5 ms·

I never heard of NextDNS. I am appalled. From their site: https://nextdns.io https://nextdns.io > See what's happening on your devices with in-depth Analytic

by cremp 7y ago

I never heard of NextDNS. I am appalled. From their site: https://nextdns.io https://nextdns.io > See what's happening on your devices with in-depth Analytics and real-time Logs. > Protect your kids and control what they can access online. Their pricing page is also extremely troubling. > We may adjust this later on based on actual costs at scale, but it will follow this logic. What the hell is this Mozilla... This is not a company you should be dealing with. They tell you up front that they log and monitor... They also aren't at scale, and have to learn lessons the hard way with outages. Mozilla is dead to me now. Edit: As others have pointed out, Mozilla's own policies: https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy Transparency Requirements, section 2. Where on earth is a transparency report for NextDNS? They were started in March, and I would think that Mozilla would check their requirements before giving the 'lets add them.'

sp332 7y ago
If not specifically requested by the user, no data is logged. Some features require some sort of data retention. In that case, our users are given the option, control, and full access on what is logged and for how long.
core-questions 7y ago
> Protect your kids and control what they can access online. Yes, god forbid some parents would like to have a little bit of control and the ability to protect their children from seeing obscene material when they're too young to handle it. Evil! Mozilla needs to quash these terrible people! May they burn with Brendan Eich!
- saagarjha 7y ago
  "Protecting your kids" is often "we log everything and have complete visibility over how people are using our service, and we're willing to share a bit of that with parents to spy on their children". It's a valid concern to have unless there's evidence to the contrary.
  - core-questions 7y ago
    I assume every single DNS provider is logging and, if possible, selling my data. Why wouldn't I? This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. Still, if your goal is to block your kids' access to things, DNS is a good place to do it. Works across all your devices and doesn't require any install.
    - newscracker 7y ago
      I’d be interested to get to any links/descriptions on how you run your own DNS server and the monetary and time costs of it.
      - core-questions 7y ago
        You should look into setting up a Pi-Hole. https://pi-hole.net/ https://pi-hole.net/ Good jumping off point for this.
        newscracker 7y ago
        Thanks. I have heard of pi-hole and know what it does (though I haven’t setup one myself). I’ll take a shot at it. I was wondering what stack the GP was using, where it was hosted and what the costs were.
    - icebraining 7y ago
      > This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. How do you prevent the ISP from logging those requests to the root?
      - LinuxBender 7y ago
        I can't speak for them, but I do the same thing and use a VPN to resolvers on numerous VPS providers. Those talk upstream to the root servers. Between the min-ttl cache at each layer and the large number of resolvers, correlation of my DNS requests is non trivial. I also ensure that client subnet EDNS is blocked.
- cremp 7y ago
  I'm not saying that the product doesn't have it's use, but it is not how DoH should work. I'm trying to bolster the point that they are promoting logs and more importantly, blocking DNS queries. How can I trust the DoH endpoint if I know they have an active product whose purpose is to log and not give back the requested IP.
thayne 7y ago
the monitoring and blocking features are not enabled by default. The pricing model is certainly troubling though.
- afiori 7y ago
  > Completely free during the beta, then free up until about 300,000 DNS queries/month — $1.99/month for unlimited queries. > We may adjust this later on based on actual costs at scale, but it will follow this logic. >We will accept credit, debit and prepaid cards, PayPal, cryptocurrencies and other popular payment platforms. In what sense is it troubling? I have never looked at a DNS pricing page before today, but this looks reasonable...
  - chaz6 7y ago
    Firefox will need a new error page ERR_DNS_NEEDS_PAYMENT
    - afiori 7y ago
      Do you think that it could be possible to fix their monetization strategy? Also I suspect that in that case NextDNS would just send you to their own page a la WIFI login page.
bad_user 7y ago
Wow, you're pretty easily upset. Was Mozilla alive for you before this? Their privacy policy is pretty straightforward: https://nextdns.io/privacy https://nextdns.io/privacy Not saying this is going to be good, but at least I'm going to withhold judgement until I've got more data. > They also aren't at scale, and have to learn lessons the hard way with outages. Is that a reason you're upset about? Is that a certainty? I don't get it.

by cremp 7y ago

sp332 7y ago

If not specifically requested by the user, no data is logged. Some features require some sort of data retention. In that case, our users are given the option, control, and full access on what is logged and for how long.

core-questions 7y ago

> Protect your kids and control what they can access online. Yes, god forbid some parents would like to have a little bit of control and the ability to protect their children from seeing obscene material when they're too young to handle it. Evil! Mozilla needs to quash these terrible people! May they burn with Brendan Eich!

saagarjha 7y ago
"Protecting your kids" is often "we log everything and have complete visibility over how people are using our service, and we're willing to share a bit of that with parents to spy on their children". It's a valid concern to have unless there's evidence to the contrary.
- core-questions 7y ago
  I assume every single DNS provider is logging and, if possible, selling my data. Why wouldn't I? This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. Still, if your goal is to block your kids' access to things, DNS is a good place to do it. Works across all your devices and doesn't require any install.
  - newscracker 7y ago
    I’d be interested to get to any links/descriptions on how you run your own DNS server and the monetary and time costs of it.
    - core-questions 7y ago
      You should look into setting up a Pi-Hole. https://pi-hole.net/ https://pi-hole.net/ Good jumping off point for this.
      - newscracker 7y ago
        Thanks. I have heard of pi-hole and know what it does (though I haven’t setup one myself). I’ll take a shot at it. I was wondering what stack the GP was using, where it was hosted and what the costs were.
  - icebraining 7y ago
    > This is actually why I use my own DNS server and resolve against the root, like anyone else who cares about privacy ought to be doing. How do you prevent the ISP from logging those requests to the root?
    - LinuxBender 7y ago
      I can't speak for them, but I do the same thing and use a VPN to resolvers on numerous VPS providers. Those talk upstream to the root servers. Between the min-ttl cache at each layer and the large number of resolvers, correlation of my DNS requests is non trivial. I also ensure that client subnet EDNS is blocked.
cremp 7y ago
I'm not saying that the product doesn't have it's use, but it is not how DoH should work. I'm trying to bolster the point that they are promoting logs and more importantly, blocking DNS queries. How can I trust the DoH endpoint if I know they have an active product whose purpose is to log and not give back the requested IP.

thayne 7y ago

the monitoring and blocking features are not enabled by default. The pricing model is certainly troubling though.

afiori 7y ago
> Completely free during the beta, then free up until about 300,000 DNS queries/month — $1.99/month for unlimited queries. > We may adjust this later on based on actual costs at scale, but it will follow this logic. >We will accept credit, debit and prepaid cards, PayPal, cryptocurrencies and other popular payment platforms. In what sense is it troubling? I have never looked at a DNS pricing page before today, but this looks reasonable...
- chaz6 7y ago
  Firefox will need a new error page ERR_DNS_NEEDS_PAYMENT
  - afiori 7y ago
    Do you think that it could be possible to fix their monetization strategy? Also I suspect that in that case NextDNS would just send you to their own page a la WIFI login page.

bad_user 7y ago

Wow, you're pretty easily upset. Was Mozilla alive for you before this? Their privacy policy is pretty straightforward: https://nextdns.io/privacy https://nextdns.io/privacy Not saying this is going to be good, but at least I'm going to withhold judgement until I've got more data. > They also aren't at scale, and have to learn lessons the hard way with outages. Is that a reason you're upset about? Is that a certainty? I don't get it.