clean up / enhance: 0707: DoH

[Thorin-Oakenpants]

currently

/* 0707: disable (or setup) DNS-over-HTTPS (DoH) [FF60+]
 * TRR = Trusted Recursive Resolver
 * 0=off by default, 1=race (removed in FF69), 2=TRR first, 3=TRR only,
 * 4=race for stats but always use native result (removed in FF69), 5=explicity off
 * [WARNING] DoH bypasses hosts and gives info to yet another party (e.g. Cloudflare)
 * [1] https://www.ghacks.net/2018/04/02/configure-dns-over-https-in-firefox/
 * [2] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ ***/
   // user_pref("network.trr.mode", 0);
   // user_pref("network.trr.bootstrapAddress", "");
   // user_pref("network.trr.uri", "");

I think we should get this up to date

Some pointers

• The ghacks link is old and limited
• There is now a UI for some of this which we can add in
• There are new prefs as well
• maybe add something like: https://www.privacytools.io/providers/dns/#icanndns

Note: This is not something I want to enforce on anyone: it will (probably) stay inactive. I haven't really followed it, but there are pros and cons to both sides, not to mention lots of other variables (such as what are you using at an OS/network level). But it does need a good update

Suggestions?

[ema-pe]

Hi, this article says Mozilla will gradually activate DoH for US users in late September. The article also says that Firefox will give an opportunity to opt out.

I do not have an opinion about DoH, but I am sure to disable it for now. I think that you should insert two different points of view, like this article.

[rusty-snake]

What do the other user.js's

pyllyukko user.js:

// PREF: Trusted Recursive Resolver (DNS-over-HTTPS) (disabled)
// https://wiki.mozilla.org/Trusted_Recursive_Resolver
//user_pref("network.trr.mode",                 0);

privacy-handbuch user.js

user_pref("network.trr.resolvers", '[{ "name": "Cloudflare", "url": "https://mozilla.cloudflare-dns.com/dns-query" },{ "name": "SecureDNS", "url": "https://doh.securedns.eu/dns-query" },{ "name": "AppliedPrivacy", "url": "https://doh.appliedprivacy.net/query" },{ "name": "Digitale Gesellschaft (CH)", "url": "https://dns.digitale-gesellschaft.ch/dns-query" }, { "name": "Quad9", "url": "https://dns.quad9.net/dns-query" }]'); 

[Atavic]

I'd say from version 62.

DoH support has been added to Firefox 62 to improve the way Firefox interacts with DNS.

https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/

[KOLANICH]

IMHO - If one wants encrypted dns requests, he probably should use https://github.com/DNSCrypt/dnscrypt-proxy

[rusty-snake]

changing the value to 5, and I was thinking of making it active

Sounds good. It would prevent that all your (Browser) DNS-traffic is send to cloudflare. I do that in my overrides.

[earthlng]

You got the impression that I wanted more DoH prefs added? I don't remember ever saying anything to that effect.

Anyhow, I'm always in favor of adding more quality links and setting the default value to 5 also SGTM but I'd keep the pref inactive because IMO it should be up to each user to decide whether they want DoH enabled or not. The users in the US that get DoH enabled as part of the staged rollout are shown a notification prompt where they can opt-out and for everyone else DoH is still default-disabled so no need to force-disable it for everyone IMO.

[rusty-snake]

@Thorin-Oakenpants two thing

1. what about adding network.dns.skipTRR-when-parental-control-enabled commente here (see FF70 diffs)

2. You could do this at the OS level instead; e.g. DNSCrypt.

This is a bit confusing, because DNSCrypt is another protocol to encrypt DNS-Traffic.

[rusty-snake]

There is a lot more interesting network.trr.* stuff.

and has a UI

But

1. it is a bit hidden (End of about:preferences > Button > PopUp > Scroll down)
2. The UI sets it to 2 not 3, thats a potential leak of DNS traffic.

---

Or rip it out if you want.

[Thorin-Oakenpants]

don't get your panties in a twist - the tag is used to filter for changes to the user.js / wiki

[earthlng]

removing useful information is an awesome enhancement ;)

[earthlng]

That's not trolling - just voicing my disagreement using sarcasm to highlight the fact that removing information is not an enhancement.

Look, you opened this issue to "clean up / enhance" 0707 so clearly the burden is on you. Nobody asked for any changes or said anything about 0707 being outdated, incomplete or whatever. Then you weren't satisfied with the responses you got and decided to just remove it instead of just closing the issue which is what you should've done. Even if the information were outdated, which it wasn't, that's still better than no information at all. It listed the 3 most essential prefs as well as all the available values and that's all that's really needed for someone to either force-disable TRR or set it up the way they want.

You also said that it has a UI to which @rusty-snake responded, and rightfully so, that the UI is fucking useless (my words ;) because it sets the mode to 2 and has no option to use mode 3. Fe. the other day we had a guy report an issue with TRR and if he didn't know about mode 3 and just used the UI instead, he might have ended up under the impression that he's now using TRR while in reality it would've just fallen back to native resolution - because the UI is fucking shit! Now, IDK how he learned about mode 3 but I'd like to think that he probably saw it in the user.js - before you ripped it out :)

and re-invent the wheel that a thousand articles and websites already provide

that's just a shitty excuse. If that were a criteria we could probably remove 50% of the user.js because articles get written about pretty much everything. I mean, why provide any links at all if users could just google it, right?! sorry but that's just stupid

14 lines for one pref.

We're at somewhere around 1800 lines and I couldn't care less if we ended up at 4k lines. This is supposed to be a (if not "the most") "comprehensive" user.js template, right? So who the fuck cares about # of lines.

asked for help ... and no-one fucking helped.

you said that before - "So, no one cares?" - after 2 people already replied! That's not exactly encouraging collaboration. Why should anyone contribute anything if you just disregard/ignore what they say?

And similarly, I really, really, REALLY don't like your threats! like "Do something or else ...!", fe

That's my draft. You guys fix it up (and hurry up), or I'll rip it out

When I saw that I just said fuck it, let him do whatever the fuck he wants, I'm outta here. That was until you added the enhancement label at which point I just couldn't resist to say something

ps. if a smiley makes this blunt criticism any better or less offending, here you go ... :)