Hacker News Reader

Comment by betaby | Hacker News Reader

Mozilla is literally switching Canadian users to use government's (CIRA) DNS by default. Seriously, how that's a good thing?

View on HN

It's not quite that clear cut. CIRA is strictly speaking a public, not-for-profit company, but the DNS servers were built and maintained by CSE (our NSA) for the malicious domain filtering/reporting aspect, the Centre for Cybersecurity (another public service arm mandated with building out our domestic cybersecurity infrastructure), and Shared Services, the federal government's infrastructure backbone.

I know many people will stop reading at CSE and draw their own conclusions, but like with every issue there's nuance here. CSE arguably draws some of the foremost information security experts in the country, and their mandate does also include protecting the digital security of Canadians. I'm going to be cautiously optimistic and start looking for transparency resources around Canadian Shield.

Misleading. "CIRA is providing the threat blocking technology while the CSE's Canadian Centre for Cyber Security is offering its threat intelligence services — basically a who's-who list of every bad actor roaming the web."

CIRA has 3 levels much like opendns, private, protected and family. My router has already been using private for awhile mainly because it was the fastest dns.

The server for where I am located is hosted at a local ISP. If they were truly nefarious vacuuming up every dns request and providing a printout of my activity to the prime minister every morning they'd just host the server on their own network.

If CSE built it themselves as alleged, they did a good job in terms of its performance and I trust the Canadian government more than I trust an ad company.

Good for your. Canadian government did a great job with the recent CRTC decisions, right?

Don't try to muddy the waters by conflating the regulatory board's pricing decision with nefarious spooks searching for Newfoundland independence videos in my history.

CRTC explicitly asked to evaluate CIRA DNS as a potential way to block content for Canadians https://crtc.gc.ca/eng/archive/2021/2021-9.htm

"15. While network-level blocking can be implemented without accessing the content of Internet transmissions, the Commission nevertheless considers that any regulatory framework for blocking or filtering traffic must include safeguards to ensure user interests are protected. Any framework the Commission approves will need to include, at a minimum, provisions that (i) ensure Internet subscriber privacy, (ii) enable subscribers to opt into or out of blocking, (iii) provide a false-positive correction mechanism, (iv) ensure blocking decisions are unbiased and made in the best interest of Canadians, and (v) minimize subscriber information monitoring, collection, and usage."

In case of emergency, break glass and use VPN.

> I trust the Canadian government more than I trust an ad company.

Me too. However, since it's sort of the government running it, I wonder if they could ever implement ad blocking without getting sued by the ad companies.

Good callout, thanks for the correction.

Every member of the Mozilla TRR program has to abide by the TRR resolver policies, undergo regular audits to ensure compliance, publicly commit to these policies in their own privacy policy, and publish annual transparency reports. CIRA meets these requirements, which provide assurance that they are treating user data with respect. See https://wiki.mozilla.org/Security/DOH-resolver-policy for more information.

First of all, CIRA is not the government, it is an elected public company.

Second of all, it is not switching to use CIRA's DNS, it is added CIRA DNS to their revolver so .ca domains get fed through Mozilla's DNS over HTTP, rather then going Mozilla DNS <-> CIRA.

No? What does it even mean 'added CIRA DNS to their revolver so .ca domains get fed through Mozilla's DNS over HTTP'. Please explain in technical terms.

CIRA is a root domain company (like Verisign for .com), it has root records because it owns the root nameservers for all .ca domains. All they are doing is adding those to Mozilla's existing supply (Cloudflare provides other DNS records). So rather then going Mozilla -> Cloudflare -> CIRA and back, it now just goes Mozilla -> CIRA. I don't have time to explain how DNS works. Look up Mozilla’s Trusted Recursive Resolver and how it works.

No. Mozilla changes is about recursor, not '.ca' domain.

CIRA isn't government owned or backed, it's a member-directed not-for-profit organization. The government doesn't have anything beyond a non-voting board seat.

Reply on news.ycombinator.com