DoH mode 2 should always use heuristics
Categories
(Core :: Networking: DNS, defect, P2)
Tracking
()
People
(Reporter: grover, Unassigned)
References
Details
(Whiteboard: [necko-triaged])
If mode 2 is turned on by the add-on, but also if the user enables doh in prefs.
Currently, there are two paths to Firefox using DoH. One is if the user goes into prefs and enables it (mode 2). In this case, DoH will be used always (except if DoH provider reports an error, in which case FF will fall back to system DNS for that query).
Another is if DoH is enabled by the rollout addon. This requires that the user has NOT touched the default pre-existing DoH settings (i.e. DoH is not enabled). A doorhanger will be displayed to the user, giving them a chance to opt out, but assuming they opt in then DoH will be enabled, but this is not exactly the same as the first case because additional tests ("heuristics") are performed that conditionally disable DoH.
This, with the current UI, creates problems:
- Users who opt out of DoH via doorhanger but reconsider and enable via prefs will get different behavior (DoH but no heuristics) than if they had accepted the doorhanger (Doh with heuristics). That's surprising.
- Users who want DoH with heuristics and enable via the pref UI before the plugin is enabled will not get heuristics, even after the addon is enabled (the main focus of this bug). That's surprising.
- No obvious way to know if heuristics are enabled or not. This is a subset of the greater issue: No obvious way to know if DoH was used or not.
If UI changes are not possible in the short term, I think the most sensible thing is to enable heuristics for all users in mode 2, whether the addon or the user enabled DoH. This solves #1 and #2 above.
Applying heuristics to all users in mode 2 could be surprising the other way to some users, where DoH is expected to be used, and then with heuristics enabled is used less. I think this is a lesser concern because mode 2 users were already only best effort (subject to system DNS fallback on error), and if they have a strict requirement to use DoH, then use mode 3.
see bug 1614751 where users are finding current behavior confusing.
|
Reporter | |
Updated•5 years ago
|
|
||
Comment 1•5 years ago
|
||
IMO, a good way to solve this problem is to use a different trr.mode value for "on with heuristics". We can use mode 1 for this instead of having mode 2 having different meanings depending whether people choose to enable DoH themselves or if DoH gets enabled as the default option. This would need some changes in the UI and addon code though.
Applying heuristics to all users in mode 2 is tricky, due to the surprise factor mentioned in the previous comment. Another problem is that many of those users have made the choice to enable DoH for themselves, and we should not interfere with that (the heuristics will flip trr.mode back and forth between mode 0 and 2 based on networks).
|
||
Comment 2•5 years ago
|
||
Please also change the behavior of the use-application-dns.net query so replies with NOERROR and a specific A or AAAA record (like 127.0.0.2) are also accepted as indication.
|
|
Reporter | |
Comment 3•5 years ago
|
||
(In reply to Rob Janssen from comment #2)
Please also change the behavior of the use-application-dns.net query so replies with NOERROR and a specific A or AAAA record (like 127.0.0.2) are also accepted as indication.
Please open an independent bug for this?
How would it work in terms of parental control via a DNS server? If someone wants that, will this still allow the user (child) to change network.trr.mode (to 3) and bypass use-application-dns.net?
From what I can tell this use case has been totally ignored by DoH and there's literally no way to have parental control. Feel free to tell me If I'm missing something.
|
|
||
Updated•5 years ago
|
How would it work in terms of parental control via a DNS server?
Or similarly, if an organization wants all DNS request to go through it's internal DNS resolver.
|
||
Comment 6•4 years ago
|
||
I think this is WONTFIX. But I need to re-read this - needinfo myself to keep it in my queue.
Could we at least have an easier way to set firefox to heuristics mode? Currently, if you ever toggle DoH in the settings page, it is pretty difficult to get DoH back into heuristics mode.
|
|
||
Comment 8•4 years ago
|
||
OK, I do think this is WONTFIX.
- Yes, users can't get back into heuristics mode, but heuristics are mostly purposed for detecting conditions unsuitable for us to make a choice on behalf of the user. Once the user starts making some choices, we don't need heuristics.
- We've long had the intention of improving the DoH UI in about:preferences including making it possible to toggle heuristics mode in some way. However, that's a separate effort that also involves exposing DoH status better in the UI somewhere. In any case, this bug is about coupling heuristics with mode 2, which I don't think is the way to go especially because we decided to keep heuristics in the frontend.
Please see bug 1664875 and bug 1616982.
Description
•