Hacker News new | ask | show | jobs
by tialaramex 2189 days ago
Mozilla provides a clear policy for how you get your resolver onto their list. US ISPs (the DoH resolver is only enabled by default in the US) could obey that policy and apply to be added to the list.

But it seems like none of them have done that. Maybe the policy terms are objectionable? Let's see:

"Only aggregate data that does not identify individual users or requests may be retained beyond 24 hours."

But how will the poor ISP make extra money selling DNS query information?

"When a domain requested by the user is not present, the party operating the resolver should provide an accurate NXDOMAIN response and must not modify the response or provide inaccurate responses that direct the user to alternative content."

An ISP that obeys this can't put up advertising banners or sell search engine redirects when you typo a name - they'll have to actually earn money providing Internet service instead.
1 comments
gsich 2189 days ago
Mozilla can't verify that the providers behave. Apart from the obvious NXDOMAIN answers (not many providers will do so).

Also it is questionable why a free service would be better then a paid one. If one assumes that the ISP is evil, DNS providers are not suddenly less evil.

link
tialaramex 2189 days ago
As with its Trust Store Mozilla operates in public. If you believe that providers aren't behaving you can and should present evidence to the community.

Mozilla isn't suggesting you choose services based on how cheap they are, but on whether they implement these policies.

NextDNS, who are on Mozilla's list, offer a paid service if you want advertising filters or porn filtering or whatever but if you're damn sure you "get what you pay for" then pay them their subscription fee and don't switch on any filters.

link
gsich 2189 days ago
>Mozilla isn't suggesting you choose services based on how cheap they are, but on whether they implement these policies.

Mozilla doesn't know if they do. They can't verify it. So if Mozilla says "Cloudflare and Nextdns adhere to our policies" it's not verifiable by me and neither by them. I don't see a "trust but verify"-implementation. This is my gripe with this behaviour.

link