Firefox now defaults to DNS-over-HTTPS for US netizens and some are dischuffed about this Mozilla has started rolling out encrypted DNS-over-HTTPS (DoH) by default for US users of the nonprofit's Firefox browser. DoH encrypts DNS (Domain Name System) traffic, which has both security and privacy benefits, though use of the DoH protocol itself is not the only issue here. The other question is, whose server do you use …
I object to DoH for security reasons.
While it certainly does increase security in one way, it does so at the cost of security from other directions. Given that it is possible to obtain the security benefits of DoH in other ways that don't bring a security hit with them, this seems like an unnecessary compromise to me.
Agreed. I use a local (to my network) DNS server which connects upstream to a main DNS server using DNS over TLS (same security as DNS over HTTPS, just using the standard DNS protocol) and DNSSEC.
That then covers all services and all devices on the network.
It makes trouble shooting much easier. If the browser stops working, you can use other tools to check the network connection and they respond in the same way.
I also have around 2.5 million tracking, malvertising and malware websites blocked by my DNS server. I don't want the browser ignoring that.
If I am out-and-about
Yes. That is my point. If they want to do something to help users, they should be helping them learn how DNS works and to secure their networks. Instead, Google are breaking DNS in a way that cuts other data gobblers out of the equation and allows them to get all the information on a connection.
Firefox are going half-way and providing a, theoretically, indepedent DNS provider, who won't log your lookups.
"Google just want to use DoH so they can get the data on what you are resolving"
If that's true, why haven't they enabled it in Chrome? (It's only available in Firefox so far).
Why haven't they set up a DoH host? (Firefox are using Cloudflare so far).
At least try to remember which companies you're ranting about.
I don't understand why DNS over TLS isn't being pushed as the way to go. It seems like a far more sensible way to go, but seems to be pretty-much ignored
Because the OS builders didn't get behind it, DNS resolving isn't a browser function but a network/OS function. For lack of DoT DoH was developed.
I disagree on so many levels. First off, your DNS config has always been forced on you (unless you're a technical person) by your ISP since the days of dial-up. Nobody objected to ISPs forcing *their* DNS service on their users.
Also, DoH protects people where they need it the most. Public WiFi.
Chrome's approach seems sensible, but it's unlikely your ISP will switch on DoH as they will receive considerable pressure from Gov, Law enforcement etc.
DHCP picks up a default DNS server, but that's not even in the same league as an application picking its own server in defiance of system configuration. If I do, for some reason, change my system DNS configuration, I damn well expect all applications on the system to honor it, not to have to chase down any and everything that can access the internet and hope I can change its configuration to match.
There's simply no justification for Mozilla's behavior - period.
I get this in one sense that the OS should be the ultimate arbitrator of what happens on the system. You want to 'know everything' that goes on in a modern OS preventing data leaks etc.
But we have had many applications that have gone around system configs. I'm thinking my VPN application here changes my network settings to make VPN work. What about Outlook and O365 probably does some things that make that service work. I think Cisco even sells this service for OpenDNS. I don't think this is really a big deal really.
I have to point out that you pay the ISP for internet service, a part of this service is DNS which the majority of home users won't know how to change (Other bolt on such as email addresses and web hosting these days are less important).
I have no issue with this, I have an issue on supplied routers not letting you change DNS Settings especially if you pay for the router (Looking at you BT).
They've been breaking it for years, if I enter n1a in the address bar I want to go to that host. I don't want to search for it - that is what a search bar is for. I certainly don't want you to try n1a.com and similar before you go to where I told you.
Just do what I damn well tell you. I'm fed up of browser vendors making arbitrary decisions about what is in my interests.
No I want n1a, or maybe fred, wilma or barney, resolved by my dns server, or perhaps from my /etc/hosts file. I don't want to go to the effing internet, I want to go to the machine downstairs on the third floor called betty. If I want to search for something on the "BIGGER THAN ME" internet, I will perform a search, not type n1a in my F*CKING ADDRESS BAR WHERE YOU PUT A F*CKING ADDRESS NOT A SEARCH TERM. I'm not searching for nude pictures of Betty White, I have a machine called betty which I can happily 'ssh betty' to, but when I want to just go to betty's stupid apache server, I have to type in http://betty/, and I have a 50/50 chance I will get those nude pictures.
AAAAAAAARRRRRRRGGGGGGGHHHHHHHHH!!!!!!!
This bizniz of default to internet search, which happens to be where mozzila get their money from, is telling. If they really cared about privacy they would not send data to search engine by default.
All dns to cloudflare is a shocking default.
Any one ever been hit by a dns hijack problem in the real world? Personally I have only been hit by the reverse, firefox going to somewhere i did not type and passing a whole url of private data with it.
And my network is smaller than the Internet and the Internet DNS server don't know anything about it.
n1a is a server on the local network, that the local DNS resolves. No need for the browser to go to Google or to use DoH, because it won't find it!
If I ping it, it translates to a local IP address, if I enter it into the browser, the browser ignores the DNS lookup and goes straight to Google/DuckDuckGo/whatever. You can override it with "n1a/", but most people generally forget the first time.
Except most. browsers have a multipurpose search & address bar and have done for years and it will second guess you, unless you add a protocol such as http://n1a, then generally it will realise that you want to go to that host and not look it up in $SEARCH_ENGINE.
I will admit, mixing the search and address bars is a great boon to the general public, but I've mostly found it to be a pain :( Oh, and get off my lawn!
Quite.
As always there are multiple correct answers here. Just as the anonymity argument on social media swings between "But trolls" and "But political activists operating in fear of their lives" or just people separating their online and professional persona (e.g. The Secret Barrister) so it is with the case for DoT/DoH.
DoH is excellent for not only securing your DNS but obfuscating it as general HTTPS traffic. It also bypasses possibly-compromised DHCP settings (though if the authorities are on your device it's already game over). For some people that's genuinely of interest and value.
But for general usage, the Browser is categorically the wrong place to be doing DNS. It makes the crucial assumption that you don't want to connect to LAN domains or use anything that your system might otherwise know about. Worse yet, Firefox's implementation allows you to specify only one "Trusted provider". When Cloudflare fell over last year, there was no way - other than manually changing your settings - to say "Yes, use NextDNS if Cloudflare is unavailable" resulting in resolution failures for everyone using it. What sort of fragile implementation doesn't allow for failover?
Of course there's a security argument there as well, but if you only trust one provider, you can just specify one provider. Those who prefer reliability can specify two.
Compare this to System-level DNS Resolvers - W10 lets you set a Primary/Secondary, macOS lets you set an arbitrary number in preferred order. Linux likewise.
"... W10 lets you set a Primary/Secondary..."
Win 10 lets you set any number, under advanced settings of the properties of the protocol.
Windows has done this since at least XP.
Granted, it's not in the most obvious place, but at least this one they've kept consistent through versions of OS (so far!)
Seems to think it is a good idea.
https://www.schneier.com/blog/archives/2020/02/firefox_enables.html
There are some good arguments in the comments about why it is a bad idea, though. Like most complex technical issues, I think there will be advantages and disadvantages depending on whether you are a non-technical user or someone who wants/needs finer control of their systems.
I'm afraid it does allow fingerprinting, something that is far more difficult with plain DNS behind a NAT, too little information in the latter to be much useful.
But an HTTP call can contain a lot of user information that can be used for fingerprinting.
What means they delete data after 24h and keep only aggregate one? That's enough time to extract any useful information. I'm sure they don't sell the data, they will just sell the use of them.
They should forget them the moment they send back a reply.
About a decade or so ago, when fibre first appeared for us, BT were the only operator providing the service (I had been refreshging the availability page and it went from a few weeks away to available!), so if I wanted fibre it was them or wait.
Being impatient and tired of my 3.5Mb (at best, on a good day), I signed up.
It didn't matter what you set your DNS servers to, BT forwarded all the traffic to their own.
Do they still do this, does anyone know?
Google also has plans to roll out DoH in Chrome, but with an important difference. It will only use DoH if the configured DNS server supports it, saying: "This would upgrade the protocol used for DNS resolution while keeping the user's DNS provider unchanged."
Right, so if I want to run a DoH server but don't want to expose UDP 53 (i.e. a "normal" resolver), Chrome's just not going to bother? Bit of a non-starter then.
Precisely. We'd all like more freedom of choice plus more security combined together, but the DNS providers seem to be dragging their feet on this. IMHO Mozilla has done the best that they can, provide DoH, using the few known, and trusted, DoH providers that currently exist.
Mozilla's choice is hopefully forcing the hand of the DNS system to finally step up and provide a larger number of alternatives, by implementing DoH across more of their infrastructure.
The problem with Google's "We'll use it if it is available" mantra is that there is no impetus for the DNS providers to actually create that functionality, as it is optional. If history proves anything, never give mediocrity as a 'reasonable' choice because that's exactly what you'll end up with.
Agreed. The point of distributed DNS is to prevent a single source from being overloaded. Cloudflare's whole business model is distribution and redundancy.
Unless you have local domains to resolve (if working for a corporation, browser configuration should be locked by IT policy anyway), why would you ever need your own copy of the DNS registry? It's not like there are allowed to be different public DNS registries, the entire internet would just burn in the resulting chaos (as happens occasionally when a major DNS power screws up).
The only problem with a single source like Cloudflare would be if we didn't trust Cloudflare to show us the page we wanted. It sounds like Cloudflare, being a ""trusted recursive resolver", is willing to be open enough to show this isn't really a concern.
I'm much more worried about what my ISP is choosing to do with it's man-in-the-middle status.
the problem is centralization. If your ISP's DNS goes down it only affects the ISP's customers
https://www.theregister.co.uk/2019/07/02/cloudflare_down/
Cloudflare has had a good chunk of outages over the years. Or at least their outages make news here more often than most any other CDN provider I can recall by a large margin, I haven't tried to get stats so my impression may be incorrect.
Having DNS ride on top of HTTPS makes things worse outage wise I'd expect as that is a pretty common data path. Cloudflare's CPU flare up last year I don't believe had any impact on their regular UDP/53 DNS hosting services (I was in talks with them at around that time to use them as a DNS provider).
I've run my own DNS both recursive(internal) as well as authoritative for my domains(external) since about 1998.
I'd be more open to DNS over HTTPS if there was actually a number of resolvers people could run on their own equipment. Last I checked I haven't seen any (one recent forum thread on the topic here someone pointed me to a product but it ended up being a simple proxy to an already existing DoH provider, not capable of serving DoH from say a local BIND installation).
Perhaps that situation has changed in recent months I am not sure.
I do fear the number of end user issues encountered as a result of split DNS on vpn systems where resolving some host externally results in a different address than internally and that behavior being intentional. I did something like this to block access to vulnerable CMS systems several years ago, if you tried to acess them externally they hit an address where the load balancer inspected the rule and only allowed very specific url patterns through, if you wanted to manage the CMS you had to be on VPN. If you tried to manage from outside you got a big warning page saying you needed to be on VPN.
Another similar situation recently where I adjusted internal DNS during an extended outage so that users on VPN could connect to the application, and users on the internet would get a maintenance page. An alternative solution would of been use host file entries for internal users but that is even more complicated. In fact I had to help one user deal with their host file entries from another similar event 2+ years ago that they never removed which was interfering with the new host file entries they were trying to use(tried to resort to host file entries for that user after all attempts to use DNS failed, only later did they disclose they had other host file entries already in place that were obsolete, so I just had them remove them all).
I'd wager in both of these cases Firefox's (and probably soon Chrome's and others) behavior will cause problems. The article mentions being able to push a policy, well good luck with that outside of very tightly controlled orgs(i've never worked at such an org in my 22 year career). Just another annoying thing to have to keep in mind when a user has a DNS related issue.
Already complex enough to try to get users to clear their DNS cache and/or browser dns cache/restart browser to get around DNS caching problems this will just make it much worse.
oh well, pales in comparison to the headache that will be the new SSL expiry issues, ugh.
> I'd be more open to DNS over HTTPS if there was actually a number of resolvers people could run on their own equipment. Last I checked I haven't seen any (one recent forum thread on the topic here someone pointed me to a product but it ended up being a simple proxy to an already existing DoH provider, not capable of serving DoH from say a local BIND installation).
It's perfectly possible to run your own DoH Server. The post covers a few options for how you handle the back-end, but the base principle is
- Get the DoH terminator up and running
- Configure it to forward onto the resolver of your choice (which may well be a local BIND instance)
Personally I've got it forwarding into Pihole (for ad filtering), which then sends into Unbound (because I have some additional config in Unbound format). You can just as easily _just_ use Pihole, or install BIND etc.
I do fear the number of end user issues encountered as a result of split DNS on vpn systems where resolving some host externally results in a different address than internally and that behavior being intentional.
You _can_ address that to a limited extent where you're running your own DoH server. Basically, you need 2 and need to split-horizon those too. The internal one returns the VPN/local addresses, the external one the external addresses.
I've not done as much with that though.
Cloudflare does in principle have a resilient setup but it is by now means infallible - it fell over a few weeks ago. The problem is that every node in its network is identical so a problem in hardware or software affecting one may well affect them all.
Centralisation is in general a bad idea, both because it reduces diversity and also because the large pools of data that inevitably result from it are very attractive to hackers, include the so-called "state actors". And anyone that thinks Cloudflare, or indeed any of the other providers, can withstand a determined attack by a state actor is deluded.
I love the idea of DNS over HTTPS - I have it enabled myself in PiHole, using applied-privacy.net as my DNS over HTTPS provider, it works great. My devies uses PiHole as their primary DNS server, so no need to fiddle with DNS on an application level. DNS at application level seems weird,
I don't like that Mozilla are changing something so central by default; even if it's done with good intentions, it normalises such things and then before you know it, less ethical players such as Google will follow suit.
I don't like that Mozilla are changing the behaviour of their software deliberately based on your territory, that feels a bit weird.
This post has been deleted by its author
My local ISPs (PlusNet and Virgin) who are under the control of the UK government or an ISP in the USA which is not directly under the control of the UK. For now I'll take the USA provider, with the added advantage that my requests are encrypted over the wire. I'm sure the UK government will at some point roll out a DNS platform that we must all use by law until then I am happy with having options.
"One question is who is more trustworthy?"
That isn't one question, that's a multitude of questions. Because some entity I would trust with regards A I would not necessarily trust with regards B.
Some examples:
Whom do I trust more not to immediately give all of my data to the US government? US ISP or UK ISP? I would go with the UK ISP on that one.
Whom do I trust not toi immediately give all of my data to the Chinese government? Whichever one has the better security, which isn't easy to tell.
Whom do I trust not to immediately sell my data to anyone who flashes their wallet? I would trust the UK ISP more in this regards, as there is both a customer relationship there and they are, at least in theory, regulated by some pretty powerful laws.
Whom do I trust not to screw everything up massively? Well, not Virgin, for example.
etc.
If you're concerned about keeping your DNS data private I'd stick to a UK / European provider as they're all covered by GDPR. I would definitely avoid any US company as the personal data for non-US citizens that can be reasonably assumed to be located outside of the US can be accessed by US law enforcement authorities without a warrant under FISA 702. And note that this applies no matter where in the world the servers are located.
Ah, so that's why my DNS-based ad server blocks suddenly stopped working. :P
If you wonder why google's such a huge proponent of this technology, now you know...or are they? Google is farily meh on doh arent' they? Odd, since they're pretty pro on HTTPS-everywhere in every other respect.
Exactlly:
"DoH combined with a third-party resolver makes it harder for" user-controlled DNS server to block advertising - or other sites which should not be reachable for whatever reason.
Many company blacklists may stop to work - if they don't fully ensure which browser are used and how they are configured. If Mozilla wants to increase its market share, maybe that's not the right way.
I think I've mentioned this before, but companies have one of two solutions now due to DoH:
1.) Block or MITM all HTTPS traffic. Legality concerns (i.e. is the promise of the company's firewall to only MITM for site blocking enough if the firewall truly does forget the data as soon as it's checked the blacklist/whitelist enough to satisfy the rules?) apply. In the USA though it'd probably be where the mandated logging gets installed, since the infrastructure to capture the browsing destinations and origin machines is already in place.
2.) Deploy VPN to the desk (no VPN session, no Internet access of any type) along with completely locked down, fully corporate controlled computers. This means whitelisted apps, and is a lot more invasive. It stops anyone on the technical side from doing much of their job or makes anyone that has an exception to e.g. run VMs a prime suspect in any computer crimes investigation (in Blighty, that probably means arrest first and ask questions later).
What Mozilla has done is effectively funnel the personal browsing of workers into their oh-so-easily-tracked mobiles. Great job increasing privacy!
> Block or MITM all HTTPS traffic
This is what I've done for my home LAN -- all HTTPS traffic is funneled through a MITM proxy so that I can filter out any DoH requests and drop them. I'm still on the lookout for a better solution, but I don't think that one exists.
Unless all your "personal browsing" is routed to your own home network (using mobile openvpn to pivpn in your house), and then goes out via pihole set up to cut out mobile advertisers and using DoH.
I realise that using this methodology conveniently routes ALL of my home and roaming internet activity through a single path which is a downside if anyone was genuinely interested in me. But I'm in the UK and mildly inconveniencing mobile provider/ISP/UK government information gathering (as a boring law abiding individual) brings me some satisfaction.
If I was really paranoid I could set up a second pivpn for mobile use which would routes out of my home network using openvpn as well, but like I say I'm not /that/ interesting.
Disabling DoH on a network is mind boggingly trivial. If the admin doesn’t want to use an enterprise policy then can just use a Canary Domain on his DNS to return NXDOMAIN, Firefox checks this at startup and then doesn’t use DoH. Voila, local DNS with blacklists will continue to be used.
PiHole even has it implemented.
> If the admin doesn’t want to use an enterprise policy then can just use a Canary Domain on his DNS to return NXDOMAIN, Firefox checks this at startup and then doesn’t use DoH.
Doing this will not affect software that really wants to use DoH. It will only affect webpages that use the FF-supplied mechanisms.
Except of course that any other application on your device that decides to use DoH will likely ignore the canary domain as well as your local DNS settings. And let's not forget that malware is also using DoH to hide from your firewall. Oh and Mozilla may withdraw the canary domain option in the future anyway.
Apart from that you're good.
The answer is obvious: use DNSSEC and DNS-over-TLS (DoT), with the latter having its own port instead of trying to sneak along with other HTTPS traffic.
Client-side DNSSEC validation ensures that the DNS record is genuine. DoT ensures that nobody can look at those queries (for whatever reason...).
DoH is an unnecessary complication to DoT that adds a lot more overhead. Having random apps on your system dodging local and network-level security by pretending to be plain HTTPS traffic is a security nightmare. Implementing DoH on embedded devices is inconceivable, unless unnecessarily adding an entire webserver to said device as a dependency overhead (and security risk) can be considered to be a good idea by anyone.
Elledan,
"The answer is obvious: use DNSSEC and DNS-over-TLS (DoT)"
But, DoT is very easy to block by disallowing Port 853 !!!
DoH is not as 'pure' But is not so easy to block.
If you use 'Dnscrypt-proxy' you can use DoH in Firefox and it will go to your own DNS Resolver.
(See https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH)
Since FF is open source; this means that the innards are on display which means the technical amongst us will block 1.1.1.1 at the router.
And so on and so forth
Not great as a situation but FF will have to fallback to normal OS DNS resolution at some point otherwise it’s dwindling market share will quickly drop to zero when the likes of my family can’t view cat videos.
There are several Linux-based tutorials out there, and the overhead is minuscule. I'd imagine that pre-rolled containers will be popping up shortly. At that point you can control how DNS resolution occurs within your personal or business environment; what is forwarded upstream, filtered, etc.
there is no way you can force applications to use your DoH resolver
But that statement is true whether or not Firefox use DoH. Any application (or even any javascript running in any browser window) can decide it will do name-to-address translations using their favourite web site if they want. Even if there was no such thing as a DoH spec, Firefox or Cloudflare in existence.
Firefox implementing it means the vast majority of those apps will just let FF do the lookup for them and so give me controls to send that to my own server. It changes nothing for the ones who are going to their own DoH server,
> But that statement is true whether or not Firefox use DoH.
Yes indeed -- that's rather my point, and my objection to DoH. That it exists as a standard is the problem with it, not that it exists in FF.
> Even if there was no such thing as a DoH spec, Firefox or Cloudflare in existence.
But without DoH, it's simple to detect and filter DNS lookups when they do. If they use a nonstandard, private DNS server to avoid that sort of defense, then it's easy to block all access to that server.
While it was always technically possible to do surreptitious DNS lookups, that there is a standard mechanism to do so now, supported by mainstream DNS providers, means that the number of people actually doing this will grow from "insignificant" to "reasonably common".
> Firefox implementing it means the vast majority of those apps will just let FF do the lookup for them
Yes, but those aren't the apps I'm worried about. I'm worried about ne'er-do-wells, such as martech companies and other spies.
Most consumer users just rely on what their ISP-provided router make available. While technically-savvy users will work around DoH if they think they have, they are still a small percentage of the overall public - and those gathering the data know that.
As if I'm going to let Mozilla choose a "name resolution partner" to control my DNS lookups. Not interested, not having it.
I don't do ISP DNS servers anyway, I use a service that I trust to return current (respecting TTL), unbiased results. In resolv.conf files as well as in my router/gateway for any other clients. I've also considered forcing redirection, but don't want to limit my abilities to query other name servers directly.
If you want the high conspiracy theory, then I would point to the recent news that the CIA bought and ran a Swiss manufacturer of encryption machines for decades. There are those who believe, not without precedent that firms such as Cloudflare through which so much of your private data flows are just there as part of the vast data collection efforts of various intelligence agencies.
Personally, I don't think it's possible to discount this possibility nor confirm it. Much like Huawei, the question becomes, is it worth the risk?
This is a really valid point. We don't think it's the case, but who's to say for sure?
Also, what if they have been issued a secret subpoena requiring them access to all the DNS logs?
Alternatively just targeting their network data which I've read can be fingerprinted to identify lookups. A massive project, but certain people have big pockets and by putting all your eggs in one basket it means they have less networks to target. Cloudflare/Google DNS being the main ones.
Anyway, 99.9999% of people don't know what DNS Sec is, so I think Fierfox have done the right thing for today. In a years time there might be a better option. If you're a techie you can change it in the options, if you aren't you would have no idea and noprotection anyway, so something is better than nothing.
Define "aggregated" - that's a weasel word. We don't know really what they mean when they say "aggregated" and we don't know its granularity. A "user" profile is an "aggregation" of data too, they can't store every single search or other detailed data (and search through them each time a marketer ask a target group) - they're going to aggregate that data. And sell the target group, not the data.
Anyway even less granular data could be useful - say for example you can work out the age group, income level and location for particular searches (and that's a kind of aggregation), it's evidently something you can sell.
A malicious DNS server could direct you to a site you did not request...
...whether you talk to it over HTTPS or not, so DOH doesn't do anything to address this. Forcing the resolver to cloudflare (as per FF) does, but only for things going via FF and is thus nowhere near a full solution. All this does is impart a false sense of security, a dangerous thing.
This company lost its bearings long time ago. Used to be that the user was the master. Give them all the options so that each user can customize their browser whichever way they want. "Take back the internet" was their slogan, because MS was taking the control away from you.
Then, (in my paranoid opinion after a MS mole infiltrated the organization, just like in Nokia's case) they did a 180 and decided that they will go after the user that doesn't know better. Well that market already has a trillion-pound gorilla and a trillion-pound elephant catering to them.
Now what? After pissing their loyal base off, have they reversed their market share loss? Have they at least stopped sinking? Neither, and in my cynical mind they are just waiting for a Nokia style bailout...
In some respects the security services may be quite happy with this. As the browser is forcing the choice of DNS resolver it will be much easier for the US security services to assert control over the resolvers it points at rather than having to pull the data from the ones controlled by the ISP's. This will let them see in real time the sites people are looking at. Should someone decide to point their DNS at another site I'm sure a browser update could be "arranged" to reset the configuration, and very few would notice.
"Cloudflare argues that filtering and blocking traffic via DNS is a poor approach. "Application-specific controls such as browser extensions would be more effective since they can actually look into the URLs and selectively prevent content from being accessible," said Peter Wu, part of the Crypto Team at Cloudflare."
Seriously? A browser extension? Oh, that'll work really well... until 10 seconds after I've left my kids room, when it'll be disabled.
DNS is a network function, that should be handled at the network layer and seperated from web traffic.
DNS needs to be resolvable from different locations (especially in enterprise) as you need to point people to internal resources.
DNS needs different treatment and higher priority than web traffic.
DNS should use TLS for integrity and confidentiality
DNS should use certificates for authentication
secure DNS should be on its own port
use DoT (DNS over TLS) to connect to an endpoint authenticated by DNSSEC
This can be handled in the network stack
This can be pointed at any resolver
This can be prioritised over web traffic
This uses TLS
This uses Certificates
This is on its own port
They have broken sooo much, by breaking DNS.
Everything that you or your organization does with DNS is broken. (In firefox)
How many millions of bind/nsd/dbsmasq servers out there have been bypassed by this change.
No warning. Just break shit and watch people walk off to Chrome.
Hows your market share doing with all these security enhancements, Mozilla.
This will be the nail in the coffin of FireFox.
Someone needs to fork.
This post has been deleted by its author
.deb packages The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
