Turn off DoH, Firefox - <AUTHOR> https://ungleich.ch/en-us/cms/blog/2019/09/11/turn-off-doh-firefox/ <comment><USER3> This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have _far_ more lucrative avenues open than selling DNS requests by IP).

If instead what you worry about is the government spying on your traffic then complaining about DoH is even _more_ silly - DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany).

DoH is vital to protect users around the world from censorship and worse. Enabling it by default is a _good_ thing - protecting users from abuse shouldn't only be opt-in. There has to be SOME default chosen, and the default needs to be a site large and well run enough to a) handle the load, and b) be in the firefox HSTS preload list. There aren't a lot of good DoH providers that fit these criteria - CF is one of the few.

<comment><USER4> There's nothing that makes Cloudflare the more "privacy friendly" 3rd party. "Privacy friendly" would be a mechanism by which my desire to communicate with "example.com" involved my computer and the computer at example.com with _no_ third party in between.

As it stands Mozilla is switching out our local ISP for CloudFlare without asking our consent which means my traffic data is now spread around one _more_ company - that seems like less privacy.

And I am not looking forward to finding out the fun ways in which this will break our local DNS.

The idea that Cloudflare is in way more trustworty than my local ISP is at best naïve. All this creates is another huge centralized pool of data with no oversight whatsoever except the _promise_ of some company that is currently growing fast, that they will not do anything with that data. Come the times when money becomes tight again, we'll see how well that promise holds up.

Sure, encrypting DNS is a good thing. But this is just like trying to make email more secure by using a 3rd party encryption gateway - all it does is moving around who to trust.

That's not privacy - that's just silly

<comment><USER5> > that seems like less privacy.

Seems obvious, but is wrong. If there is a really obvious obstacle to anything, which immediately comes to mind, chances are people addressed this already.

In the US, Firefox by default directs DoH queries to DNS servers that are operated by CloudFlare, meaning that CloudFlare has the ability to see users' queries. Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.

[https://support.mozilla.org/en-US/kb/firefox-dns-over- https](https://support.mozilla.org/en-US/kb/firefox-dns-over-https)

<comment><USER6> Before, my ISP could gather the domains I visit by DNS. Now, they can still gather them from the IP addresses and SNI, _and_ Cloudflare can gather them from DNS. I'm really struggling to see how this isn't a reduction in privacy.

> Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that > forbids CloudFlare or any other DoH partner from collecting personal > identifying information. To mitigate this risk, our partners are > contractually bound to adhere to this policy.

What happens if they get a FISA warrant? How does your contract protect users that before didn't have their DNS queries sent to US companies?

<comment><USER5> Your ISP can gather them with much, much more effort. There is privacy value in making things harder. The only motivation your ISP has for logging this is making money; if getting the information is too tedious and expensive why would they bother?

> and Cloudflare can gather them from DNS

but is contractually forbidden from saving that information.

> What happens if they get a FISA warrant?

They have to follow the law? Wrong threat model.

<comment> a-raccoon > Wrong threat model.

You are not permitted to hand-wave corrupt government interception or rubberhosing of civilian data as "wrong threat model." These technologies are central to, and must be focused specifically on, protecting all civilian data from all governments. That is the primary purpose of all privacy systems. Not to protect you from coffee-shop denizens trying to snoop which dating sites you use.

<comment><USER7> Your ISP is subject to the same FISA warrant threat.

If it's one of the large monopoly providers, it's as much a one-stop-shop as Cloudfront is.

<comment><USER8> Not outside the US. Now unless Mozilla decides to pick a different DoH party for deployment in EU, the problem will come back.

<comment><USER9> The internet is as much of a monopoly outside of the US for example Tiscali in Europe. We have the same kangaroo courts when it comes to getting warrants to invade people privacy.

At least from a general perspective I don't see a big difference.

<comment><USER6> But it's not one or the other; an EU court will make a warrant for the ISP traffic data, and an US court for the DNS requests. You become vulnerable to both.

<comment><USER10> 220.127.116.11 operates on edges of CloudFlare CDN - EU users will be handled by EU DNS server. And there's no logging.

<comment><USER6> Cloudflare is still a US company. Do you have any FISA jurisprudence showing that simply running the server on another country makes it immune to warrants?

> And there's no logging.

Until the courts say there must be.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> It's very disturbing to see the overreach that Mozilla has resorted to and the "privacy" argument (it was "security" before that...) being used to justify essentially ignoring system configuration. My ISP has more accountability than a company in another country.

 _The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems._

Exactly. If Mozilla wants to, it's more than welcome to reach into the VPN area with its own products, but I don't believe this functionality should be part of a browser. They're already reaching into the VPN area[1], should they also investigate bypassing Chinese censorship with their own "firewall- busting" obfuscating VPN? That's not something most users want nor need in their browsers, and such functionality is really a cat-and-mouse game that I think is best left to smaller and less-well-known entities.

It's unfortunate that browsers are already beyond "neutral", when IMHO the only thing they should do is fetch exactly the page URL that was entered and display it.

Edit: yes, apparently people disagree and want Mozilla to control what the Internet (and every user, ignoring his/her default configuration) does. This is really _really_ disturbing.

[1] [https://news.ycombinator.com/item?id=20927832](https://news.ycombinator.com/item?id=20927832)

<comment><USER12> > the only thing [browsers] should do is fetch exactly the page URL that was > entered and display it.

I strongly disagree. Browsers deal with a hostile environment that poses countless threats to their users, and need to be safe. Arguing that browsers should be minimal and not protect privacy is like arguing that cars should be minimal and not have seat belts.

There is an argument that ensuring privacy in DNS could be done outside the browser. I think HTTPS is a good precedent for putting privacy in the scope of the browser; the browser should attempt to ensure that privacy expected by the user is established or it should refuse to operate.

I disagree with the solution of trusting Cloudflare, but privacy should be considered crucial to user safety in modern browser design decisions.

<comment><USER11> _I strongly disagree. Browsers deal with a hostile environment that poses countless threats to their users, and need to be safe. Arguing that browsers should be minimal and not protect privacy is like arguing that cars should be minimal and not have seat belts._

I strongly disagree. A browser has one job, and that is to follow and render URLs. Secure connections and such are services provided by other components of the OS, and the browser should absolutely use those services but not attempt to overreach its main purpose. It's really the principle of "do one thing and do it well".

To spin your analogy, you're arguing that cars should have seatbelts that also check your age and blood alcohol level because "that's also a safety thing".

 _There is an argument that ensuring privacy in DNS could be done outside the browser_

Yes, the same way that VPN clients are; and I'm perfectly happy for Mozilla to be working in that area, but most certainly do not put that in the browser and do not make it default.

<comment><USER13> What do you do as a browser vendor when the OS fails to provide you meaningful security and privacy? This is pretty much how we got here. Basically every device on the planet is right now configured to blindly accept whatever DNS server is handed to it by DHCP and there is really no movement on changing that.

So browsers can throw up their hands and say "we are as secure as the OS" or they can do it themselves. Not ideal but the alternative is worse for users.

<comment><USER11> _What do you do as a browser vendor when the OS fails to provide you meaningful security and privacy?_

Nothing. Absolutely nothing. Work within the environment you're given.

 _Basically every device on the planet is right now configured to blindly accept whatever DNS server is handed to it by DHCP and there is really no movement on changing that._

...and that's just fine, because I trust my LAN more than some third party in another country.

</comment></comment></comment></comment></comment><comment><USER14> Of course, I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government!

If you don't like CF just switch to different provider [https://github.com/curl/curl/wiki/DNS-over- HTTPS](https://github.com/curl/curl/wiki/DNS-over-HTTPS)

<comment><USER15> > I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and > government!

I trust my ISP and government more than a US company I have no formal contract with and the US government.

Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Firefox users on my network.

<comment><USER16> > I trust my ISP and government more than a US company I have no formal > contract with and the US government.

And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something better.

> Also, there's the whole 'applications should not override system level > settings' thing.

Hopefully, DoH will become a system level setting eventually.

<comment><USER17> If you use your ISP's DNS servers, there is no intermediary between you and them.

<comment><USER18> If you use wi-fi without a VPN, you have the coffee shop and the coffee shop's ISP. And anyone listening there. Of course there is cleartext SNI even for SSL connections... but alas.

<comment><USER15> What coffee shop ? I only connect to wifi at home and at the office.

<comment><USER18> And you're the only person who uses mobile computing devices.

<comment><USER15> Not sure what point you're trying to make here.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> This is a gross over-simplification. Cloudflare is required by contract to respect your privacy, which is much stronger than even the privacy laws have here in the EU since it addresses everyone, not just the EU population:

[https://developers.cloudflare.com/18.104.22.168/commitment-to- priv...](https://developers.cloudflare.com/18.104.22.168/commitment-to- privacy/privacy-policy/firefox/)

The people fighting for the status quo probably know how to run their own resolver, even with DoH or DTLS. But Mozilla's conundrum is how to protect _everyone_ 's privacy (and to a certain extent, security). DoH, despite all its flaws, attempts to do that by piggy-backing on already working infrastructure, so it seems like a good fit to move everyone to DoH. But then, they're the chicken-and-egg problem. How do you make sure people deploy local DoH resolvers if no browser enforces the move to DoH ? How do you make sure those resolvers are truthful, or even respect local law (having both is often impossible).

So, you need to compromise. I'd have preferred to have temporary non-profit third party entity handle this à-la-Letsencrypt, but Mozilla deemed its contract with Cloudflare sufficient to provide enough guaranties. Ideally, name resolution should be done closer to the user instead of being centralized like that. But by arguing instead of experimenting we just keep the status quo. Time will tell if this was a bad decision. But it's not as clear cut as this blog post says it is.

<comment><USER20> A contract where cloudflare receives no consideration isn't particularly comforting, as such agreements are routinely ignored by courts (or equivalently by capping damages at nothing).

> Mozilla's conundrum is how to protect everyone 's privacy

And exactly how does this protect user's privacy? Instead of the user's ISP being able to see where the user connects now both cloudflare AND the user's ISP (via seeing the connection itself) can tell.

<comment><USER19> Re: the contract, let's hope you're wrong.

Re: privacy: by not having lying DNS or no NXDOMAIN, there is also less tracking (say, fingerprinting in ad web pages).

And in the ISP's case, you're assuming they already do DPI, otherwise they now see IPs, which might not mean much in the CDN case. But if they do DPI, it will be resolved once ESNI starts being deployed.

<comment><USER8> > _Re: the contract, let 's hope you're wrong._

Switching from a technical measure of privacy (no data being shared) to _hope_ isn't the right way to go.

> _But if they do DPI, it will be resolved once ESNI starts being deployed._

Once.

<comment><USER21> > > But if they do DPI, it will be resolved once ESNI starts being deployed.

> Once.

This underestimates DPI vendors. eSNI can't stop them, they will just move to exploit side channel information (traffic patterns) to identify which websites you are visiting. People need to remember, that DPI industry has been fighting with obfuscation for years, it's a war where Cloudflare and Mozilla are compete newbies.

<comment><USER19> These are just unsubstantiated assertions. Fingerprinting does exist, but what you're saying is that there might be methods we haven't foreseen that will be implemented to improve DPI analysis and tampering. So what ? Do nothing in the meantime ?

</comment></comment></comment></comment></comment></comment><comment><USER22> > The correct way would be to standardise DoH and DoT and add support into it > into automatic address configurations and operating systems. Not in > applications!

You're right. But so are Mozilla.

Here we are 30 years into the web, and we're still using plain old DNS. DNS over TLS should have caught on, but it didn't. Apple and Microsoft had years to ensure it's implemented as standard, but they didn't.

The points this article makes - about DHCP options, about multiple providers, are very valid.

But they're also just talking shops.

The biggest problems here seems to be 1) DHCP can't give internal DOH servers. When I'm at home I want it landing on my own DOH server, but when I'm away I want to use a different one. 2) Internal DNS resolving falls to bits

<comment> m-p-3 Agreed, I'd prefer setting up the DNS-over-HTTPS config at the gateway level (and either push the config over DHCP, or have the gateway act as a local resolver, which forwards the new requests over DoH), but we're not there yet.

<comment><USER22> In theory isn't it "just" a matter of agreeing a DHCP option number, then having the DHCP client (or vpn client or whatever) be responsible for passing it to applications that want it (including the system resolver, be that mDNSResponder, systemd, glibc, whatever windows uses)

Anyone who wants to can configure their dhcp client to ignore it, or use a different service, you could even have applications doing that too, but this would allow a network operator to tell people where the recommended resource is.

Likewise if you want to change your DNS provider yourself you would have a single location on your machine to do it for the entire OS, rather than having to change 50 different applications.

</comment></comment></comment><comment><USER23> As someone who has donated to Mozilla over the years and used Firefox as much as possible, this makes me very unlikely to donate in the future.

People say that it's trivial to change. It's trivial to change for us who are technically minded. It's far from obvious and will not be changed by non- technical users.

This will only increase the massive amount of data that Cloudflare gets about people's online behavior. I am always very skeptical of centralization and of having a company get this much information. Remember google's Don't be evil? I'm extremely uncomfortable with such a massive centralization of data.

People might say that the status co is not great because DNS is sent to the ISP. I'd argue the status co is better because it's far less centralized. And, at least for Europeans, I trust European legislation better than US legislations.

I can understand the argument that some countries have mass surveillance and it's a net positive for users in those countries since it will protect them. But in that case, I feel that the default should be randomized from a list of provider, not only one company. I also would be much less concerned by this if it was an option on first startup with a clear explanation (even though users tend to not read and blindly click accept, it's at least more of an informed consent)

And anyway, that purpose of preventing mass surveillance and blocking in those countries where it would actually be useful seems to be moot because of: > Additionally, Mozilla is also working with ISPs to make sure users won't use DoH as a way to bypass legally-set blocklists.

> The organization said it's been asking ISPs and providers of network-based > parental control solutions to add a "canary domain" to their blocklists. > When Firefox will detect that this canary domain is blocked, it will disable > DoH to prevent the feature to be used as a filter-bypassing solution.

So, if isp in countries with censorship can use a canary website to prevent users from bypassing "legally-set blocklists". What is the point again of enabling this?

<comment><USER5> > This will only increase the massive amount of data that Cloudflare gets > about people's online behavior

No, it explicitly won't.

Mozilla has a strong Trusted Recursive Resolver (TRR) policy in place that forbids CloudFlare or any other DoH partner from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.

[https://support.mozilla.org/en-US/kb/firefox-dns-over- https](https://support.mozilla.org/en-US/kb/firefox-dns-over-https)

<comment><USER24> Which sounds nice in theory, but there are the usual legal exceptions:

> The resolver must not retain, sell, or transfer to any third party ( _except > as may be required by law_ ) any personal information, IP addresses or other > user identifiers, or user query patterns from the DNS queries sent from the > Firefox browser.

> Transparency Report. There must be a transparency report published at least > yearly that documents the policy for how the party operating the resolver > will handle law enforcement requests for user data and that documents the > types and number of requests received and answered, _except to the extent > such disclosure is prohibited by law_.

> The party operating the resolver should not by default block or filter > domains _unless specifically required by law in the jurisdiction in which > the resolver operates_.

This doesn't really matter if you live in the US, but most of us don't.

</comment></comment></comment><comment><USER25> There are two points:

1\. centralization of all dns lookups is worrisome

2\. Dns should not be handled by applications. It should be handled by the operating system.

I see a lot of people conflating the two in the comments.

<comment><USER26> > 2\. Dns should not be handled by applications. It should be handled by the > operating system.

I agree with #1 but why it should be managed by the OS?

<comment><USER27> It's annoying. I've already experienced this with chrome as chrome ignores my hosts file settings.

Example: Say you use hosts file to block porn and other shady sites for your kid, all they have to do is use chrome.

<comment><USER28> This has nothing to do with the topic. Chrome isn't replacing the OS's DNS resolver, and that bug is just that: a bug.

A bug that I cannot reproduce. Chrome follows my HOSTS file fine on Windows 10. But even if it didn't it would still be off-topic.

</comment></comment></comment></comment><comment><USER29> It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?

<comment><USER11> ...and a local HOSTS file.

So now it will, by default, contact all the ad/tracking hosts that you configured to be blocked.

"But now your DNS queries to those ad/tracking hosts are encrypted!"

No. I don't care. I didn't want to connect to those hosts in the first place.

<comment><USER30> Even worse, corporate _intranet_ addresses get leaked.

Everyone on this article saying it's FUD is either a framework junky, isn't seeing the bigger picture, or just focus on one wrong thing in the article.

<comment> m-p-3 It's actually FUD, because it's missing some important points

> For starters, Mozilla said that after it turns on DoH by default for US > users, Firefox will contain a mechanism to detect the presence of any local > parental control software or enterprise configurations.

> Additionally, Mozilla is also working with ISPs to make sure users won't use > DoH as a way to bypass legally-set blocklists.

> The organization said it's been asking ISPs and providers of network-based > parental control solutions to add a "canary domain" to their blocklists. > When Firefox will detect that this canary domain is blocked, it will disable > DoH to prevent the feature to be used as a filter-bypassing solution.

[https://www.zdnet.com/article/mozilla-to-gradually-enable- dn...](https://www.zdnet.com/article/mozilla-to-gradually-enable-dns-over- https-for-firefox-us-users-later-this-month/)

<comment><USER30> I hardly see how the OP is FUD. What the article states is true; just because you can opt-out doesn't mean it's wrong.

Where you are drawing the line is the opt-out to disable it, as opposed to the convention of opt-in.

Think about companies in the 50-200 employee range; As a sysadmin, I have to purposefully go out of my way to put that domain (use-application-dns.net)[1] in my root resolver, and point it to NXDOMAIN.

I can't do it if another provider is managing my DNS (ISP, cloud service...); it also doesn't actually guarantee that it is off.

> If a user has chosen to manually enable DoH, the signal from the network > will be ignored and the user's preference will be honored.

The basic IT mantra has been 'If it aint broke, don't fix it.' Mozilla itself is moving fast and breaking things; which is why we have standards in the first place.

For god sake, there isn't even a proper RFC to select yes or no to DoH.

I, as a sysadmin, must not only implement the domain in my resolver, but I also must keep in my mind that if a user is using Firefox, that there are things it does internally that are not right, and it is easier for me to have my users on Chrome, because it is less of a headache for me.

[1] [https://support.mozilla.org/en-US/kb/configuring-networks- di...](https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns- over-https)

<comment><USER31> Indeed, Firefox is prioritizing the interests of users over the interests of sysadmins. Personally, I'm fine with that.

> The basic IT mantra has been 'If it aint broke, don't fix it.'

An unencrypted protocol that compromises privacy may not be "broke" for sysadmins, but it is for users.

<comment><USER32> Well, now CF will know per-organization IT structures. All those LAN-only administrative interfaces, and, with link prefetching, internal resource maps could be built in just a few clicks , using account with sufficient privileges. This is such a security-defying move by Mozilla I can't even start. And CF DNS logs will be the obvious first step for every targeted attack.

<comment><USER31> Sure, if your targeted attacker has managed to compromise Cloudflare first… Not exactly a trivial prerequisite. If you have any kind of VPN or Wi-Fi access to your network, those domain names are already leaking to other DNS providers whenever someone accidentally accesses a URL while on the wrong network.

Also, if your internal resources are using publicly trusted SSL certificates, the domain names are already being broadcast to the public thanks to Certificate Transparency. If you're sophisticated enough to run a private CA for them, then you're probably sophisticated enough to set up use-application- dns.net as well – though I still wouldn't recommend ever treating domain name secrecy as a meaningful security boundary, considering how many ways they can be leaked. The remaining possibility is that your internal resources aren't using SSL at all... in which case you have bigger problems than domain name leaks.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> I had no idea this was going to be the default. It's massively wrong. I use a Pihole DNS server, which means after a lot of debugging I'd have discovered Firefox had unilaterally decided to _stop abiding by internet protocols_. It's always one step forward and two back with these Moz guys. I guess that's better than every step back like Chrome, but jeez Moz, get a clue.

</comment><comment><USER34> This misses the forest for the trees. In the UK ISPs are already legally mandated to log your web requests and provide them to the government. Those who live under free regimes should not deny those of us who live under oppressive governments the right to privacy of our communications. The fact that cloudflare is a US entity and thus not subject to UK law is the whole point.

<comment><USER35> > The fact that cloudflare is a US entity and thus not subject to UK law is > the whole point.

As a fellow citizen of a Five Eyes country, I assume that if any of those 5 have info about me that one of the other four wants it won't even be a question of paperwork for it to be shared.

<comment><USER34> The previous UK law, RIPA, was abused for investigating minor crimes such as fraudulently obtaining disabled parking badges. It's not just about national governments but local municipal authorities too. Yes I would prefer another jurisdiction but it's way better than the status quo whereby the browsing history is just handed over.

<comment><USER35> > The previous UK law, RIPA, was abused for investigating minor crimes such as > fraudulently obtaining disabled parking badges.

I understand that you're trying to illustrate a larger problem, but that example is likely to get you zero sympathy from anybody, anywhere.

I know that US ISPs have an established pattern of "just handing over" browsing history, but I have no idea what CF's track record is like.

</comment></comment></comment></comment><comment><USER36> > It is clear what Mozilla needs to do: Mozilla can and should revert the > change and allow users to easily opt-in.

I think it should be on by default. In my country encrypted DNS makes it more difficult for the government to track what people watch and to block sites.

> And to select or enter the DoH provider instead of defaulting to Cloudflare.

You can enter any DNS server address in Firefox.

While I agree, that it is bad to concentrate all the world's DNS queries in the hands of an entity under US jurisdiction, not encrypting DNS is much worse currently. So Cloudflare and US government are the lesser evil for me.

Also, if there were volunteers running free DoH servers then Mozilla could choose one of them randomly instead of sending all queries to USA.

<comment><USER37> Why not install DoH system wide, then (the kind of change which is easy if tools like Firefox use the system APIs for this and very difficult if individual applications all reimplement DNS) instead of only doing it for Firefox?

<comment><USER36> Because it is easier to embed it into a browser rather than persuade vendors of all major OSes (Windows, Mac, Android and thousand of Linux distributions) to add it.

Also, even if a company like Microsoft adds it to Windows, they will add it only to they latest version and leave people on Windows XP, 7 and 8 without protection. Same with Google - they will add it only to the latest Android. Because commercial companies want you to buy new products, not to use the old one for a long time.

</comment></comment></comment><comment> m-p-3 What they should do is offer several alternatives when enabling DoH (Cloudflare isn't the only DoH provider out there), and anto-detect if your ISP or local network supports it at the enterprise level.

At least you can change the provider in about:config. I don't remember if you can do it through the settings page.

<comment><USER14> Many ISPs won't offer such thing [https://www.zdnet.com/article/uk-isp-group- names-mozilla-int...](https://www.zdnet.com/article/uk-isp-group-names- mozilla-internet-villain-for-supporting-dns-over-https/)

<comment><USER38> > claimed that Mozilla plans to support DNS-over-HTTPS "in such a way as to > bypass UK filtering obligations and parental controls, undermining internet > safety standards in the UK."

> By planning to support DNS-over-HTTPS, Mozilla is throwing a monkey wrench > in many ISPs' ability to sniff on customers' traffic and filter traffic for > government-mandated "bad sites."

But I don't see why they can't offer their DoH, it seems their issue is with Cloudflare not with DoH per se

<comment><USER39> because most people don't know they can easily bypass the DNS based filters that is used to block "bad sites". DoH by default uses cloudflare's DNS, and so won't (need to) comply with the UK's filter laws.

<comment><USER40> > DoH by default uses cloudflare's DNS, and so won't (need to) comply with the > UK's filter laws.

I'm assuming the DoH servers used by British users are physically in the UK. (I believe they anycast the service from all of their edge locations, and they have several in the UK.)

So the fact that Cloudflare doesn't have to comply with this law is precarious. Is it because only ISPs are required to comply? If so, it seems like a matter of time before Parliament amends the law to require any public DNS operator to implement the filters as well.

</comment></comment></comment></comment></comment><comment><USER41> The only thing that annoys me slightly about this, is that I currently have a couple of pi-holes running at home (one for us, and one for the kids) and I have the Mikrotik setup to redirect any request for DNS to the correct pi (So even if they change the DNS on the device it still hits the pi)

This is going to make that a pain - especially if they introduce it in the mobile version?

<comment><USER42> You should be able to disable the Firefox default-on DoH across your network by returning NXDOMAIN for use-application-dns.net [1]

I don't know how to configure pi-hole, but at the dnsmasq level you can do that with this directive:

      address=/use-application-dns.net/

[1] [https://support.mozilla.org/en-US/kb/configuring-networks- di...](https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns- over-https)

<comment><USER41> Interesting, thanks.

I guess if these use normal DNS requests first to determine if it should be allowed, then it will work.

> If a user has chosen to manually enable DoH, the signal from the network > will be ignored and the user's preference will be honored

Well, that kinda puts a dampner on it all!

</comment></comment></comment><comment><USER43> It's worth noting that CloudFlare has already proven itself to not be a neutral party - they have proven willing to take sites offline for both legal and social pressure reasons.

This will greatly impact the internet's ability to route around censorship as if it were damage.

<comment><USER44> I agree, only somewhere that hosts neo-nazi websites would be trustworthy enough for this. /s

</comment></comment><comment><USER45> The Internet was a great distributed system with reasonable separation of concerns.

Now we are content that applications do their own name resolution and said resolution is centralised on a very few (non-altruistic) hands (CloudFlare/Google).

Add amp to this. Sprinkle it with the views of people who run their own mail server and consider where this leaves us.

I am not that naive and think we can keep ourselves in 1995. But I do think we give up on too many of the good parts all to freely.

<comment><USER46> The internet also was 99% plaintext. Then we realized that governments would pull all kinds of tricks to watch that text. From your own state monitoring all the traffic, to outside states hijacking BGP and slurping up your data. This has, at least in the case of http centralized certificates.

Here's the next thing, no one is stopping you from running your own DoH server. No one is stopping you from changing the FF config to use it. The big issue has been is the end user has been so unaware of security for so long and done so little about it _somebody has to_. There is no financial incentive for your ISP to care, so they have not. Most operating systems, specifically Windows, but also Apple have done little to nothing for client DNS security. This could have been handled between operating system developers and DNS infrastructure but they didn't care to.

<comment><USER21> > This could have been handled between operating system developers and DNS > infrastructure but they didn't care to.

No, there was a lot of caring over the years as DNS is old and insecure, in particular unencrypted communications with authoritative DNS servers being the biggest issue. And yet completely ignored by DNS-over-HTTPS, because solving it would likely eliminate the need for resolvers in the middle, so surveillance capitalism isn't interested, they only want to "solve" it in a such way that doesn't really solve it, but just gives them DNS data.

</comment></comment></comment><comment><USER47> Disagree. Most users haven't chosen their DNS server, so replacing one unchosen DNS server with another makes no practical difference. And DoH means that people snooping on your network can no longer spy on you.

Cloudflare has committed themselves to not track users via DNS requests, and only log what's strictly necessary.

And if you distrust Cloudflare, you have a much bigger problem. Half the Internet routes through Cloudflare these days. If they wanted to spy on you, they have (potentially clear-text) access to a good chunk of your HTTPS traffic.

And as many others have pointed out, it's a much better recommendation to have people change the DoH server to something else.

</comment><comment><USER48> Living in Russia, I, for one, welcome DoH and ESNI. I know I trust Cloudflare more than my government and ISP (The same ISP that routinely spoofs requests to inject ad pages/reminders to pay for service, nevermind all the blocked sites).

<comment><USER49> Not like DoH helps much here though.

</comment></comment><comment><USER50> How will this affect using Firefox on an intranet, where there are often services and websites on a local-only DNS server? Will Firefox be unable to reach those sites by default?

</comment><comment><USER20> Wow, thats awful that they're sending all user DNS requests to cloudflare without informed consent.

Is this also potentially a violation of federal wiretap law?

My ISP being able to monitor where I connect is not great, but being exposed to my ISP _and_ cloudflare monitoring it is not better-- and is also very unexpected.

There are also at least somewhat clear standards of privacy expected from ISPs, it's entirely unclear to me what duty of care cloudflare has towards users of this service or what position they'd be in to resist further compromise of user data (through either legal or illegal means).

</comment><comment><USER51> Does anyone knows why does mozilla think this is a good idea? Between each user sharing dns queries with their isps and everyone sharing dns queries with cloudflare it appears that it's obviously more secure the first approach even if none of them is really that great.

<comment><USER52> ISPs have proven themselves untrustworthy repeatedly, CloudFlare yet really hasn't. Not that I like the control they have, but it's honestly the fault of ISP's this has happened.

<comment><USER11> _some_ ISPs.

The problem is that Mozilla is taking a very US-centric view of a product that is used worldwide.

<comment><USER53> …and DNS over HTTPS, using CloudFlare, is only being enabled in the US. A US- centric view for a US-only decision seems fair to me?

</comment></comment></comment></comment><comment><USER54> One thing that concerns me greatly is debugging network problems.

Up until now, you could use dig, nslookup and other tools to see how your computers resolves to help you figure stuff out.

Now what do you do?

also what happens when firefox uses this cloudflare, some other X application will start using Z, and the third Y.

Also I work, and used to work for many small shops (under 50 people) in different industries. Its standard practice to have internal domains, sometimes even having different things on the same domain (ie mail.comany.co is diffrenet server form inside and outside the network).

If you don't have AD (increasingly common here with apple and linux laptops being the 95% of users), you will have to go to each user on every device that has firefox and help him fix the settings.

I would say just block it at firewall level, but it's not trivial, without breaking sites that use cloudflare.

</comment><comment><USER55> If the single DoH 'server' is the issue, wouldn't having a list of several 'servers' around the globe (hopefully in places where there isn't any form of censorship and preferably though non-commercial institutions) that the browser selects randomly solve this?

<comment><USER56> No. The browser has no business in selecting DNS servers; it is a system-wide setting and it should ask the operating system to resolve names.

How the operating system resolves names, is up to it. It could use tcp-over- pigeons, if the sysadmin configured it so, and no application should be working around that.

If you want to use DoH with Cloudflare, you are free to configure your system to do so. You will also get consistency, all your apps will use the same system, not just the browser. Let the others to have their systems configured as it suits them.

<comment><USER57> Maybe if the OS providers were more proactive about DNS over TLS/HTTPS, Mozilla wouldn't have needed to do this to keep users secure.

<comment><USER56> Android does support DNS-over-TLS, and it does it in a way that does not break networks - whatever it gets from DHCP, it tries the same server with DoT first. Users can also configure their preferred DoT server.

Linux, or at least the glibc-based distributions, have a concept of nss_modules; you can configure whatever mechanism you want, some people are using DNSCrypt or nss-tls, for example. Systemd-resolved, with all the hate it gets, does support DoT. So do other local caching resolvers, like Knot.

With other systems, you would have to discuss that with the respective vendors. Vendors also discuss these issues with customers, and very few customers are fond of breaking their systems. Activism, as Mozilla has shown, is a good way to irritate a good chunk of your user base. The change would have to be gradual, and allow the local admins to be in control (like Android and Linux distributions do).

</comment></comment></comment></comment><comment><USER58> I think this is a horrible idea and applications should respect the OS DNS configuration. I have already configured the instance of dnsmasq on my router at home to return NXDOMAIN for the canary domain.

That being said I am a little confused by those that are concerned because this change would mean their DNS queries will be sent to a US company and they don't trust US companies. Firefox is developed and distributed by a US corporation and is just a susceptible to being forced to follow US government directives as Cloudflare.

</comment><comment><USER59> Also, do keep in mind that by using DoH, you're also rendering anything like Pi-Hole useless. The solution of course being to use DoH from the Pi-Hole device [0], picking your own provider and disabling it on Firefox. Only step you need to change is the part where upstream providers are given and use your own instead of Cloudflare's default.

[0] [https://docs.pi-hole.net/guides/dns-over-https/](https://docs.pi- hole.net/guides/dns-over-https/)

</comment><comment><USER60> I simply don't like DoH because I use a DNS provider that I have chosen - OpenDNS - specifically because they log my DNS queries _and let me see that log_. I don't mind DNS lookups from my network being logged, as long as the provider does accurate, uncensored DNS lookups. It's helped me find domains to block such as tracking domains used by IoT devices that I can't configure myself.

I have my router directing all DNS traffic to OpenDNS so these devices can't pick their own servers, any outbound requests on port 53 will be redirected. If they start using DoH/DoT, I can't do that so easily. I'd have to start monitoring outbound traffic and do hostname resolution on the IPs.

I think the privacy argument for DoH in the browser is fairly weak, since doing a DNS lookup is not really an indication of, well, anything really. No matter what domain it was, there's no indication that the user intended to visit a website or use a service on that domain, it could be as simple as a lookup to load an embedded image in a spam email. The only good usage of it is to prevent censorship via DNS.

</comment><comment><USER61> Idk folks, the entire debate seems to be out of proportion. 1) If you do not agree with Mozilla's actions - do not user their browser. I mean Mozilla isn't forcing anyone to use Firefox. As a company they are free to design their product as they see fit. As an individual you are free to either use their product or not. 2) If you disagree and still chose to use Firefox - <USER2> because you are reading this means you have the knowledge to disable DoH. 3) If Mozilla remove the option to disable DoH over CF and you don't like it - use another browser. 4) If you are concerned for other people's data going to CF (specifically people who are not as well informed, people who don't know what DoH or even DNS is) - very noble indeed, but unfortunately options are limited here. Encourage people to do some research and to decide for themselves whether or not they are as passionate about it.

The main point I am making is just as we want to be free in choosing whether or not to use DoH over CF, Mozilla is as free to design their own product.

</comment><comment><USER62> I was never a conspiracy buff but the hordes of shills here who think it's a good idea to send the whole worlds browsing habits to the US a country with practically no protection of data lets this seem like a long prepared operation.

The Chinese had to hack BGP to get that kind of data for a limited time.

</comment><comment><USER63> As a sysadmin and a user i dont see any problems with DoH, i can easily set a DNS entry[0] so that FF respects my company configuration. And as a user I've been using DoH for months, just not from cloudflare but from CZ NIC because the latency was slightly better. You can easily set your custom DoH provider with 2 clicks in the Options menu. Also for most users I see benefits, because most of them don't use VPNs on free wifis.

edit: I also think OS maintainers are the main problem here, none of this would've happened if they supported DoT or DoH themselves.

[0] [https://support.mozilla.org/en-US/kb/configuring-networks- di...](https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns- over-https)

</comment><comment> tedk-42 I think it's good Firefox are leading the way on DoH.

The ability to chose which DNS provider you query will be next on the feature list for Firefox I imagine.

Cloudflare have the same mindset to do something about the vulnerability of DNS to snooping (see their 184.108.40.206 app). Two companies with the same mindset. I'm hoping others follow them.

The article itself sounds paranoid and divides those that would rather trust private companies (with good intentions) against those that would rather trust their ISP/Government (also with good intentions).

</comment><comment><USER64> With Mozilla pushing their users around, it's inevitable that a FF fork with Moz's shenigans disabled will become mainstream. What's the current state of eg Seamonkey?

</comment><comment><USER65> We are having zero problems with the current decentralized DNS architecture.

Evidently, Mozilla plays the role of a Google's darling once again. Those financial "donations" have some interesting effects, aren't they? Aside from an official "Google Search Bar in Firefox" line.

What's even more interesting is that Hacker News moderator deranked the topic.

Probably all the actors represent the same mafia ring, as they painfully in need to defend those interests to stay commercially relevant in changing world (hello IPFS).

</comment><comment><USER66> Maybe I'm missing something, but the "I think just me and you was safer" image feels a little misleading. There already was a third party - your ISP/DNS provider.

</comment><comment><USER67> In other news, bots have now started using DoH (one via Google's DoH service):

* [https://www.proofpoint.com/us/threat-insight/post/psixbot-no...](https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module)

* [https://news.ycombinator.com/item?id=20934680](https://news.ycombinator.com/item?id=20934680)

</comment><comment><USER68> I don't know about you guys but in Turkey if you query wikipedia.org from 126.96.36.199 it doesn't return results.

However if you use DoH you can access Wikipedia.

Thank you whoever contributed to DoH!

<comment><USER69> Whatever convinced Google – _Google_ – to censor Turkey, you don't think they will be able to convince Cloudflare to do the same?

This is a problem of centralization.

</comment></comment><comment><USER70> The stated problem is that there are few providers, as for the offending party - Firefox, it's they've defaulted to a company based in the US or a 14 Eyes member.

It doesn't feel right to address the issue by blaming the DoH, or Firefox, as they are not defaulting to the prime evil - Google.

I believe the better suggestion here to say is to set up own DoH servers, urge related parties to opensource their own implementation if there's none.

</comment><comment><USER71> The government already has your DNS queries. So the whole point of the argument is moot.

The ISPs, and anyone they share the data with, also already have the DNS queries, so the argument is wrong.

But also, if you do want just one government to have the data, do you prefer that data to go to your local country, which may be speech-oppressing regimes like Syria, Saudi Arabia, UK, Ukraine, or Iran?

I fail to see how this is in any way a step backwards.

</comment><comment><USER72> List of FF "integrations" grows. There is also HIBP one. We need a clean from 3rd parties version, like ungoogled-chromium project.

</comment><comment><USER73> Pretty hilarious that this entire article is negated by contractual agreements spelled out in Firefox's FAQ in DoH

[https://support.mozilla.org/en-US/kb/firefox-dns-over- https](https://support.mozilla.org/en-US/kb/firefox-dns-over-https)

</comment><comment> TX-i I don't understand the DoH protocol entirely. I thought the entire point of it was to pass encrypted requests to CloudFlare. Can anyone confirm how this works? I thought this was the entire point of DoH, adding encryption to requests and directing it away from the plaintext DNS requests.

</comment><comment> m-p-3 For those who are uneasy to use CF DoH, here's a list of alternative DoH Resolvers

[https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly- av...](https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-available- servers)

</comment><comment><USER74> I had to turn it off, not because I'm opposed to the idea, far from it, I'd love to use DoH, but because cloudflare's spat with archive.is renders the whole thing useless if you ever need to browse archive.is stored copies of pages.

<comment><USER75> Kind of a disservice to call it cloudflare's spat when archive.is added special code to make their dns implementation non spec compliant only when queried by cloudflare.

<comment><USER57> I wonder if they will deal with it now that all US Firefox users will be unable to use it by default.

</comment></comment></comment><comment><USER76> _As somebody who 's been working for internet security over 20 years, we strongly believe that applications should not choose the DNS server. The operating system is designed to manage DNS and network settings for all applications._

This is nonsense.

<comment><USER77> Instead of a reactionary remark please provide arguments and explanations for your viewpoint to actually further the discussion.

<comment><USER78> I think tptacek's comment is just fine as it is.

</comment></comment></comment><comment><USER79> Not convincing. I live in Russia, explain why I wouldn't want this turned on?

</comment><comment><USER80> The result will be simple: FF market share in corporate environments will drop. If sysadmins have to jump through hoops simply to get the thing to respect corporate DNS settings, then it won't be used.

</comment><comment><USER81> In places like India, blocking is often done at the DNS level. Cloudflare and Firefox are big reasons I can get around stupid overbroad government blocking of whatever they think is anti-national or porn.

</comment><comment><USER82> It's weird how large companies can make decisions like this (re-routing all DNS requests to the US) on their own, without local/EU government stepping in to prevent it...

</comment><comment><USER83> DoH and DoT are very interested technologies, disabling them 'cause Cloudflare is ... strange.

From another side, DoH/DoT prevents ISPs/government from DNS modifying/rerouting.

<comment><USER84> Why is that strange? It seems rather obvious to me why people are reluctant to route all their DNS queries through a for-profit company in a country with no real privacy laws (and one that you have to assume is backdoored by the NSA).

<comment><USER83> 'Cause it not vendor-locked to Cloudflare, you can use your own server.

</comment></comment></comment><comment><USER85> I strongly support DoH as it prevents government snooping on the public. It's really unhelpful that people like this attack Firefox over this issue.

Stand strong Firefox against this.

<comment><USER86> One goes fishing where the fish is. There are dozens of large and hundreds of medium to small ISPs in the US. There's only one Cloudflare. That's where the resources to get the data would be concentrated. It has been demonstrated with PRISM.

If Mozilla wants to play this game, it really should make DoH a visible top level choice for a user.

<comment><USER87> Most users don't understand DNS, HTTPS, or DoH. I think this decision overall is good, and for those who see and understand the possible issues, it's trivial to remedy.

</comment></comment></comment><comment><USER88> I think dns (and many other "trivial" to implement sensitive services) should be a gov service. Preferably the eu and idealy made usable for anyone.

</comment><comment><USER72> OpenBSD folks removed it, and they are always right about security, as they were with disabling Intel hyperthreading.

</comment><comment><USER72> How decisions are made in Mozilla? By whom? Is there public discussion beforehand?

<comment><USER89> This has been tested and debated for months. Initial support for Firefox rolled out 9 months ago or so: [https://miketabor.com/enable-dns-over-https- and-encrypted-sn...](https://miketabor.com/enable-dns-over-https-and- encrypted-sni-in-firefox/)

The conclusion of the debate was that it vastly improves the privacy for most users. Which is why it shipped in Firefox.

Take that into account when you read (misleading, factually wrong) push-back like the original article.

<comment><USER72> > The conclusion of the debate

Obviously debate is still on, as we see in here and in [0], and it looks like HN folks are not in favour of these integrations, including me. So question stands, how/why the debate was concluded, did all developers had a vote? Is there a link to discussion?

[0] [https://news.ycombinator.com/item?id=20927832](https://news.ycombinator.com/item?id=20927832)

<comment><USER89> >it looks like HN folks are not in favour of these integrations, including me.

I have no idea why you think that random HN discussion afterwards (in response to an article filled with misinformation!) would have any bearing on how Firefox is developed.

[https://www.mozilla.org/en-US/about/governance/](https://www.mozilla.org/en- US/about/governance/)

>Is there a link to discussion?

There's been about 1.5 year of extended discussion and iteration over DoH, yes. I'm sorry but there certainly isn't just a "single" link!

</comment></comment></comment></comment><comment><USER90> privacy aside , how about internal hosted zones and stuff that isn't resolvable by TLDS or CCTLDS?

</comment><comment><USER91> My understanding is that the DNS query goes to the closest of the more than 180 Cloudflare servers, not specifically to the US servers. Complete FUD.

<comment><USER11> The point is that Cloudflare is a US company. From that perspective, where their servers are located is irrelevant.

<comment><USER91> Of course it is relevant. They claim US government has access to all the logs, this is simply not true.

<comment><USER43> Please provide some proof that a US company would not have to respond to US government requests. The location of the servers doesn't matter.

</comment></comment></comment></comment><comment><USER92> > It means people outside the US can now be fully tracked by US government

How?

</comment><comment><USER93> Firefox, wth.

Cloudflare is not the internet.

<comment> m-p-3 It's currently proxying 10.2% of all known websites (by the surveyor) on the entire Internet.

[https://w3techs.com/technologies/details/cn- cloudflare/all/a...](https://w3techs.com/technologies/details/cn- cloudflare/all/all)

Not big, but not insignificant.

</comment></comment><comment><USER94> I hope to see a solution from Mozilla, is it known why they choose DoH with Cloudflare? It seems a bit strange from a company always focused on OSS.

<comment><USER47> There aren't a whole bunch of companies that are able to provide a good DNS service world-wide. You'll need high-reliability DNS servers co-located all over the world. Probably a multi-million dollar investment to get such a thing going, saying nothing of the running costs.

</comment></comment><comment><USER95> I think this article would benefit from not shoehorning politics into the issue. Couldn't take this seriously after the irrelevant slight at Trump.

</comment><comment><USER96> > DoH means that Firefox will concentrate all DNS traffic on Cloudflare, and > they send traffic from all their users to one entity.

Why does DoH necessarily mean that Cloudflare will be handling the traffic? The article barrels right to that conclusion without explaining why.

<comment><USER41> The default setting in Firefox is to use Cloudfare as the DOH provider

<comment><USER96> Thanks for pointing this out.

> It is clear what Mozilla needs to do: Mozilla can and should revert the > change and allow users to easily opt-in. And to select or enter the DoH > provider instead of defaulting to Cloudflare.

Buried lede is buried.</comment></comment></comment>


Inception Movie explained using the C language - <AUTHOR> https://github.com/karthick18/inception <comment><USER2> Can I submit a bug report? The code says:

> the ending is still a state of limbo

Limbo is a world which allegorically represents the mortal world (Matthew 7.24). The ending is a heaven sequence. Cobb demonstrates faith by rejecting Mal and then sacrifices his life to rescue Saito. This triggers a symbolic death ("you have to die to wake up") followed by the forgiveness of sins (at immigration) and the reunion of the family in the heavenly garden. This is classic Christian allegory and it's amazing more people aren't commenting on it.

The ending is no more a dream than heaven is hell. And the only significance of the spinning top is that Cobb ignores it (another demonstration of faith). That said, since it's an interesting question how one models death and redemption in code, my suggestion would be a segfault and then return to root?

</comment><comment><USER3> The _Inception_ Movie explained to my son (by Donald Duck, none the less) [1]. Almost all the scenario and the "innovative" concepts of the film come from a 2004 Scrooge McDuck comic.

I've linked to Cracked (even though they might not be seen as the most serious source) because their account is detailed and very documented.

1\. [http://www.cracked.com/article_19021_5-amazing-things- invent...](http://www.cracked.com/article_19021_5-amazing-things-invented-by- donald-duck-seriously.html)

<comment><USER4> The comic in question: [http://disneycomics.free.fr/Ducks/Rosa/show.php?num=1&lo...](http://disneycomics.free.fr/Ducks/Rosa/show.php?num=1&loc=D2002-033&s=date)

</comment></comment><comment><USER5> For the lazy, this is how the output of running the program looks: <https://gist.github.com/840077>

</comment><comment><USER6> Can somebody please intercept the code for me? Seems I am in deep dream; not able to figure out the code.

<comment><USER7> From my 5 minutes of skimming:

Basically, it spawns threads for each 'dreamer.' Then they spawn more threads for each dream level, and wait for the lucid_dreamer-s in lower levels to accomplish their task, while printing what's going on. Think of it like the good old dining philosopher's program, where threads represent the diners.

Here's a slightly more lucid explanation: [http://calacanis.joshontheweb.com/wp- content/uploads/2010/07...](http://calacanis.joshontheweb.com/wp- content/uploads/2010/07/inception_infographic_by_dehah-scaled-1000.jpg)

<comment><USER8> ah, the dreaming philosophers problem

</comment></comment></comment><comment><USER9> Hmmm. Why the cryptic assembly language stuff? Surely this isn't (_very_) cleverly disguised malware...

<comment><USER10> From the readme: "My tribute to Nolan in "C" Language and a bit of assembly (x86) as the inception is done using x86 code morphing so that Fischer wakes up thinking that the thought was originated from his mind."

I assume it's to make that trick work. Maybe run in on a VM, just in case. :-)

</comment></comment><comment><USER11> Why? So terribly convoluted</comment>


TempMail: Temporary Email Addresses - <AUTHOR> https://temp-mail.org/en/ <comment><USER2> I love disposable email services! How do you see your service go forward compared with the others?

I'm working on an email automation service. We'd be interested in offering aliases programmatically: \- Generate aliases by API (as many as we want) \- Ideally, aliases would be on domains we own \- Possibly use subdomains \- Auto forward all the emails that arrive to the generated address, to an email address \- Get a webhook that fires off every time an email arrives \- Webhook gives us the whole payload (subject, body, sender, attachments etc)

Would this be possible with your API? We're looking at Anonaddy and ForwardEmail, but always happy to consider more :)

<comment><USER3> You can also take a look at SimpleLogin, quite similar to AnonAddy but could be selt-hosted. Just ping its founder for possible collaboration, he answers very quickly.

<comment><USER2> That looks excellent. Thanks for the pointer.</comment></comment></comment>


Kiwi Browser - Android Chrome based browser with extensions support - <AUTHOR> https://github.com/kiwibrowser/src <comment><USER2> I learned about this from a user of my Chrome extension who was having some issues. Most of the features actually worked out of the box, though the UI isn't quite right. Very cool that it works this well!

I understand Brave will be adding extension support this year as well.

<comment><USER3> ?? Brave already has chrome extension support. I do not get why this is highlighted as something special for chromium based browsers.

<comment><USER2> We're talking about mobile browsers. Even mobile Chrome does not support Chrome extensions.

</comment></comment></comment><comment><USER4> Wow, it used to be closed source before. I am surprised that it eventually went open source.

<comment><USER5> a website that showcased software that survived that transition would be entertaining, if it doesn't already exist somewhere.

<comment><USER6> If you find (or build) anything like that, I'm sure HN would love it. Personally, I'm concerned about my favorite reference manager, Qiqqa, which was open sourced when retired by the company that made it. As far as I can tell, there is 1 (maybe 2) coders maintaining and improving the software and maybe a few people catching and reporting bugs. It seems like a razor's edge, but the most active contributor is doing a great job. It would be interesting to see different projects succeeding and where others stagnated or fell apart.

<comment><USER7> Would you be less concerned if they had retired it without publishing the source code?

<comment><USER6> Of course not. I'm a little confused as to how you might think that if the case. I use it daily, and I'm invested in its continued improvement. I ask because I'd like to know how projects best succeed in the kind of situation.

</comment></comment></comment></comment></comment><comment><USER8> A very important project because it is one of the two browsers on Android that support extensions (the other one is Firefox Mobile). I didn't know it was closed source.

<comment><USER9> Yandex mobile does chrome extensions.

<comment><USER10> If you trust yandex enough to allow them to possibly gather all your browsing activity, passwords, ... It's like trusting tencent.

<comment><USER11> How about Google?

</comment></comment></comment></comment><comment><USER12> I'm using this simply because it still has the address bar at the bottom.

<comment><USER13> It's interesting to see the different user preferences. For example, I can't stand the address bar at the bottom. But I find folks such as yourself who can't stand it at the top.

Very few browsers I've found let you choose.

<comment><USER7> Firefox Preview (why don't they brand it with the awesome code name Fenix?) does.

<comment><USER14> Because as a name it will die anyways. They just just rolled it out as Firefox Beta.

I wonder if Preview will remain at all than.

</comment></comment></comment></comment><comment><USER15> I've been using this specifically for its extension support, and I'm just waiting until Firefox Preview can get extension support fully as I use Firefox on the desktop and I'd like for them to sync. I looked at other browsers like Brave but I just cannot trust them.

<comment><USER16> Firefox on mobile has extension support, I am using it right now?

<comment><USER17> It's gonna be replaced during this year with a complete rewrite.

Extension support is coming, but at the moment only uBlock Origin is available.

<comment><USER18> So to be clear, the existing Firefox on Android which has broad extension support is going to be replaced with a version with less extension support? Why? One of the biggest value adds of Firefox on Android is broad extension support.

<comment><USER19> Only way to make it suck less

[https://blog.mozilla.org/futurereleases/2019/06/27/reinventi...](https://blog.mozilla.org/futurereleases/2019/06/27/reinventing- firefox-for-android-a-preview/)

<comment><USER20> It sucks? I switched from Chrome last year and am nothing but happy. Who decided it sucks?

<comment><USER21> Single process for all tabs/sites, no sandboxing, for a start.

I personally won't touch Gecko anymore, and I've been a FF advocate since it was called Mozilla, ha

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> I love Kiwi Browser! If it was able to Save "Webpage, Complete", I'd use it as my mobile daily driver.

<comment><USER23> Send a PR... It would probably be easy enough to add...

</comment></comment><comment><USER21> Bromite needs more love from this community!

</comment><comment><USER24> Beware, the binary .apk's have unreleased patches you can't get from compiling yourself.

<comment><USER25> That sounds shady. Thank you for the warning. How does one determine that?

Also not found on F-droid. Hard pass.

<comment><USER26> F-Droid has the same potential tampering issue: apps there are signed by the F-Droid key, not the developer's key.

An F-Droid compromise could backdoor every app.

<comment><USER21> Any history of this?

For anyone: Why don't they cross-sign with their key+dev key?

<comment><USER27> Because the builds are (generally) not reproducible

<comment><USER26> I think cross-signing implies adding a second signature (notarization) to an existing dev-signed build, not doing a rebuild.

Does apk support such a thing?</comment></comment></comment></comment></comment></comment>


Women, minorities, and the Manhattan Project - <AUTHOR> http://blog.nuclearsecrecy.com/2015/11/27/women-minorities-and-the-manhattan-project/ <comment><USER2> The most interesting parts of this for me were the lessons about discrimination. First, that how we think about the Manhattan Project is shaped by how it was reported at the time, because it was naturally written about through the lens of that time's biases. Second, that while WWII allowed more women to get into science out of necessity, this was sadly reversed afterwards as the need was gone: WWII didn't end society's prejudices, it just forced it to temporarily overlook them in some limited areas.

Food for thought.

<comment><USER3> Yes, it would be much better to have equality. Women would get drafted and fight in WW2 alongside men.

<comment><USER4> It's a little funny to think about equality, or really _justice_ , in the context of war. Among other things, at least in the modern US, quite a number of US soldiers are men of lower classes and limited options who are looking at the armed forces as a job with good pay and a good basis for a future career, and the armed forces know that and advertise on that basis. If a draft starts, college students and certain professionals can get deferred; working men age 18-25 get drafted. It is the very nature of income and earning-power inequality in the US that is powering our current enlistment and would be powering any draft. It's not really sensible, I think, to argue about whether _this_ equality is needed when the very reason the situation exists is itself a fairly major inequality.

That said, women's groups have historically supported extending the draft to women. In the 1981 Supreme Court case _Rostker v. Goldberg_ , which was filed by a group of men who opposed the gender discrimination in the draft, both the National Organization for Women and the ACLU's Women's Rights Project filed amici supporting them:

[http://www.nytimes.com/1981/03/22/us/women-join-battle-on- al...](http://www.nytimes.com/1981/03/22/us/women-join-battle-on-all-male- draft.html)

[https://www.aclu.org/tribute-legacy-ruth-bader-ginsburg- and-...](https://www.aclu.org/tribute-legacy-ruth-bader-ginsburg-and-wrp- staff)

</comment></comment></comment><comment> nommm-nommm When brilliant and accomplished rocket scientist Yvonne Brill died in 2013 The New York Times opened her obituary with

 _She made a mean beef stroganoff, followed her husband from job to job and took eight years off from work to raise three children. "The world's best mom," her son Matthew said._

<comment><USER5> This has since been changed and, in typical New York Times fashion, no mention was made that the article was updated[1].

It now reads: > She was a brilliant rocket scientist who followed her husband from job to job and took eight years off from work to raise three children. "The world's best mom," her son Matthew said.

[1][http://io9.com/the-new-york-times-fails-miserably-in-its- obi...](http://io9.com/the-new-york-times-fails-miserably-in-its-obituary- for-464140204)

<comment> nommm-nommm As if a reference to beef stroganoff was the only issue...

Though it is better.

The New Yorker points out the eight years off part isn't even factually accurate, she moved to a job with more flexible hours at FMC Corporation (involved in their work with ARPA) while still making major contributions to the world in that capacity.

</comment></comment></comment><comment><USER6> "As advertisements from the later period suggest, the role of the space-age woman was as the helpful wife — not the person doing the calculations."

What the advertisement really suggests is that someone felt the need to promote women's role as housekeepers. You can also find adds with women smoking, which shows cigarette companies tried to get the non-smoking part of population as customers.

</comment><comment><USER7> really good article in general. i thought it was worth pointing out this neil degrasse tyson clip in particular, linked at the end to tie the discussion back to the present day: [https://www.youtube.com/watch?v=6EkuXfsWmMo](https://www.youtube.com/watch?v=6EkuXfsWmMo)</comment>


"Business" person needed - Disrupt the music promotion business with us - <AUTHOR>

We're disrupting the way artists promote their music by getting their songs played on the air. The artists we've spoken to love our service but can't afford the price. We need a solution to this. We've thought about either lowering our price (not sure that's a good idea) or extending credit to these artists (via a third-party). In either case, we need help getting our service off the ground, proving our business model, and then taking it to the next level.
Initially this will have to be a a commission-only position. But if the service grows, you grow with us.
Please get in touch if you believe this is a perfect role for you.
Cheers,
Erik <comment><USER2> "The artists we've spoken to love our service but can't afford the price"

So, why is lowering your price a bad idea?</comment>


If We Told You That, We Would Have to Shoot You - <AUTHOR> http://www.whattofix.com/blog/archives/2010/06/if-we-told-you.php#more

<comment><USER2> You live in a country where medical people of any sort (doctors, medical suppliers, etc) can be sued _without scientific evidence_ that they harmed anyone. They will face trial with a jury having no ability to evaluate scientific evidence and who will make a decision based on who is more sympathetic. The plaintiff's lawyer may _pretend to be a psychic_ and still be awarded millions of dollars rather than being laughed out of court ([http://www.nytimes.com/2004/01/31/politics/campaign/31EDWA.h...](http://www.nytimes.com/2004/01/31/politics/campaign/31EDWA.html)).

Is it any surprise that everyone involved goes out of their way to avoid any hint of possible legal liability?

<comment><USER3> Medical tort costs in 2007 were 30 billion and have been increasing at about 5% a year for the last 10 years ([http://www.towersperrin.com/tp/getwebcachedoc?webc=USA/2008/...](http://www.towersperrin.com/tp/getwebcachedoc?webc=USA/2008/200811/2008_tort_costs_trends.pdf))

Meanwhile, medical costs are more on the order of 2 _trillion_ and have been increasing by over _15_ % a year for the last 10 years.

I don't think liability is really the main cost driver here. I'd look at profits first. $2k to do a sleep study? How much work could that possibly be? And then they insist on _another_ one? Not to mention the whole PCP -> specialist -> other specialist to get a frickin piece of plastic. Everyone got a piece there.

<comment><USER2> I don't recall claiming torts were the cause of all medical inflation. I claimed torts were the cause of Daniel Markham being shuffled from sleep study to sleep study and of him not being allowed to hack his own medical device.

Also, your argument is specious since it completely ignores the cost of unnecessary medicine performed in order to ward off lawsuits. For example, a lawsuit fearing doctor might order unnecessary tests and procedures with little medical benefit but, but which the doctor can point to in court and say "look, I did the best I could".

<comment><USER3> You claimed torts were the cause -- I'm claiming they're the excuse, and the $2k bill is the cause. $2k in guaranteed cash is a stronger incentive than the very remote chance of a lawsuit over sleep apnea. Even if the latter does exist in some small number and can be blamed.

<comment><USER2> 1) The pulmonary specialist who ordered the sleep study _does not get $2k_ , the sleep study guy does. Why would the pulmonary specialist care about enriching the sleep study guys?

2) Humans respond disproportionately to low probability, high cost events. Witness the reaction to "XXX causes cancer", the DC sniper, 9/11, or similar rare events.

So yeah, I'd say fear of lawsuits is a better explanation than the desire to make somebody else $2000 richer.

<comment><USER4> _The pulmonary specialist who ordered the sleep study does not get $2k, the sleep study guy does. Why would the pulmonary specialist care about enriching the sleep study guys?_

So, you're 100% certain that the pulmonary specialist is not an owner or an investor at the sleep study facility?

In reality, it is quite common for doctors to own or invest in facilities to which they refer their own patients.

</comment></comment></comment></comment></comment></comment><comment><USER5> This is pretty problematic. The government and legal system don't seem to view taking responsibility for your own health as a legal right. I don't care that some people would do stupid things. A big "you shouldn't do this without a doctor's supervision" note is really all that should be required.

</comment><comment><USER6> I wish people would think outside themselves for a bit. Is every person who has self-diagnosed with Dr Google right? I am sure doctors have seen a bunch of people that are waving some printout that says "I have X, I need Y! Stat!" and are totally wrong. I personally don't blame them for wanting to go through the tests.

<comment><USER7> It's actually an even deeper problem that people self-diagnosing through Google, as diagnostic tools increase in sophistication and decrease in cost you can potentially find "issues" that never existed before.

Take CT scans: if you took a random sampling of people, gave them a CT scan and then had an ortho doc look at the result 30% of the scans would show an "abnormality", but almost none of the patients would end up actually needing spine surgery.

Similarly with apnea, almost everyone has some sleep apnea, but not everyone needs a CPAP, etc.

<comment><USER2> This is simply innumeracy, in particular an inability/unwillingness to use Bayes rule.

</comment></comment></comment><comment><USER8> My startup is working in exactly this field; building a small embedded tag which can be linked to the data port of a variety of clinical devices, allowing data to be offloaded into a electronic patient record or external database.

We've had a bit of trouble getting protocols out of the manufacturers, but generally the hospital department in change of device maintenance (here, Medical Physics) will have access or can request it for datasheets, protocol specifications, and almost everything you'd want.

Not sure they'd be too happy providing it to a random patient though, whereas we have a working relationship with a few local hospitals.

I also recently underwent a sleep study for sleep apnea, and after having waited around 4 months for the test, it will now be another 5-6 before the specialist can review my results and make a diagnosis. Chances are any sort of CPAP will require another test for calibration and the like as well :/

I'm highly tempted to do as described in this article, and take one of the office test devices, a Nonin XPod <http://www.nonin.com/OEMSolutions/Xpod> and do a bit of night-time data logging of my own. Having worked with those devices, I quite like their very simple serial packet format, which is standard RS232 serial, and fully documented on the public datasheet on their website.

</comment><comment><USER9> This was posted a couple of days ago... can't find the link though.

Here it is: <http://news.ycombinator.com/item?id=1471123>

</comment><comment><USER10> Recommended reading: Andy Kessler, The End of Medicine: How Silicon Valley (and Naked Mice) Will Reboot Your Doctor.

There are startup opportunities hidden here!

</comment><comment><USER11> I dunno, these patient narratives have a way of driving me up the wall.

It seems like just about everybody who can't cope has "Obstructive Sleep Apnea" these days... Enough that I'm starting to wonder if it's not just fashionable, but contagious.</comment>


Massive multiplayer online scrabble (nodeko entry) - <AUTHOR> http://scrabb.ly/

<comment><USER2> Hmm, "You must build off of words you've played yourself (the dark tiles on the board) after your first turn."

So if I put my first word cleverly in one of the denser places of the board, I am basically screwed (well, only until I start a new game)? Just disappointing after I searched the board for quite a while to place my second word, only to get that message. Also, I have no idea where to find my first word (I know it will appear darker, but I have no idea where in the 2D space.

<comment><USER3> I put down my first word and then scrolled far, far away. Then realized that the rule and I was lost.

<comment><USER4> Hah. Yeah, I really wanted to fix that but we completely ran out of time at the end. This project was crazy ambitious for 48hrs, I'm just amazed we got anything to work at all! :-)

When you place words, the history shows up on the right. Once the judging is over, I'll make it so when you click on a word in the sidebar, it scrolls the board over to that word. Should help people like me who are always getting lost within the infinite scrabble space.

In the meantime, you can just click "Swap Tiles" a few times to end the game and start anew.

</comment></comment></comment><comment><USER5> Looks like the leader board got hacked:

        Leaderboard

        1.FAIL -80085
        2.@dacort 2
        3.@aviel 1337
        4.@ggoodale 1337
        5.@railsjedi 1337

<comment><USER6> nope. we didnt quite get it working so we poked fun at ourselves :-)

<comment><USER5> I see. Well, I'm having a lot of fun with your app. Annexing other words by augmenting them almost makes it feel like a game of conquest. It would be fun if other people could steal "territory" from you by completing your words.

</comment></comment></comment><comment><USER7> This is very cool! It's addictive to keep adding words.

If you start at the edge and build outwards, it seems pretty easy to go on indefinitely, continuing to add on points without even thinking of particularly high-scoring words. Maybe there should be a clearer goal? Get a high average score in addition to a high total? Get a high score using up all of the tiles in a normal scrabble set?

<comment><USER4> I think games shouldn't ever have to end. Once we get the leaderboard working again, it'll be a competition who can have the longest, largest, and most ridiculous never ending game of scrabble.

</comment></comment><comment><USER8> App crashed

This application is temporarily offline.

If you're the administrator of this app, please check your heroku logs for the backtrace.

<comment><USER4> Yeah, Heroku's node hosting has got some issues at the moment (its still in beta). I have to manually restart it whenever that happens :-(

</comment></comment><comment><USER9> Insanely addicting. I'm building out my own little peninsula of words.

Needs a minimap to get around.

<comment><USER10> Very high on our list of post-competition features. Not just for the usability; we also think the game board would make an gigantic, amazing poster. ;)

</comment></comment><comment><USER11> It crashed while I was playing, and then it came back, and remembered my game when it came back!

<comment><USER12> If it's a shared multiplayer persistent board, there is no "your game".

<comment><USER11> Ah, I see what you mean. I guess I was impressed that my game state was perfectly restored... current letter times, score, and ability to add to my prior words.

<comment><USER10> Actually, we do track your game state along with everyone else's. Thanks for playing!

</comment></comment></comment></comment><comment><USER13> Getting 2 double word score tiles doesn't seem to work.

<comment><USER10> Heh. That was from my misunderstanding of the rules of that, er, _other_ tile- based word game. I'll fix it post-competition when we can deploy changes to the app. Thanks for playing!

</comment></comment><comment><USER14> I want a Home button because I lost my words!

</comment><comment><USER15> that's a really cool application! I've too have been working on a multiplayer application, hope to release soon.

</comment><comment><USER16> nicely done! what are you using for persistence on the backend?

<comment><USER4> MongoDB + geospacial indexing</comment></comment>


Ask HN: Any digital mail start up still alive? - <AUTHOR>

I have desperately wanted to throw money at a digital mail service ever since reading about Outbox.  All my google-fu has turned up nothing but dead companies.<p>Can anyone recommend a company which is still active? <comment><USER2> I was so sad to hear the news about Outbox. I've been waiting for a Canadian equivalent to appear. I'm also watching this space anxiously.

</comment><comment><USER3> [https://www.earthclassmail.com](https://www.earthclassmail.com) looks like it is still alive, no?

</comment><comment><USER4> [http://www.virtualpostmail.com/](http://www.virtualpostmail.com/) \- i love them.

</comment><comment><USER5> [https://www.papertrailer.com](https://www.papertrailer.com)

</comment><comment><USER6> I currently use mailboxforwarding.com and am pretty happy with it.</comment>


The Hobbit advance screenings disappoints  blames Red's high resolution - <AUTHOR> http://www.eoshd.com/content/7987/advance-press-screenings-of-48fps-the-hobbit-disappoint

<comment><USER2> I'll be disappointed if they back out and never show it at 48 fps, because I would be interested in finding out if it really does look like crap at that setting.</comment>