are simply breaking common practise here. And that not ev= en for all users, but only for a random selection. And on top of all of this = they partnered up with Cloudflare after self-hosting everything for privacy r= easons for years. Absolute bollocks. > On 3 Mar 2020, at 16:06, Bernhard Bitsch wrote: >=20 >=20 >=20 >> Gesendet: Dienstag, 03. M=C3=A4rz 2020 um 16:55 Uhr >> Von: "Tapani Tarvainen" >> An: development(a)lists.ipfire.org >> Betreff: Re: Re: Should we block DoH by default? >>=20 >> That is different: again, as sysadmin I may want to enforce such >> rules inside my net, one way or the other. >>=20 >> Perhaps I should also note that Firefox allows you to choose your own >> DoH server, you don't have to use Mozilla or Cloudflare or whatever, >> and at some point it might be good to have DoH server built into >> IPFire. >>=20 >=20 > To clarify from my side. It's not DoH that brought up the discussion, but t= he decision of Mozilla to enable it by default "silently". >=20 > - Bernhard=20 >=20 --===============8838991035421059601==--