ISP Association Nominates Mozilla as “Internet Villain”

https://www.ispa.org.uk/ispa-announces-finalists-for-2019-internet-heroes-and-villains-trump-and-mozilla-lead-the-way-as-villain-nominees/

by pjc50 • 7 years ago

220 146 7 years ago

ispa.org.uk

wmf• 7 years ago

In other news, Mozilla names all ISPs Internet villains.

realshowbiz3• 7 years ago

Considering my past personal experiences with IPSs, Mozilla must be doing something right.

lgierth3• 7 years ago

If I were in an ISP's shoes, I'd be thankful for Mozilla to neutralize the legal attack surface which apparantly is running DNS for customers.

leblancfg• 7 years ago

I didn’t know that either! For anyone else wants to try it out: https://www.reddit.com/r/firefox/comments/a5evhr/configure_d...

lgierth3• 7 years ago

Umm I think you commented under the wrong parent

wp381640• 7 years ago

they monetize dns query data so hate it and pretend it's about the children

lgierth3• 7 years ago

Yeah I didn't think about the monetization angle when I typed that comment, you're right. Some even redirect NXDOMAIN results to a "search" page full of ads (T-Online in Germany did this until recently).

readyp1• 7 years ago

It says in the link that Mozilla was nominated "for their proposed approach to introduce DNS-over-HTTPS in such a way as to bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK".

So... for circumventing censorship, then?

nullwasamistake2• 7 years ago

Hah! This is the most insane justification I've seen in a while. Even better than when all the tech giants smash competition because "security".

Cloudflare (which has somewhat shady ties to us govt maybe) is pushing hard for DNS over secure channel and it's pissing off ISP's. Because they won't be able to sell personalized browsing history if is catches on....

Control/view of DNS requests is worth A LOT of money to advertisers/ISP's because it's currently immune to ad blockers and ties a user directly to their IP and real info. It's even better than browsing history because it includes everything a user does outside the browser as well, protocol agnostic, cross device.

It's the perfect example of "metadata" that various companies and agencies collect for all sorts of shitty reasons. It's the last cleartext frontier of activity monitoring.

Analemma_• 7 years ago

This doesn’t make any sense. Your ISP still knows your browsing history even if they can’t see your DNS requests.

yholio• 7 years ago

But if Cloudflare is the point of aggregation and the ISP can no longer distinguish between what, according to UK law, is legal and illegal traffic, then... surely the legal onus of performing the filtering will fall on Cloudflare?

When they are providing internet content to UK customers, they must respect UK law. It's a dangerous chicken game to think UK will not be able to enforce it's laws against Cloudflare.

The villain here is the UK govt. ISPs should applaud the technical developments with all their hearts since they are legally off the hook.

t34543• 7 years ago

It appears that way - I cannot fathom the mentality that actively supports censorship. The internet was beautiful, information open and available for all. That idea became so powerful it’s now a threat. Sigh.

CodeMage• 7 years ago

The internet was beautiful, information open and available for all.

"Was" is the correct word to use. Here's a fun example: try explaining to someone non-technical why you can't simply download your e-mails. I went through that exercise this morning, when my wife asked me to download a bunch of e-mails and send them to her in a "folder", which she can then send to someone else.

So then I had to explain that GMail allows me to download a single message -- no bulk downloads, of course -- but it saves it in .eml format, which you can't open with programs that come installed on a typical Windows box. And even if you could, there's no guarantee that the guy you're sending them to can.

Of course, she thought that was stupid: why offer saving e-mails in an "obscure" format? So I had to explain why the Internet is now a bunch of walled gardens and closed services, all built on top of open and standardized protocols and formats. And, of course, those open standards can't improve and evolve easily, because each player in the game wants to lock users and their data inside their own walled garden.

So yeah, the takeaway in a nutshell is that the Internet was once open, but then it became lucrative.

EDIT: I think a lot of people replying here might be missing the point. Like I stated above, I was trying to explain the situation to a non-technical person. Yes, I'm aware of POP and IMAP support. Yes, I know RFC5322 is not an obscure format. But I'm talking about people who don't know or care what these things are. Try downloading a bunch of messages in RFC5322 format, zipping them and sending them to your average lawyer and see how they react.

realshowbiz3• 7 years ago

And ease of surveillance

donmcronald• 7 years ago

It’s a double edged sword. DoH will enable unblock-able ads.

realshowbiz3• 7 years ago

How?

kibwen2• 7 years ago

It would only be a difficulty for intercepting devices like PiHoles (and I don't think it's an insurmountable difficulty either, if you control both the Pi and the computer). It wouldn't affect browser-based adblockers, which is how the majority of adblocking is already done, because browsers already have access to the unencrypted request.

dredmorbius6• 7 years ago

DNSMasq, the resolver used by many adblock tools, supports DNS-over-HTTPS.

Solvitieg• 7 years ago

Which is ironic because they also nominated Article 13 for "threatening freedom of expression"

rayiner• 7 years ago

Presumably it takes just a small number of people to submit a nomination, so you’re seeing different nominees from different factions.

api• 7 years ago

For circumventing ISP data collection on user browsing habits.

sdfin• 7 years ago

Is there any disadvantage about activating it? Is the default (https://mozilla.cloudflare-dns.com/dns-query) adequate?

snek2• 7 years ago

Make sure you have a resolver mode (trr.mode) that matches your comfort!

0 = use whatever the default is (one of the below)

1 = race DoH and regular dns and use whichever replies first

2 = try DoH and then fall back to regular dns

3 = only DoH

4 = unused

5 = explicitly off

The default resolver is identical to 1.1.1.1 except it collects less data: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

dcow3• 7 years ago

Requests take orders of magnitude more data because you have to negotiate TLS each time. Not the end of the world obviously but you will generate more traffic and observe slightly reduced performance.

the84722• 7 years ago

It would contribute to the centralization of the internet, by making cloudflare more important.

throw0101a8• 7 years ago

Is there any disadvantage about activating it?

How do you do split-horizon DNS if the browser goes out to some random IP for DNS instead of using the OS-supplised resolver (resolv.conf)?

If malware starts using it to contact C&C servers, how do I find the domain that's being talked to? If malware has to talk to internal DNS servers, I can examine the query log. If the malware uses Cloudflares CDN IPs for DNS, am I supposed to block all of Cloudflare?

ehsankia• 7 years ago

Aren't Google and many others looking at it too? Also DNS-over-TLS is also being looked at by Cloudflare, Quad9 and more. I don't see why Mozilla is being called out here.

15characterslon2• 7 years ago

Most major public (non-ISP) DNS resolvers support DNS-over-TLS today. (This includes Google, Cloudflare and Quad9.) The problem for the ISP is that switching to those resolvers would mean users would no longer use their DNS resolvers. I guess they're selling the data and that's why they're so mad about it. Mozilla is AFAIK the first one to include support for it in a browser. Chrome doesn't support it yet but will do so soon.

pbhjpbhj• 7 years ago

And default logging all your lookups with a third-party, I gather.

throw0101a8• 7 years ago

So... for circumventing censorship, then?

I don't know about ISPs, but as someone in IT, DoH could be a mess. If Firefox ignores resolve.conf how is split-horizon going to work? Wait until malware starts using it and it can't be blocked with blacklisting, e.g., entire CDN IP ranges.

Paul Vixie has strong views on DoH:

* https://twitter.com/paulvixie

I'd be okay if they at least used DNS-over-TLS (DoT): privacy and it can at least be handled by firewalls for us corporate types.

tialaramex2• 7 years ago

People should cut it out with the split horizon DNS. Like NAT this was always a nasty hack, of course things will break if you do it.

If you need malware to be nice and use your configured security systems or else it'll cause problems I have bad news for you: the malware authors aren't on your side.

Everything DoH, eSNI, TLS 1.3 and QUIC and a dozen other protocols are doing was already trivial for malware to do if it wanted. If your defences begin by assuming bad guys are only doing things that obey all your rules you've fundamentally misunderstood what "bad guys" even are.

dcow3• 7 years ago

I love Mozilla. I respect DoT/DoH. I support the adoption of private DNS for mature, independent, internet users. I personally value freedom of access to information over censorship. All these things should be protected by governments and the software we build.

I do not, however, dismiss the UK’s argument that society needs a practical way to for parents to monitor and potentially filter what type of content their children are encountering online. I do not believe a child deserves the same privacy as a grown adult. It’s not even really arguable: it’s a parent’s responsibility to parent their children. The only practical way for a parent to do so if everything uses global/e2e DNS privacy is to give children “managed” devices with non-administrator accounts, or physically hovering over their shoulder all the time (yes children can earn more privacy as they build more trust and mature, but that’s for a parent to decide). It’s much easier and more effective to manage this at a network level.

Furthermore, a consenting adult, without needing justification but common ones include: security, & ad-block, may choose to sacrifice a small amount of privacy (either because they don’t care or because they trust someone with the information) to enter into a relationship where they delegate filtering and monitoring to a third party. If someone wants to build a DNS resolver that doesn't resolve queries to companies run by assholes, then so be it.

Browser mandated DNS privacy prevents all of this (unless you have administrative access to install and configure DNS resolvers on all the devices you own—but you don’t: thanks Apple and the cloud-based internet of shit). And even then if vendors pin keys or certs then have fun. Mozilla certainly isn’t the devil and doesn’t deserve this assessment, but the controversy surrounding fast-tracking proliferation of vendor-controlled DNS “privacy” is warranted.

There’s a final point that often gets overlooked. If Mozilla or Google start shipping browsers that use their own DNS privacy resolvers, it’s a power play (whether intentional or not). They now control DNS, not you, not independent third parties. They now have more data about you. And they can start deploying nefarious things that only work in their vertically integrated web.

I don’t think it’s that much of a stretch to say blindly and hastily pushing DNS privacy without standards in place to defend interoperability of software and internet systems and prevent even deeper vertical integration is bad for the internet.

I am happy we have started exploring ways to extend privacy to the DNS. But I should be able to manage my network in my own home in whatever way I see fit. I do not wish to concede control of such a fundamental system so hastily to browser vendors, of all people.

cpeterso• 7 years ago

Firefox's DoH resolver is user-configurable but could presumably be locked down by enterprise or parental controls.

robtherobber2• 7 years ago

I'm not sure I understood your argument, very likely due to my limited knowledge in this area.

You say:

society needs a practical way to for parents to monitor and potentially filter what type of content their children are encountering online.

I agree with you on this point. But how does Mozilla's initiative prevent parents from filtering what type of content their children are allowed to be exposed to online or asserting control over this activity?

I would first argue that this is more than anything a responsibility of the parent - unsupervised internet browsing by children should not really be happening and no technology can save people (children included) from themselves/mistakes/curiosity/etc. as efficient as education can. If the children are too young they won't care that their browsing is filtered, if they are old enough to be knowledgeable about this kind of stuff they will likely find a way to circumvent filtering.

Second, surely, Mozilla can make the DoH functionality optional and, together with other local access & filtering measures, you can probably put in place a system that works for this case. You're again correct that it’s easier to manage this at a network level, but private DNS doesn't automatically impede us to do so, albeit it forces our hands to do so differently if the user can't decide for himself when to use it.

Third, if enough demand will appear for such a feature (i.e. to allow parents to filter browsing for children), I am confident that paid or even free solutions will emerge to address it. The way I see it, users should not concede control to browser vendors, especially if they are Google, but also if they are governments. I argue that we should trust our (democratic)governments with many things, but not with the guarantee that they will always work in the public interest. We need mechanisms to ensure they're always kept in check _before_ things go south.

If Mozilla or Google start shipping browsers that use their own DNS privacy resolvers, it’s a power play.

That's quite true and a reasonable point that I think needs addressing in a meaningful way. What we should have is more user control.

DonHopkins2• 7 years ago

It's like being on Nixon's or Trump's enemies list: a badge of honor!

They should pass out top hats and stick-on curly waxed mustaches to all Mozilla employees, to celebrate.

https://en.wikipedia.org/wiki/Villain

dmix3• 7 years ago

If the future internet is going to look anything like how their site looks I don’t want any part of it:

https://i.imgur.com/EyljrGA.png

90% of the content is needlessly covered, including the ridicolous EU cookie policy that interferes with millions of websites while providing almost no practical value to privacy.

Avamander2• 7 years ago

The GDPR prompt wouldn't even be required if nothing shady is going on :P

squiggleblaz5• 7 years ago

The GDPR prompt doesn't make me safer though.

robjan• 7 years ago

If you have cookies disabled you see the same notice, but asking you to enable all cookies. It can't be dismissed

dmix3• 7 years ago

Don’t you feel more secure now?

black6• 7 years ago

Mozilla – for their proposed approach to introduce DNS-over-HTTPS in such a way as to bypass UK filtering obligations and parental controls, undermining internet safety standards in the UK

In other words, for keeping the Internet true to its philosophical roots—to transmit information from A to B, regardless of the number or complexity of steps in between.

DoctorNick• 7 years ago

I have to give them credit; because of this article, I found out that Firefox now supports dns over https and I just enabled it in my browser. Thanks!

function_seven• 7 years ago

Same here. Just toggled it on. Mozilla can wear this nomination as a badge of honor.

climb_stealth• 7 years ago

For anyone else searching for the option:

Firefox -> Preferences -> General -> Network Settings -> Enable DNS over HTTPS

StavrosK3• 7 years ago

This overrides my DNS server, right? I use dnsmasq to rewrite all local addresses to their local IPs when I'm on my LAN, but it looks like this will break that.

ghoulfarmer• 7 years ago

you should enable ESNI (encrypted SNI) on top of that next.

wtmt• 7 years ago

Instructions for others:

* Type about:config in the address bar and hit Enter.

* Accept the "This will void your warranty" warning.

* Type network.security.esni.enabled in the search box (you can also just type esni to filter to this setting).

* If it's set to false, double click it to set it to true.

* Confirm that it's working and that your DNS requests are secure, by visiting the Cloudflare test page. [1]

[1] https://www.cloudflare.com/ssl/encrypted-sni/

inspector14• 7 years ago

thanks to you & the ispa for the heads up

jliptzin• 7 years ago

Thank you Mozilla! I’m doing it as well now.

stordoff• 7 years ago

Hero:

Sir Tim Berners-Lee – for spearheading the 'Contract for the Web' campaign

Contract for the Web:

[Governments will] Keep all of the internet available, all of the time
So that no one is denied their right to full internet access.
Respect people’s fundamental right to privacy
So everyone can use the internet freely, safely and without fear.
[Companies will] Respect consumers' privacy and personal data
So people are in control of their lives online.

https://contractfortheweb.org/

Villain:

Mozilla – for their proposed approach to introduce DNS-over-HTTPS in such a way as to bypass [censorship and prevent ISPs viewing DNS queries]

I'm sorry, what?

aussieguy1234• 7 years ago

For introducing DNS-over-HTTPS to circumvent censorship.

This will be great in dictatorships, where anything the dictator doesn't want you to see is censored.

rocky1138• 7 years ago

After reading their reason, I would like to say to Mozilla: keep up the good work.

nathancahill• 7 years ago

Mozilla should use this in ads. Like Snowbird's 1-star ad campaign [0]

[0] https://www.snowbird.com/one-star/

ljm• 7 years ago

And how important is ISPA.org.uk? If you’re up to date with our government’s ideas about internet censorship (aspirational to China, in a nutshell) then this org and post has no credibility.

The UK government has a serious axe to grind against any aspect of the internet they don’t like. They are trying to censor in their favour, using children as an excuse.

DNS over HTTPS is a thorn in their side. But of course, never mind Google and GDPR, they don’t give the slightest shit about any of that.

Never mind that DNS over HTTPS enhances the security of their own digital gov. movement.

devoply• 7 years ago

You must not be a wanker unless you register to be a wanker. Also no wanking teens. Their innocent eyes must be protected from depravity.

- UK government

DonHopkins2• 7 years ago

If only the word wanker had another, more general, less sexual connotation, that did not involve literally having sexual intercourse with ones self. Then there would not be so much of a stigma associated with registering as a wanker.

preinheimer• 7 years ago

The Net interprets censorship as damage and routes around it.

Close this as "works as designed".

squiggleblaz5• 7 years ago

1990s era myth. Falsified entirely nowadays but anyone who's ever been in a non-first tier democracy. The internet drops packets and they don't get through. And we're not just talking about the Great Firewall of China. More or less democratic states - and sometimes the free market of ISPs - will effectively censor you.

That's precisely why Mozilla has tried to create a new protocol to deal with the censorship. A bunch of people doing work to negotiate and implement a new protocol is not "the internet" unless you have the most depraved view of people or a view of "the internet" so broad as to be completely meaningless that we even had the internet in mediaeval Sweden.

apsdsm• 7 years ago

On my phone this website throws up a giant banner over the bottom 30% of the screen telling me I have cookies disabled and that I really do need to turn them back on please.

Riiiight. Moving on then...

lone_haxx0r• 7 years ago

Obviously, they are not stupid enough to really believe this. There are evident political interests in this nomination, but it's still amusing how they're saying it with a straight face.

I'm sorry for breaking my composure, but I'm laughing my ass off at these people. 10/10.

Mindwipe• 7 years ago

It's worth noting that IPSA has a complaints procedure open to customers of their member ISPS.

I'll certainly be making a complaint about their board tomorrow.

nine_k• 7 years ago

ISP Association makes a controversial move, gets publicity.

Mozilla gets a controversial nomination, also gets a bit of publicity.

News outlets have a bit more to write about.

In a cynical way, it's a win-win situation.

It also somehow resembles me a move by a n acquaintance of mine, a professor, who wrote to his students something like: "We recommend to use [this list of expensive textbooks]; the use of free textbooks available at [list of URLs] is not officially endorsed." Because, you know, want to let the students know about the free textbooks, but can't do so in a positive way.

dredmorbius6• 7 years ago

Since we're also talking about OpenWRT[1], you can enable DNS-over-HTTPS via DNSMasq for all software and devices on your LAN.[2]

1. https://news.ycombinator.com/item?id=20356811

2. https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq...

borland• 7 years ago

Association of criminals nominates the police as "City's worst Villain"

amatecha• 7 years ago

At the risk of sounding a bit sensationalistic, I think any org that calls Mozilla an "Internet Villain" just instantly loses any credibility to discern the hero/villain status of any other organization in the future :P

sys_64738• 7 years ago

DNS over https is coming to Chrome shortly:

https://chromium-review.googlesource.com/c/chromium/src/+/16...

ddingus• 7 years ago

Great!

I am in the process of returning to Mozilla as primary browser.

This helps.

jchw• 7 years ago

Hmm, maybe Mozilla should nominate the ISP Association for something similarly flattering given how absolutely absurd a conviction this is.

dredmorbius6• 7 years ago

And: ISP A&A have donated what would have been their ISPA membership fee to the Mozilla Foundation:

https://twitter.com/aaisp/status/1146803916853645314

judge20203• 7 years ago

Wait till Google pushes the Chrome update that includes the UI for enabling DoH. Google Chrome already supports DNS over HTTPS (just the UI is not available on non-mobile)[0] and they're working on eSNI[1].

0: https://github.com/bromite/bromite/wiki/Enabling-DNS-over-HT... (bromite exposes this flag)

1: https://crbug.com/908132#c14

ipsum2• 7 years ago

Wow, this got flagged off the front page really quickly, even though it has 183 votes in the last 2 hours.

pixxel• 7 years ago

Noob question, if I may. I have Cloudflare's 1.1.1.1 enabled on my devices via each device's own network settings. How does enabling Firefox's "Enable DNS over HTTPS" at browser level factor into things? Is one ignored or conflicted?

Firefox's Cloudflare DNS Resolver* collects less data than 1.1.1.1. Would be nice to use Firefox's Resolver at system level, heh.

*https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

kangnkodos• 7 years ago

Where is the great firewall of China on the list of villains? Surely that is doing more harm than Mozilla.

RaleyField• 7 years ago

And I, as a member of the esteemed assembly of contributors to this thread, am pleased to nominate Internet Services Providers’ Association as the 2019 Internet Villain. Congrats..

ISP Association Nominates Mozilla as “Internet Villain”

Related Stories