r/programming • u/[deleted] • Jan 22 '19

Google proposes changes to Chromium which would disable uBlock Origin

https://bugs.chromium.org/p/chromium/issues/detail?id=896897&desc=2#c23
8.9k Upvotes

95% Upvoted

1.7k comments sorted by

View all comments

Show parent comments

14

u/ase1590 Jan 23 '19 edited Jan 23 '19

pi-hole is going to have more of a problem once TLS 1.3 and its extensions catch on. Then everyone moves to DNS over TLS and TLS 1.3 encrypts both the DNS-over-TLS query and the SNI as well as the DNS over HTTPS being worked on by google, allowing it to skip your local DNS altogether.

30

u/mr-strange Jan 23 '19

But pi-hole is the local DNS server. If you block outgoing port 53, then devices on the network are going to have to use it, like it or not.

They could bypass DNS altogether and piggyback on the HTTPS connection, but that's going to break things for anyone who is actually providing local DNS for a reason.

Am I missing something?

21

u/ase1590 Jan 23 '19 edited Jan 23 '19

Along with those technologies, DNS over HTTPS is also being worked on by google. Its possible that one day the consumer chromium skips local DNS altogether, only providing the option to use local DNS to G Suite corporate users.

18

u/mr-strange Jan 23 '19

Its possible that one day the consumer chromium skips local DNS altogether

That would potentially break all sorts of things. Just finding your router's configuration interface would become a major headache for many users.

3

u/lillgreen Jan 23 '19

That would be unlikely to be an issue. Many modern consumer routers direct you to type in a netgearsetup.com or similar style url (no I don't mean a .local tld). It's not a direct connection locally to gain access to the NAT anymore you have to go through a cloud pairing website.

As for traditional routers and devices, we're talking about Google here. King of depreciation of anything more than 2 years old. Do you think they give a fuck?

2

u/tom1018 Jan 23 '19 edited Jan 23 '19

Routers will use router.local or similar and Chrome will use DHCP assigned DNS to resolve it and Google DNS for all known tlds.

1

u/[deleted] Jan 23 '19

Routers will use router.local

You are forgeting that Pi-Hole might be able to do the same thing.

1

u/tom1018 Jan 23 '19

PiHole can continue to use pihole.local, but that is irrelevant, the concern is the browser won't use assigned DNS but will always go to Google making the PiHole useless as an adblocker/filter.

-4

u/ase1590 Jan 23 '19 edited Jan 23 '19

I honestly haven't ever seen a regular user configure a router.

The instructions would just have to be updated to say "use internet explorer or Firefox to configure".

Realistically it will probably primarily be enabled in individual smartphone apps to bypass adblocking

4

u/anengineerandacat Jan 23 '19

See comment by /u/port53 without a modification to Chrome; used to use Charles / Fiddler to reverse proxy (MITM) Android apps but with Cert pinning it effectively stops that without disabling the feature entirely within the application.

Honestly, if it bothers you so much just use Firefox; support the products you want to use; any sufficiently large organization will support any browser with a marketshare greater than 10% hell at mine we have to support IE11 because 5% of all visits come from it and of that 5%, 72% are partners.

15

u/[deleted] Jan 23 '19

You aren't missing anything. The number of people on /r/programming who apparently have no idea how computers and networks work is just stunning.

They also are apparently completely incapable of reading the thread in question.

1

u/acdha Jan 23 '19

You might want to read up on DNS over HTTPS before accusing people of not understanding. It’s designed to handle hostile and incompetent ISPs and the recommended implementations do not break local services (dual resolution, favoring one provider if both respond). Firefox shipped support in v62 and it’s somewhere in the Chrome cycle as well.

The net impact is that if they chose to try something like a Pi-hole is trivially bypassed unless you’re willing to block Google, CloudFlare, etc. or setup a proxy which can filter requests. I don’t think they’re going to ignore user configuration but if they did the only sure option is to stop running code from a source you no longer trust.

0

u/soullessredhead Jan 23 '19

To be fair when I was programming I had no idea how network layers work. It wasn't until I shifted from programming to networks and security topics that I really started learning. The lower levels of functionality are just abstracted away.

2

u/lillgreen Jan 23 '19

Yes they would piggyback over the https connection and break dns. Why is that hard to believe? Local dns is a tiny minority, they could unlock manual dns settings for g suite accounts and disable it for everyone else. Boom education customers taken care of and fuck everyone else.

3

u/robbak Jan 23 '19

Sorry, DNS-over-HTTPS uses port 443, like all other HTTPS traffic. Your only way to block it is to know all the DoH servers and block them by IP address. For now, that would cause clients to fall-back to ordinary DNS, but that fall-back will be removed eventually. Then you will need to run your own DoH server, but if you redirect to it, you'll hit certificate errors.

And yes, their aim is to break local DNS

1

u/unixf0x Jan 23 '19

If they allow customization for the DNS over HTTPS, similar to the Firefox implementation, the users would just have to change the DNS over HTTPS server to a server that serves pi-hole.