{"id":37892,"date":"2019-10-31T22:20:24","date_gmt":"2019-10-31T19:20:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox\/"},"modified":"2019-10-31T22:20:24","modified_gmt":"2019-10-31T19:20:24","slug":"mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","title":{"rendered":"Mozilla prech\u00e1dza k predvolenej aktiv\u00e1cii DNS-over-HTTPS vo Firefox","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1ri Firefox ozn\u00e1mili<\/a><\/noindex> o ukon\u010den\u00ed testovania podpory DNS over HTTPS (DoH, DNS over HTTPS) a z\u00e1mere na konci septembra t\u00fato technol\u00f3giu predvolene aktivova\u0165 pre pou\u017e\u00edvate\u013eov v USA. Aktiv\u00e1cia bude prebieha\u0165 postupne, najprv pre nieko\u013eko percent pou\u017e\u00edvate\u013eov, a pokia\u013e sa nevyskytn\u00fa probl\u00e9my, postupne sa zv\u00fd\u0161i na 100%. Po pokryt\u00ed USA sa zv\u00e1\u017ei mo\u017enos\u0165 aktiv\u00e1cie DoH aj v in\u00fdch krajin\u00e1ch.<\/p>\n

Testy vykon\u00e1van\u00e9 po\u010das roka uk\u00e1zali spo\u013eahlivos\u0165 a dobr\u00fd v\u00fdkon slu\u017eby, a tie\u017e umo\u017enili identifikova\u0165 niektor\u00e9 situ\u00e1cie, ke\u010f DoH m\u00f4\u017ee sp\u00f4sobi\u0165 probl\u00e9my a vyvin\u00fa\u0165 rie\u0161enia na ich ob\u00eddenie (napr\u00edklad boli preveren\u00e9 m\u00e1 probl\u00e9my<\/a><\/noindex> optimaliz\u00e1ciu prev\u00e1dzky v sie\u0165ach dod\u00e1vky obsahu, rodi\u010dovsk\u00fa kontrolu a firemn\u00e9 intern\u00e9 DNS z\u00f3ny). <\/p>\n

D\u00f4le\u017eitos\u0165 \u0161ifrovania DNS prev\u00e1dzky je hodnoten\u00e1 ako z\u00e1sadn\u00fd faktor ochrany pou\u017e\u00edvate\u013eov, preto sa DoH rozhodlo zapn\u00fa\u0165 predvolene, av\u0161ak v po\u010diato\u010dnej f\u00e1ze iba pre pou\u017e\u00edvate\u013eov v USA. Po aktiv\u00e1cii DoH sa pou\u017e\u00edvate\u013eovi zobraz\u00ed upozornenie, ktor\u00e9 mu umo\u017en\u00ed v pr\u00edpade z\u00e1ujmu sa vzda\u0165 pr\u00edstupu k centralizovan\u00fdm DoH DNS serverom a vr\u00e1ti\u0165 sa k tradi\u010dn\u00e9mu zasielaniu neza\u0161ifrovan\u00fdch dopytov na DNS server poskytovate\u013ea (na rozdiel od distribuovanej infra\u0161trukt\u00fary DNS resolverov, v DoH je pou\u017eit\u00e1 v\u00e4zba na konkr\u00e9tny DoH servis, ktor\u00fd m\u00f4\u017ee by\u0165 pova\u017eovan\u00fd za jedin\u00fd bod zlyhania).<\/p>\n

Po aktiv\u00e1cii DoH m\u00f4\u017ee d\u00f4js\u0165 k naru\u0161eniu funk\u010dnosti syst\u00e9mov rodi\u010dovskej kontroly a firemn\u00fdch siet\u00ed, ktor\u00e9 pou\u017e\u00edvaj\u00fa \u0161trukt\u00faru n\u00e1zvov DNS dostupn\u00fa len pre intern\u00fa sie\u0165 na konverziu intranetov\u00fdch adries a firemn\u00fdch hostite\u013eov. Na rie\u0161enie probl\u00e9mov s tak\u00fdmito syst\u00e9mami bola pridan\u00e1 syst\u00e9m kontrol, ktor\u00fd automaticky vyp\u00edna DoH. Kontroly sa vykon\u00e1vaj\u00fa pri ka\u017edom spusten\u00ed prehliada\u010da alebo pri identifik\u00e1cii zmeny podsiete.<\/p>\n

Automatick\u00e9 prepnutie na pou\u017eitie \u0161tandardn\u00e9ho rezolvera opera\u010dn\u00e9ho syst\u00e9mu je tie\u017e zabezpe\u010den\u00e9 pri vzniku probl\u00e9mov pri rezolvovan\u00ed cez DoH (napr\u00edklad pri poru\u0161en\u00ed sie\u0165ovej dostupnosti s poskytovate\u013eom DoH alebo pri zlyhan\u00ed jeho infra\u0161trukt\u00fary). Zmysel tak\u00fdchto kontrol je pochybn\u00fd, preto\u017ee nikto nebr\u00e1ni \u00fato\u010dn\u00edkom, ktor\u00ed kontroluj\u00fa prev\u00e1dzku rezolvera alebo s\u00fa schopn\u00ed zasiahnu\u0165 do prev\u00e1dzky, simulova\u0165 tak\u00e9to spr\u00e1vanie na odpojenie \u0161ifrovania DNS prev\u00e1dzky. Probl\u00e9m sa rie\u0161i pridan\u00edm vo\u013eby \u201eDoH v\u017edy\u201c do nastaven\u00ed (predvolene nie je akt\u00edvne), pri nastavovan\u00ed ktorej sa automatick\u00e9 odpojenie neuplat\u0148uje, \u010do je rozumn\u00fd kompromis.<\/p>\n

Na ur\u010denie firemn\u00fdch resolverov sa vykon\u00e1vaj\u00fa kontroly netypick\u00fdch dom\u00e9n najvy\u0161\u0161ej \u00farovne (TLD) a vracanie intranetov\u00fdch adries syst\u00e9mov\u00fdm resolverom. Na ur\u010denie aktiv\u00e1cie rodi\u010dovskej kontroly sa vykon\u00e1va pokus o rezolvovanie mena exampleadultsite.com a ak v\u00fdsledok nezodpoved\u00e1 skuto\u010dnej IP, pova\u017euje sa, \u017ee na \u00farovni DNS je akt\u00edvny blok na dospel\u00fd obsah. Ako znaky sa tie\u017e kontroluj\u00fa IP adresy Google a YouTube na pr\u00edtomnos\u0165 ich nahradenia na restrict.youtube.com, forcesafesearch.google.com a restrictmoderate.youtube.com. Navy\u0161e Mozilla pon\u00faka<\/a><\/noindex> implementova\u0165 jednotn\u00fd overovac\u00ed hostite\u013e use-application-dns.net<\/a><\/noindex>, ktor\u00fd m\u00f4\u017eu pou\u017e\u00edva\u0165 internetov\u00ed poskytovatelia a slu\u017eby rodi\u010dovskej kontroly ako zna\u010dku na vypnutie DoH (ak sa hostite\u013e nedefinuje, Firefox DoH vypne).<\/p>\n

Pr\u00e1ca prostredn\u00edctvom jednotn\u00e9ho DoH servisu m\u00f4\u017ee potenci\u00e1lne sp\u00f4sobi\u0165 probl\u00e9my s optimaliz\u00e1ciou prev\u00e1dzky v sie\u0165ach doru\u010dovania obsahu, ktor\u00e9 vykon\u00e1vaj\u00fa vyv\u00e1\u017eenie prev\u00e1dzky pomocou DNS (DNS server CDN siete generuje odpove\u010f, ber\u00fac do \u00favahy adresu rezolv\u00e9ra a poskytuje najbli\u017e\u0161\u00ed hostite\u013e na z\u00edskanie obsahu). Odoslanie DNS po\u017eiadavky z najbli\u017e\u0161ieho rezolv\u00e9ra k pou\u017e\u00edvate\u013eovi v tak\u00fdch CDN vedie k vr\u00e1teniu adresy najbli\u017e\u0161ieho hostite\u013ea k pou\u017e\u00edvate\u013eovi, ale pri odosielan\u00ed DNS po\u017eiadavky z centralizovan\u00e9ho rezolv\u00e9ra bude vydan\u00e1 adresa hostite\u013ea, najbli\u017e\u0161ieho k serveru DNS-over-HTTPS. Testovanie v praxi uk\u00e1zalo, \u017ee pou\u017eitie DNS-over-HTTP pri pou\u017e\u00edvan\u00ed CDN prakticky nesp\u00f4sobilo oneskorenia pred za\u010diatkom prenosu obsahu (pre r\u00fdchle pripojenia oneskorenia neprekro\u010dili 10 milisek\u00fand a na pomal\u0161\u00edch pripojeniach sa dokonca sledovalo zr\u00fdchlenie). Pre prenos inform\u00e1ci\u00ed o lokaliz\u00e1cii klienta do rezolv\u00e9ra CDN sa tie\u017e zva\u017eovalo vyu\u017eitie roz\u0161\u00edrenia EDNS Client Subnet.<\/p>\n

Pripom\u00edname, \u017ee DoH m\u00f4\u017ee by\u0165 u\u017eito\u010dn\u00fd na vyl\u00fa\u010denie \u00fanikov inform\u00e1ci\u00ed o po\u017eadovan\u00fdch n\u00e1zvoch hostite\u013eov prostredn\u00edctvom DNS serverov poskytovate\u013eov, boj s MITM \u00fatokmi a manipul\u00e1ciou DNS prev\u00e1dzky, prekon\u00e1vanie blok\u00e1ci\u00ed na \u00farovni DNS alebo na organiz\u00e1ciu pr\u00e1ce v pr\u00edpade nemo\u017enosti priameho kontaktu s DNS servermi (napr\u00edklad pri pr\u00e1ci cez proxy). Ak v be\u017enej situ\u00e1cii s\u00fa DNS po\u017eiadavky priamo odosielan\u00e9 na konkr\u00e9tne DNS servery definovan\u00e9 v konfigur\u00e1cii syst\u00e9mu, v pr\u00edpade DoH je po\u017eiadavka na ur\u010denie IP adresy hostite\u013ea enkapsulovan\u00e1 v HTTPS prev\u00e1dzke a odosielan\u00e1 na HTTP server, na ktorom rezolver spracov\u00e1va po\u017eiadavky cez Web API. Existuj\u00faci \u0161tandard DNSSEC pou\u017e\u00edva \u0161ifrovanie len na autentifik\u00e1ciu klienta a servera, ale nechr\u00e1nia prev\u00e1dzku pred zachyten\u00edm a nezaru\u010duj\u00fa d\u00f4vernos\u0165 po\u017eiadaviek. <\/p>\n

Na aktiv\u00e1ciu DoH je potrebn\u00e9 zmeni\u0165 hodnotu premennej network.trr.mode v about:config, ktor\u00e1 je podporovan\u00e1 od Firefoxu 60. Hodnota 0 \u00faplne vyp\u00edna DoH; 1 \u2014 pou\u017e\u00edva DNS alebo DoH, v z\u00e1vislosti od toho, \u010do je r\u00fdchlej\u0161ie; 2 \u2014 pou\u017e\u00edva DoH ako predvolen\u00e9, a DNS ako z\u00e1lo\u017en\u00fd variant; 3 \u2014 pou\u017e\u00edva iba DoH; 4 \u2014 re\u017eim zrkadlenia, kde s\u00fa DoH a DNS zapojen\u00e9 paralelne. Predvolene sa pou\u017e\u00edva DNS server CloudFlare, ale je mo\u017en\u00e9 ho zmeni\u0165 prostredn\u00edctvom parametra network.trr.uri, napr\u00edklad je mo\u017en\u00e9 nastavi\u0165 \u201ehttps:\/\/dns.google.com\/experimental\u201c alebo \u201ehttps:\/\/9.9.9.9\/dns-query\u201c.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0438 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u0438\u0438 \u0432 \u043a\u043e\u043d\u0446\u0435 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0412\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0432\u043d\u0430\u0447\u0430\u043b\u0435 \u0434\u043b\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u043d\u0442\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u0441\u0442\u0435\u043f\u0435\u043d\u043d\u043e \u0434\u043e\u0432\u043e\u0434\u044f \u0434\u043e 100%. \u041f\u043e\u0441\u043b\u0435 \u043e\u0445\u0432\u0430\u0442\u0430 \u0421\u0428\u0410 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f DoH \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla prech\u00e1dza k predvolen\u00e9mu zapnutiu DNS-over-HTTPS vo Firefox | ProHoster","description":"V\u00fdvoj\u00e1ri Firefoxu ozn\u00e1mili ukon\u010denie testovania podpory.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442 \u043a \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e DNS-over-HTTPS \u0432 Firefox | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:24+00:00","article:modified_time":"2019-10-31T19:20:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:39:22","updated":"2026-01-23 19:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/37892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=37892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/37892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=37892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=37892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=37892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}