Mozilla recently changed Firefox's default behavior so that all United States users are using technology called DNS-over-HTTPS, which stuffs your DNS queries into an HTTPS request, which then spits back the IP to connect to. On its surface it's supposed to be "more secure", but the default DoH provider is Cloudflare. This should be alarming to anyone who considers centralization a threat. The effect of this is that all Firefox DNS traffic will be routed through Cloudflare, creating a funnel of information to a single provider.

Cloudflare uses Google captchas and other analytics. Mozilla has also been gathering "anonymous browsing data" through their Studies platform. The only real reason to gather this data is to sell it; very little of this data is useful for the Studies program, and using hot/cold or A/B testing for determining features is poor software design philosophy. As such, I recommend disabling DNS over HTTPS, or running your own Trusted Recursive Resolver, if you're going to stick with Firefox.

How to Disable DNS over HTTPS

1. Open about:config;
2. Search for network.trr.mode, and set it to 5. If it doesn't exist, create it, so when you update Firefox the key will already be made. See the MDN wiki for a description of the magic numbers used here.
3. Restart your browser.

Be sure to do this for all Firefox installations.

Who knows how long they'll allow it. At present I cannot recommend any HTTP browsers. The whole protocol is a mess, as are the attempts to secure it.

If you've been paying attention, it's become harder and harder to run your own website, because corporations and browser vendors (one and the same here) keep changing the requirements to be considered "secure". This is a repeat of what's happened to the e-mail protocol, and apparently we'll need to fuck up HTTP to relearn that lesson.

We need to have a serious conversation about trust and networking. Large, powerful organizations are trying to steer what the public does online and we're expected to just trust them. What have they done to deserve our trust? We read about leak after leak of data; data that wouldn't leak if it wasn't gathered in the first place. And their answer is to trust yet another entity, that we don't have legal agreements with, to our most personal browsing information. That's a trap, folks.

None of this makes me trust the Web. It highlights how broken TCP/IP itself is. We need a networking stack that puts security and privacy first, not as a half-baked, cat's-out-of-the-bag "solution" through corporate partnerships and continuously changing the requirements for Web authorship.

There are solutions out there to sandbox your browser: Firejail, a chroot, whatever "universal packaging solution" is hip on Linux these days, or just a regular ol' VM.

If you have to use all of these things dressed up to the nines to browse the Web, then it's time to realize that HTTP(S) Is Harmful.

-z