> I don't really understand how you gave your consent any more explicitly in that case than I did when I chose and configured Firefox as my browser.
That's not a reasonable position. Never before in the history of computing has a regular end-user application actively tried to subvert the operating-system's network defaults.
Why should anyone expect that to be the position now? Should I expect Thunderbird too to bypass my DNS-settings? What about Rust's cargo? It's from Mozilla too.
Will I need to manually go configure all those tools to do what is the reasonable default, namely following what the OS tells it to do?
When Firefox fails to resolve a domain, but nslookup resolves it just fine... What should I as an end-user believe? (Besides that we have an orderly world turning into chaos)
Do you really think every application choosing, managing and implementing its own resolver is a scalable way of managing applications and networking? Really? Yeah no. So why should browsers get a free pass do things differently?
> Did your ISP make it explicitly clear to you upon signing up that with the default configuration, they'd be able to see all domain names you visit including of encrypted websites?
No. But that's not what we're talking about here.
What has always been a clear expectation is that if I sign up for an ISP and I use that ISP's default network setup, that I will be using that ISP's DNS. Never in the history of ISPs has there been any other default.
So if I may rephrase your question:
> Was it explicitly clear to you that by using an ISP as an ISP, you will also by default use their DNS services?
Obviously. That's how the internet works and has always worked. In fact, anything else would be strange.
Unless I explicitly implement something differently, I have no reason to expect anyone besides my ISP (which I do trust, I'm not from the US) is handling my DNS.
Unlike my ISP (which I trust), anyone who deviates from this contract will be someone I actively distrust. I'm looking at you, Mozilla.
Mozilla does not have this kind of influence over Rust. They've never indicated that they'd want us to do this, we've never thought that doing this is something we'd want to do, but if they told us they wanted it, and we didn't want it, it wouldn't happen.
> That's not a reasonable position. Never before in the history of computing has a regular end-user application actively tried to subvert the operating-system's network defaults. ... Will I need to manually go configure all those tools to do what is the reasonable default, namely following what the OS tells it to do?
For starters, just because the OS provides its own name resolving facilities doesn't mean it's telling applications to use it. It's there to make application development easier, not as a security feature.
> When Firefox fails to resolve a domain, but nslookup resolves it just fine... What should I as an end-user believe?
The end user should believe what the error message says, because we don't design web browsers with the expectation that the user understands how DNS works. And if they do, then I don't see why it's so onerous to ask that they also learn how DoH works, given that having that default is in the best interest of the majority of the product's users.
> Do you really think every application choosing, managing and implementing its own resolver is a scalable way of managing applications and networking? ... So why should browsers get a free pass do things differently?
Yes, I don't really see how that's such a big scalability problem like you're making it out to be. It is obviously necessary that any networked application will manage and implement its own purpose-built network protocol already. That is a significant amount of complexity necessary to any networked application, and name resolution is just a small function in comparison.
Furthermore it actually does make sense for web browsers to have special behaviour here since they are almost never used to connect to LAN resources, just internet resources, which is unlike many other networked applications. They also make up a widely used application platform which has specific security and privacy needs that other networked applications don't have.
> No. But that's not what we're talking about here.
It's what I'm talking about, because I don't see how to make sense of your "Firefox is malware" analogy otherwise. Your ISP picked a default, Mozilla picked a different default.
> What has always been a clear expectation is that if I sign up for an ISP and I use that ISP's default network setup, that I will be using that ISP's DNS. Never in the history of ISPs has there been any other default. ... Unless I explicitly implement something differently, I have no reason to expect anyone besides my ISP (which I do trust, I'm not from the US) is handling my DNS.
I don't think that's a clear expectation to most of the people who are in fact sold internet access without being trained on how DNS works. I also believe that Mozilla very clearly communicated that they were changing this default, through many channels, to Firefox users. So your implication that Mozilla is doing something sneaky here is ridiculous.
I'm sorry that this change broke your PiHole config but you can fix it easily. New software sometimes breaks your old configs. That's life. If you want an ad-blocking solution that isn't so brittle, then try installing uBO on the client rather than abusing DNS for that purpose.
That's not a reasonable position. Never before in the history of computing has a regular end-user application actively tried to subvert the operating-system's network defaults.
Why should anyone expect that to be the position now? Should I expect Thunderbird too to bypass my DNS-settings? What about Rust's cargo? It's from Mozilla too.
Will I need to manually go configure all those tools to do what is the reasonable default, namely following what the OS tells it to do?
When Firefox fails to resolve a domain, but nslookup resolves it just fine... What should I as an end-user believe? (Besides that we have an orderly world turning into chaos)
Do you really think every application choosing, managing and implementing its own resolver is a scalable way of managing applications and networking? Really? Yeah no. So why should browsers get a free pass do things differently?
> Did your ISP make it explicitly clear to you upon signing up that with the default configuration, they'd be able to see all domain names you visit including of encrypted websites?
No. But that's not what we're talking about here.
What has always been a clear expectation is that if I sign up for an ISP and I use that ISP's default network setup, that I will be using that ISP's DNS. Never in the history of ISPs has there been any other default.
So if I may rephrase your question:
> Was it explicitly clear to you that by using an ISP as an ISP, you will also by default use their DNS services?
Obviously. That's how the internet works and has always worked. In fact, anything else would be strange.
Unless I explicitly implement something differently, I have no reason to expect anyone besides my ISP (which I do trust, I'm not from the US) is handling my DNS.
Unlike my ISP (which I trust), anyone who deviates from this contract will be someone I actively distrust. I'm looking at you, Mozilla.