Hacker News
points by ToucanLoucan 1 day ago | 0 comments
Can confirm, Firefox did this forever ago. Become my ritual during a rebuild to turn DNS over HTTPS off because it fucks everything up.

Edit: Found it, February 2020: https://blog.mozilla.org/en/firefox/firefox-continues-push-t...

[–] pelican0 1 day ago
> Become my ritual during a rebuild to turn DNS over HTTPS off because it fucks everything up.

Out of curiosity, what are some of those things it messed up for you? And what kinds of builds is it affecting?

[–] ToucanLoucan 1 day ago
Like I said, internal DNS. I have my own DNS server with a small set of records for my own internal sites, mostly automation tools alongside the websites I've built and maintain for small businesses near me. The latter are the easiest to explain, for example, if I built joescoffee.com I wouldn't work in production obviously, I'd work on a copy hosted on my local server at joescoffee.myhouse.com, make my changes and then push that code live. Because Firefox and Chrome (and likely others) roll their own DNS server though, I have to configure that separately, because while my machines all get their DNS from the DHCP leases I've already configured which point all DNS queries to my internal DNS server, DNS over HTTPS bypasses that and contacts public DNS servers directly.

And like, I don't need that. My DNS server is properly maintained and queries those exact same servers itself when you request something like google.com or apple.com. Putting a separate friggin DNS query AND cache in a browser is just more trying to protect people from themselves IMO, and introduces this weird issue where you can't hit an internal site in Firefox, even though you're running `nslookup` on your freaking computer, and it's giving you the proper IP address. And paradoxically putting the IP address in makes the browser find it when the domain you can see correctly resolving in terminal isn't resolving in the browser is fucking obnoxious.

It also would render a pihole useless because Firefox despite the PC's DNS not resolving ad provider's names, WILL resolve them, ensuring an attack vector for malware remains wide open even if you've tried to close it.

And while I'm bitching about this: STOP DEFAULTING EVERY CONNECTION TO HTTPS. Any properly configured website is going to do this anyway, the browser also doing it, again, just annoys the piss out of anyone trying to host stuff locally because why the fuck would I get certificates for servers that aren't even exposed to the damn Internet!?

[–] Dylan16807 1 day ago
> And while I'm bitching about this: STOP DEFAULTING EVERY CONNECTION TO HTTPS. Any properly configured website is going to do this anyway, the browser also doing it, again, just annoys the piss out of anyone trying to host stuff locally because why the fuck would I get certificates for servers that aren't even exposed to the damn Internet!?

Attackers won't do it. The browser itself has to put barriers in front of http for public domains.

But yeah it shouldn't get so fussy for local IPs or local DNS.

[–] emn13 21 hours ago
While you say many reasonable things and describe a perfectly reasonable setup and desire - surely it's clear that your situation is _extremely_ unusual? Browsers are absolutely _also_ reasonable in prioritizing secure defaults for setups that are not similarly controlled. After all, precisely the thing that makes your situation managageble and reasonable - that being you the knowledgeable admin - is also the thing that allows you better than the average user to change defaults.

Both from a sheer numbers perspective and also from the perspective of qualitative differences between these audiences browsers are doing the right thing - prioritizing security in low-to-no-trust environments assuming low-to-no-competence administration.

[–] solyin 1 day ago
QFT! My http://nas.lan isn't getting a cert, nor public DNS. I know what I'm doing. Firefox, stop fucking things up, it's hard enough to use you instead of Chrome, don't make it harder by copying everything they do!
[–] pelican0 1 day ago
Fair enough, carry on.
[–] bombcar 1 day ago
My browsers shit themselves if I try to go to http://191.168.0.1 and meanwhile https://1.1.1.1 is a thing.