{"id":37892,"date":"2019-10-31T22:20:24","date_gmt":"2019-10-31T19:20:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox\/"},"modified":"2019-10-31T22:20:24","modified_gmt":"2019-10-31T19:20:24","slug":"mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","title":{"rendered":"Mozilla prelazi na uklju\u010divanje DNS-over-HTTPS kao zadane opcije u Firefoxu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Razvojni programeri Firefox-a <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.mozilla.org\/futurereleases\/2019\/09\/06\/whats-next-in-making-dns-over-https-the-default\/\">objavili su<\/a><\/noindex> o zavr\u0161etku testiranja podr\u0161ke za DNS preko HTTPS (DoH, DNS over HTTPS) i namjeri da se krajem rujna ova tehnologija uklju\u010di kao zadana za korisnike u SAD-u. Uklju\u010divanje \u0107e se odvijati postepeno, prvo za nekoliko postotaka korisnika, a u slu\u010daju odsustva problema postupno se pove\u0107avati do 100%. Nakon pokrivenosti SAD-a razmotrit \u0107e se mogu\u0107nost uklju\u010divanja DoH-a i u drugim zemljama.<\/p>\n<p>Provedena testiranja tijekom godine pokazala su pouzdanost i dobru izvedbu usluge, a tako\u0111er su otkrila neke situacije kada DoH mo\u017ee uzrokovati probleme i razradila rje\u0161enja za njihovo zaobila\u017eenje (na primjer, razra\u0111eni su <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50448\">problema<\/a><\/noindex> s optimizacijom prometa u mre\u017eama isporuke sadr\u017eaja, roditeljskom kontrolom i korporativnim internim DNS zonama). <\/p>\n<p>Va\u017enost \u0161ifriranja DNS prometa smatra se klju\u010dnim faktorom za\u0161tite korisnika, stoga je odlu\u010deno uklju\u010diti DoH kao zadano rje\u0161enje, no u prvom koraku samo za korisnike iz SAD-a. Nakon aktivacije DoH-a korisniku \u0107e se prikazati upozorenje koje \u0107e mu omogu\u0107iti da po \u017eelji odustane od kori\u0161tenja centraliziranih DoH DNS poslu\u017eitelja i vrati se na tradicionalni na\u010din slanja ne\u0161ifriranih upita DNS poslu\u017eitelju svog davatelja usluga (umjesto distribuirane infrastrukture DNS resolvera, u DoH-u je kori\u0161teno vezivanje za odre\u0111enu DoH uslugu koja se mo\u017ee smatrati jedinstvenom to\u010dkom otkaza).<\/p>\n<p>Pri aktivaciji DoH-a mo\u017ee do\u0107i do problema s radom sustava roditeljske kontrole i korporativnih mre\u017ea koje koriste strukturu imena DNS dostupnu samo za unutarnju mre\u017eu za prevo\u0111enje intranet adresa i korporativnih hostova. Za rje\u0161avanje problema s takvim sustavima dodan je sustav provjera koji automatski isklju\u010duje DoH. Provjere se izvr\u0161avaju pri svakom pokretanju preglednika ili pri utvr\u0111ivanju promjene podsustava.<\/p>\n<p>Automatski povratak na kori\u0161tenje standardnog rezolvera operacijskog sustava tako\u0111er je predvi\u0111en u slu\u010daju neuspjeha prilikom rezolviranja putem DoH (na primjer, tijekom prekida mre\u017ene dostupnosti s provajderom DoH ili prilikom provale u njegovoj infrastrukturi). Smisao takvih provjera je upitan, jer ni\u0161ta ne sprje\u010dava napada\u010de koji kontroliraju rad rezolvera ili koji mogu ometati promet da simuliraju takvo pona\u0161anje kako bi isklju\u010dili enkripciju DNS prometa. Problem je re\u0161en dodavanjem u postavke opcije 'DoH always' (koja je po defaultu isklju\u010dena), pri \u010demu se automatsko isklju\u010divanje ne primjenjuje, \u0161to predstavlja razumni kompromis.<\/p>\n<p>Za odre\u0111ivanje korporativnih razlu\u010ditelja provode se provjere netipi\u010dnih domena prvog nivoa (TLD) i vra\u0107anje intranet adresa putem sistemskog razlu\u010ditelja. Da bi se utvrdilo uklju\u010divanje roditeljskog nadzora, poku\u0161ava se razlu\u010diti ime exampleadultsite.com i ako se rezultati ne podudaraju s stvarnim IP-jem, smatra se da je aktivna blokada odraslog sadr\u017eaja na razini DNS-a. Kao znakovi tako\u0111er se provjeravaju IP adrese Googlea i YouTubea na zamjenu s restrict.youtube.com, forcesafesearch.google.com i restrictmoderate.youtube.com. Dodatno, Mozilla <noindex><a rel=\"nofollow\" href=\"https:\/\/support.mozilla.org\/en-US\/kb\/configuring-networks-disable-dns-over-https\">nudi<\/a><\/noindex> implementirati jedinstveni provjerava\u010dki host <noindex><a rel=\"nofollow\" href=\"https:\/\/use-application-dns.net\/\">use-application-dns.net<\/a><\/noindex>, koji mogu koristiti internetski pru\u017eatelji i usluge roditeljskog nadzora kao oznaku za isklju\u010divanje DoH-a (ako se host ne odredi, Firefox isklju\u010duje DoH).<\/p>\n<p>Rad preko jedinstvene DoH usluge tako\u0111er potencijalno mo\u017ee dovesti do problema s optimizacijom prometa u mre\u017eama isporuke sadr\u017eaja, koje vr\u0161e balansiranje prometa koriste\u0107i DNS (DNS server CDN mre\u017ee formira odgovor, uzimaju\u0107i u obzir adresu resolvera i isporu\u010duje najbli\u017ei host za dobivanje sadr\u017eaja). Slanje DNS upita s najbli\u017eeg resolvera korisniku u takvim CDN-ima dovodi do vra\u0107anja adrese najbli\u017eeg korisniku hosta, ali pri slanju DNS upita s centraliziranog resolvera \u0107e biti izdana adresa hosta, najbli\u017ea serveru DNS-over-HTTPS. Testiranje u praksi pokazalo je da primjena DNS-over-HTTP prilikom kori\u0161tenja CDN-a prakti\u010dno nije dovodila do ka\u0161njenja prije po\u010detka prijenosa sadr\u017eaja (za brze veze ka\u0161njenja nisu prelazila 10 milisekundi, dok su na sporijim vezama opa\u017eena \u010dak ubrzanja rada). Za preno\u0161enje informacija o lokaciji klijenta resolveru CDN, tako\u0111er je razmatrana primjena pro\u0161irenja EDNS Client Subnet.<\/p>\n<p>Podsjetimo, DoH mo\u017ee biti koristan za izbjegavanje curenja informacija o tra\u017eenim imenima hostova putem DNS poslu\u017eitelja davatelja, borbu protiv MITM napada i zamjene DNS prometa, suprotstavljanje blokadama na razini DNS-a ili za organizaciju rada u slu\u010daju nemogu\u0107nosti izravnog pristupa DNS poslu\u017eiteljima (na primjer, prilikom rada preko proxyja). Ako se u obi\u010dnim okolnostima DNS upiti izravno \u0161alju na odre\u0111ene DNS poslu\u017eitelje konfigurirane u sustavu, u slu\u010daju DoH, upit za odre\u0111ivanje IP adrese hosta je inkapsuliran u HTTPS promet i \u0161alje se na HTTP poslu\u017eitelj, na kojem resolver obra\u0111uje upite putem web API-ja. Postoje\u0107i standard DNSSEC koristi enkripciju samo za autentikaciju klijenta i poslu\u017eitelja, ali ne \u0161titi promet od presretanja i ne jam\u010di povjerljivost upita. <\/p>\n<p>Za aktivaciju DoH u about:config potrebno je promijeniti vrijednost varijable network.trr.mode, koja se podr\u017eava od verzije Firefox 60. Vrijednost 0 potpuno isklju\u010duje DoH; 1 \u2014 koristi DNS ili DoH, ovisno o tome \u0161to je br\u017ee; 2 \u2014 koristi DoH po defaultu, a DNS kao rezervnu opciju; 3 \u2014 koristi isklju\u010divo DoH; 4 \u2014 re\u017eim zrcaljenja gdje su DoH i DNS aktivni paralelno. Po defaultu se koristi CloudFlare DNS server, ali ga mo\u017eete promijeniti putem parametra network.trr.uri, primjerice, mo\u017eete postaviti 'https:\/\/dns.google.com\/experimental' ili 'https:\/\/9.9.9.9\/dns-query'.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Izvor: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51439\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0438 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u0438\u0438 \u0432 \u043a\u043e\u043d\u0446\u0435 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0412\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0432\u043d\u0430\u0447\u0430\u043b\u0435 \u0434\u043b\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u043d\u0442\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u0441\u0442\u0435\u043f\u0435\u043d\u043d\u043e \u0434\u043e\u0432\u043e\u0434\u044f \u0434\u043e 100%. \u041f\u043e\u0441\u043b\u0435 \u043e\u0445\u0432\u0430\u0442\u0430 \u0421\u0428\u0410 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f DoH \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Mozilla \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442 \u043a \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e DNS-over-HTTPS \u0432 Firefox | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:20:24+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:20:24+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla prelazi na automatsko uklju\u010divanje DNS-over-HTTPS u Firefoxu | ProHoster","description":"Razvija\u010di Firefoxa najavili su zavr\u0161etak testiranja podr\u0161ke.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442 \u043a \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e DNS-over-HTTPS \u0432 Firefox | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:24+00:00","article:modified_time":"2019-10-31T19:20:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:39:22","updated":"2026-01-23 19:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/37892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=37892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/37892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=37892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=37892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=37892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}