{"id":37892,"date":"2019-10-31T22:20:24","date_gmt":"2019-10-31T19:20:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox\/"},"modified":"2019-10-31T22:20:24","modified_gmt":"2019-10-31T19:20:24","slug":"mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","title":{"rendered":"Mozilla liidab Firefoxis vaikevalikuna DNS-over-HTTPS.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Firefoxi arendajad teatasid<\/a><\/noindex> DNS \u00fcle HTTPS (DoH) toe testimise l\u00f5petamisest ja kavatsusest septembri l\u00f5pus see tehnoloogia automaatselt USA kasutajatele aktiveerida. Aktiveerimine toimub j\u00e4rk-j\u00e4rgult, alguses m\u00f5ne protsendi kasutajate seas ning probleemide puudumisel ulatub see l\u00f5puks 100% -ni. P\u00e4rast USA katmist kaalutakse v\u00f5imalust DoH aktiveerida ka teistes riikides.<\/p>\n

Aasta jooksul l\u00e4bi viidud testid on n\u00e4idanud teenuse usaldusv\u00e4\u00e4rsust ja head toimivust, samuti on nad aidanud tuvastada teatud olukordi, kus DoH v\u00f5ib p\u00f5hjustada probleeme, ja t\u00f6\u00f6tada v\u00e4lja lahendusi nende v\u00e4ltimiseks (n\u00e4iteks on arutatud probleeme<\/a><\/noindex> sisu edastamise v\u00f5rkudes liikluse optimeerimist, vanemlikku kontrolli ja ettev\u00f5tte sise DNS-ala). <\/p>\n

DNS-trafiku kr\u00fcpteerimise t\u00e4htsust peetakse kasutajate kaitse v\u00e4ltimatuks teguriks, seet\u00f5ttu on DoH otsustatud vaikimisi sisse l\u00fclitada, kuid esialgu ainult USA kasutajatele. DoH aktiveerimisel kuvatakse kasutajale hoiatusteade, mis v\u00f5imaldab soovikorral loobuda tsentraliseeritud DoH DNS-serverite kasutamisest ja naasta traditsioonilisse mitten\u00fc\u00fcdseeritud DNS-serverite p\u00e4ringute s\u00fcsteemi (DoH kasutab kindlat DoH-teenust, mis v\u00f5ib toimida kui \u00fchekordne rikke punkt, erinevalt jaotatud DNS-resolverite infrastruktuurist).<\/p>\n

DoH aktiveerimisel v\u00f5ib tekkida probleeme vanemliku kontrolli ja ettev\u00f5tete v\u00f5rgustike t\u00f6\u00f6ga, mis kasutavad ainult sisev\u00f5rgu nimetuste struktuuri intraneti aadresside ja ettev\u00f5tte hostide teisendamiseks. Selliste s\u00fcsteemide probleemide lahendamiseks on lisatud kontrollide s\u00fcsteem, mis automaatselt keeb DoH v\u00e4lja. Kontrollid viiakse l\u00e4bi iga kord, kui brauser k\u00e4ivitatakse, v\u00f5i kui tuvastatakse alams\u00fcsteemi muudatus.<\/p>\n

Automaatne tagasiside tavalise operatsioonis\u00fcsteemi resolvijale on samuti ette n\u00e4htud, kui tekivad DoH-i kaudu resolvimise t\u00f5rked (n\u00e4iteks, kui DoH-i pakkuja v\u00f5rk on puudulik v\u00f5i kui tema infrastruktuuris ilmnevad t\u00f5rked). Selliste kontrollide m\u00f5te on kaheldav, kuna keegi ei takista r\u00fcndajaid, kes kontrollivad resolvija t\u00f6\u00f6d v\u00f5i suudavad liiklust sekkuda, simuleerimast sellist k\u00e4itumist, et keelata DNS-i liikluse kr\u00fcpteerimine. Probleem lahendatakse seadistuste lisamisega punkti \u201eDoH always\u201c (vaikimisi mitte aktiivne), mille aktiveerimisel automaatne v\u00e4ljal\u00fclitamine ei rakendu, mis on m\u00f5istlik kompromiss.<\/p>\n

Ettev\u00f5tte resolvereid m\u00e4\u00e4ratlemiseks kontrollitakse ebat\u00fc\u00fcpilisi \u00fclemisi domeene (TLD) ja tagastatakse sisev\u00f5rgu aadresse s\u00fcsteemi resolveriga. Vanemlik kontroll h\u00f5lmab katset tagasiviimist domeeninimega exampleadultsite.com, ja kui tulemus ei kattu tegeliku IP-aadressiga, loetakse, et DNS-tasandil on t\u00e4iskasvanute sisu blokeeritud. T\u00e4iendavalt kontrollitakse ka Google'i ja YouTube'i IP-aadresse, et tuvastada, kas need on suunatud restrict.youtube.com, forcesafesearch.google.com ja restrictmoderate.youtube.com. Lisaks Mozilla pakub<\/a><\/noindex> rakendada \u00fchtset kontrollimise hosti use-application-dns.net<\/a><\/noindex>, mida saavad kasutada internetiteenuse pakkujad ja vanemlikud kontrolliteenused DoH v\u00e4lja l\u00fclitamise m\u00e4rgiks (kui hosti ei m\u00e4\u00e4rata, siis Firefox l\u00fclitab DoH v\u00e4lja).<\/p>\n

T\u00f6\u00f6tamine \u00fche DoH-teenuse kaudu v\u00f5ib samuti potentsiaalselt p\u00f5hjustada probleemide tekkimist sisuhalduse jaotamise v\u00f5rkudes, mis t\u00e4idavad liikluse tasakaalustamist DNS-i abil (CDN-v\u00f5rgu DNS-server koostab vastuse, v\u00f5ttes arvesse resolveri aadressi ja v\u00e4ljastab l\u00e4hima hosti sisu saamiseks). DNS-p\u00e4ringu saatmine l\u00e4himast resolverist kasutajale sellistes CDN-des toob kaasa aadressi tagastamise, mis on kasutajale k\u00f5ige l\u00e4hemal asuv host, kuid kui DNS-p\u00e4ring saadetakse tsentraliseeritud resolverist, v\u00e4ljastatakse aadress, mis on k\u00f5ige l\u00e4hemal DNS-over-HTTPS-serverile. Praktikas n\u00e4idatud testimine t\u00f5estas, et DNS-over-HTTP rakendamine CDN-ide kasutamisel ei p\u00f5hjustanud peaaegu viivitusi sisu edastamise alguses (kiiretes \u00fchendustes ei \u00fcletanud viivitused 10 millisekundit ning aeglaste kanalite korral t\u00e4heldati isegi t\u00f6\u00f6 kiirenemist). CDN-i resolverile kliendi asukoha edastamiseks vaadeldi samuti EDNS Client Subnet laienduse rakendamise v\u00f5imalust.<\/p>\n

Tulet meenutada, et DoH v\u00f5ib olla kasulik, et v\u00e4ltida hostinimede p\u00e4ringute teavet lekkeid, mida edastatakse teenusepakkujate DNS-serverite kaudu, v\u00f5idelda MITM-r\u00fcnnakute ja DNS-liiklusest k\u00f5rvalekaldumisega, takistada DNS-taseme blokeeringute korral v\u00f5i korraldada t\u00f6\u00f6d, kui otse DNS-serverite poole p\u00f6\u00f6rdumine ei ole v\u00f5imalik (n\u00e4iteks t\u00f6\u00f6tades l\u00e4bi proksi). Tavalistes olukordades saadetakse DNS-p\u00e4ringud otse s\u00fcsteemi konfigureeritud DNS-serveritele, kuid DoH korral kapseldatakse hosti IP-aadressi m\u00e4\u00e4ramise p\u00e4ring HTTPS-liiklusesse ja saadetakse HTTP-serverisse, kus resolvender k\u00e4sitleb p\u00e4ringuid l\u00e4bi Web API. Praegune standard DNSSEC kasutab kr\u00fcpteerimist vaid kliendi ja serveri autentimiseks, kuid ei kaitse liiklust pealtkuulamise eest ega taga p\u00e4ringute konfidentsiaalsust. <\/p>\n

DoH-i aktiveerimiseks tuleb about:config'is muuta muutuja network.trr.mode v\u00e4\u00e4rtust, mis on toetatud alates Firefox 60-st. V\u00e4\u00e4rtus 0 keelab DoH-i t\u00e4ielikult; 1 - kasutatakse DNS-i v\u00f5i DoH-i, s\u00f5ltuvalt sellest, kumb on kiirem; 2 - DoH on vaikimisi, DNS-i kasutatakse varuna; 3 - kasutatakse ainult DoH-i; 4 - peegeldusre\u017eiim, kus DoH ja DNS t\u00f6\u00f6tavad paralleelselt. Vaikimisi kasutatakse CloudFlare'i DNS-serverit, kuid seda saab muuta muutuja network.trr.uri kaudu, n\u00e4iteks v\u00f5ib seada «https:\/\/dns.google.com\/experimental» v\u00f5i «https:\/\/9.9.9.9\/dns-query».<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0438 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u0438\u0438 \u0432 \u043a\u043e\u043d\u0446\u0435 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0412\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0432\u043d\u0430\u0447\u0430\u043b\u0435 \u0434\u043b\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u043d\u0442\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u0441\u0442\u0435\u043f\u0435\u043d\u043d\u043e \u0434\u043e\u0432\u043e\u0434\u044f \u0434\u043e 100%. \u041f\u043e\u0441\u043b\u0435 \u043e\u0445\u0432\u0430\u0442\u0430 \u0421\u0428\u0410 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f DoH \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla viib Firefoxis vaikimisi sisse DNS-over-HTTPS | ProHoster","description":"Firefoxi arendajad teatasid testimise l\u00f5petamisest toe jaoks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442 \u043a \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e DNS-over-HTTPS \u0432 Firefox | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:24+00:00","article:modified_time":"2019-10-31T19:20:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:39:22","updated":"2026-01-23 19:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}