Ask HN: Firefox connection problems after enabling DoH?
The latest version of Firefox (96.0 and 95.02) seems to have a problem where as soon as you enable DOH (DNS over HTTPS) the browser is unable to establish any connections. Disabling this feature once enabled doesn't resolve the issue, closing the browser leaves processes hanging in the background consuming resources. Several of my friends have reported (Windows/Linux) seeing the same issue but we haven't been able to find a solution.
409 comments
[ 3.2 ms ] story [ 291 ms ] threadTwitter[1] is currently lighting up with broken FF reports across the globe.
Some people are reporting that if you hold down Shift while opening it works (though any FF personalisation is wiped). That didn't work for me on Mac.
[1]: https://twitter.com/search?f=live&q=firefox%20until%3A2022-0...
I have the same issue, a different profile worked
edit: Twitter feed https://twitter.com/search?q=firefox&src=typed_query&f=live
There better be some hell of a post mortem
edit2: `network.http.http3.enabled` in about:config to false fixed it for me. Source: https://old.reddit.com/r/firefox/comments/s2u7eg/is_firefox_...
Edit: I am on Firefox 91.4.1esr, so clearly it isn't just the latest versions that are affected.
The other thing I noticed was that previously when I looked in taskmgr (windows 10) there were 4 or 5 firefox processes going on -but when I went to close firefox after setting that to false there were not.
I'll close and check again but I'm wondering if simply setting it to false once doesn't allow it to perform some update or something that lets it get back to behaving normally? Like unsticking a log jam?
[edit]Forget I said anything. When I restarted and tried to reload HN it hung again. I had to disable network.http.http3.enabled in order come back and edit this comment.
Another score for automatic updates I guess.
FWIW I've tried every documented setting, "enterprise" policies, etc. to prevent automatic updates in FF, but nothing seems to stick.
That's s private installation, a company-wide centrally managed might work differently ... but companies normally want to control updates too.
The goal is not to ostracize automatic updates, but to have faster fixes.
Or to separate security updates from feature updates, but I think this ship has long sailed for modern browsers.
That would be my preferred solution. But yes, as you say, that ship has sailed. No reason why it couldn't sail back though.
Maintenance cost.
Multiplying the number of parallel maintenance tracks and associated support costs is not “no reason”.
User is the one who must choose update policy. If user is choosing to not update then it's their own problem and no manufacturer has the right to deside otherwise.
https://support.mozilla.org/en-US/kb/switch-to-firefox-exten...
https://bugzilla.mozilla.org/show_bug.cgi?id=1749910
Even if you don't update your browser, the world updates around it
https://bugzilla.mozilla.org/show_bug.cgi?id=1749908#c10
> Telemetry has nothing to do with this, it just happens to be one of the first services with H3 load balancer.
If telemetry really had "nothing to do with" the bug, then the fact that telemetry "just happens to be one of the first services with H3 load balancer" wouldn't trigger the bug.
The question isn't whether "backend services" forms the conceptual essence of the problem - I think we all agree it doesn't.
The question is whether it "happens to be" triggered by backend services.
Edit: reading further comments it occurred to me that maybe I'm not affected because I'm not sending any data to Mozilla so I don't hit their HTTP3 load balancer.
Go interview people Mozilla. Less analytical data but you'll end up knowing your users.
I would like to see any source that may exist on it having been silently re-enabled. I know telemetry is anonymized and totally harmless or whatever, but re-enabling it behind my back would feel like such a breach of trust.
Thanks anyone in this thread who helped!
Very frustrating this. Fortunately it isn't a Tuesday or I would have been ready for murder by now.
As I instinctively was already blaming out IT dept for breaking Firefox for some security theater reason I was glad I found the real issue quickly, otherwise I might just have accidentally dropped my laptop out the window
Thank you.
EDIT: my FF version is 91.5.0esr (64-bit) on MacOS.
Many of my colleagues had the same issue today, and they all report that just restarting FF fixes the problem (one restarted the computer itself).
Can't access any website or making any connection without disable `network.http.http3.enabled` and restart.
This impact is huge for million of firefox users!
However I do recall Mozilla having another backdoor channel which they used sometime ago to push an emergency update. I hope that works.
Edit: the issue came back after reinstall! I had to disable http3 in about:config to resolve this issue.
Feels like Firefox waits some amount of time before making fresh attempts to a previously failed site, possibly due to some caching.
Or you simply didn't know that Firefox made it the default a while ago. I had it intentionally disabled on one machine but forgot that it's enabled on others, which made troubleshooting even more "interesting"... Why do things work on one machine but not the other?
Oh, interesting! I did not know it is a default now. I can imagine why they would enable it by default, but when Cloudflare (which I assume is the default DoH provider) has a problem at some point everyone is doomed.
Really wish they also could make it so the data collection part is opt-in instead of opt-out (which at this point in time appears to be the actual cause of this problem).
I mean, most of all lkve autocomplete, but when you type in <nameofprobationofficewebsite>.<tld> or what have you, are you sure you want everyone of these keystrokes to go to Google?
If not then you want a separate search field.
We have the same feelings on this - I also would prefer an explicitly separate search bar and address bar.
Edit: or maybe I'm understanding Ekaros' comment incorrectly? Either way the thing I'm talking about is that there's a combined search/address bar always visible in FF, and when you open a fresh window or tab there's a landing page which has an additional combined search/address bar.
I wondered why anyone still saw the search bar without explicitly enabling it.
I can just write the address in address bar if I want. But I do not have search engine as default page or even have one in as bookmark. So I would love to just have a search box where I can copy paste a filename with either full path or as something.py... And browser to not try to access non existent .py domain which only has third-level addresses anyway...
(For everyone wondering why we crazy people stick with Firefox: there are actually a number of technical/ux reasons in addition to not wanting to give control of the web away to a single company.)
Windows 11 almost but not entirely broke HDR. It kinda-sorta works for some things, sometimes, but most apps that used to work with HDR back in Windows 10 just can't any more and are forced to use SDR with sRGB gamut only.[1]
The Win UI SDK regressed from WPF and lost all wide-gamut or HDR support at the API level (which probably explains the above). As in, Microsoft literally removed a wide swath of floating-point color support along with the wide-gamut scRGB color space. We're back to 8-bit RGB arrays in sRGB only as the only option. Like in the 1990s.
Windows Server 2022 can't activate its license unless it uses the UTC time zone. Why? Because Microsoft employees test using Azure VMs, which... use UTC by default.
Speaking of color: Firefox for a while just... stopped doing color management. Then it worked again after a few weeks when it updated.
But it might not be Firefox's fault, because Windows also seems to randomly turn color management off, or force it back to sRGB silently.
If you have a laptop with one of those hybrid Intel+NVIDIA GPU combinations, then HDR games don't work at all with the built-in display, they all report HDR support as N/A. But they will work with external displays!
Speaking of HTTP/3 in Firefox: I've had it permanently disabled because the early releases would leak about 10 GB of memory per minute and lock up the browser very quickly. But not quickly enough to prevent the automated test suites from passing.
... and so on...
The point I'm trying to get to is that in 2022 we've achieved this state of affairs where human beings don't do actual Quality Assurance any more as a job. It's all automated and those people have been summarily fired.
Any issue that is invisible to a DevOps pipeline is Not A Bug and will ship broken. If it ships in a working state, that's probably just a lucky accident, and a subsequent patch will break it for sure.
All of the issues above are caused by automated test suites one way or another. Automated tests are literally blind to output color rendering; testing that requires a physical monitor. Automated tests are almost never set up for long-term testing for things like memory leaks, because they have to run fast. Automated tests use default, vanilla settings for the host OS. Automated tests don't have funky hardware combinations. Automated tests don't measure "jank", or inconsistent performance issues, Etc, etc...
What you're experiencing is the end result of all of this. NOBODY is sitting down and validating the end-result from the perspective of a human user sitting in front of an actual device. That final quality assurance is just not there any more, and hence we're all embarrassed when we have to "show off" some piece of IT tech and find that it's just a broken mess.
/rant
[1] This bug has apparently been fixed in some beta, and might ship around the middle of this year. In other words, Microsoft is perfectly content to break display output on their consumer desktop operating system for six months and just leave it at that.
Want it better? Augment competition and try to avoid monopolies.
EDIT: Actionable advice: avoid SW or HW which isn't at least 6 months old.
I'm very lucky to have grown up and gotten most of my work experience in that kind of environment. I was expected to aim for perfection, and punished without fail if I didn't achieve it. No half-measures. Do it right, or don't do it at all.
There are people shipping code right now with 100 million to 1 billion users where they didn't even attempt to get it right. Knowingly, on purpose, they aimed to just barely pass the test. To meet the letter but not the spirit of the requirement. To build something that technically works, but not in practice. Make something that they wouldn't use themselves.
This doesn't matter to them. They make the little test suite indicator turn into a green check mark, then it's time to clock out and go home.
"Job done boss."
And the boss never checked that it was truly done either. He's got no standards himself that the work needs to meet.
The build system reports green, all is well in the world.
"Ship it!"
I don't blame them (the employee).
Earlier it said the other AV solution was turned off (it was not) and I had no valid protection.
Now it doesn't even say an excuse. It just keeps running with no obvious way to turn it off.
Surely it was good UX to remove that "clutter"?
Please stop non-browser development and let me pay a monthly fee for a decent browser!
I don’t want a VPN service, bookmark readers or other crap. I want Mozilla to defend the open web and create an open source browser. That’s it. The past few years have been a big disappointment in Mozilla leadership and (lack off) vision.
If they don't turn this around then I hope others will step up and reclaim the web!
This isn't just a rant, it's also a cry to let people explicitly support browser-only development via donations, subscriptions and show our support.
Looks like HTTP/3 has been in Firefox for around a year
This is a great way to bypass continuity testing, I really pity all those people working the desks in hospitals right now using FireFox who are typically less savvy than your average HN'er in trying to get their work done.
If you ship a browser with a time-bomb you are utterly irresponsible.
That's not how this works. HTTP/3 support is optional as far as I'm concerned and plenty of websites that I tested with do not support it and still failed due to this issue.
Absolutely unacceptable.
But mostly: I have no real idea what's going on, so I'm awaiting the postmortem.
Basically, this could have happened at any point if a production service run by someone like Google, Facebook, Cloudflare etc managed to trigger a sufficiently bad bug in a modern browser's network stack.
If not for the centralized I/O this would just hang a single browser process, which isn't as impactful since Firefox and Chrome both split content out into many processes. It would also make it more obvious which server(s) are responsible since only certain tabs would be dying. FWIW, as far as I know this centralized I/O model was popularized by Google, not Mozilla.
(1) I did not explicitly enable this
(2) The telemetry setting seems to have re-enabled itself on some update
(3) I don't want any services from Mozilla, I want a browser
(4) It worked until it blew up revealing that in fact, I suddenly did have service dependencies
And finally, the reason I use FireFox is exactly your last sentence, so to see that they are slipping this in under the radar is a pretty good reason to drop FF altogether, it looks as if they fail to understand the difference between shipping software and getting me hooked on some service that I am not even aware of existing. And on top of that re-enabling their telemetry when it was explicitly disabled. That really takes the cake.
Switching to a browser without telemetry and automatic updates won't protect you from this kind of network stack bug.
You argue that it wasn't an automatic update: I am pretty sure that the first install on this machine did not have HTTP3 support and that automatic updates pulled it in, end of story right there.
As for the telemetry issue: that's even worse because telemetry and all other forms of communication with the mothership other than automatic updates have been disabled on this machine, and has been silently re-enabled without my consent. That's a pretty gross violation of trust, and if that in turn causes me to lose a morning then that makes it even worse. Fortunately, today is not an interview day, but if this had happened two days ago the consequences would be terrible.
Finally, automatic updates would ideally just fix security issues and not introduce new, possibly unwanted functionality. I carefully select my tools for their purpose and I absolutely hate this brave new world where critical stuff suddenly stops working because some company could not be bothered to take their end users' interests a bit more serious.
Google and Cloudflare were not implicated here, it was FireFox that stopped working, Chrome still functioned just fine.
https://bugzilla.mozilla.org/show_bug.cgi?id=1749908#c21
Someone really fucked up. There must be millions of non techies completely lost right now.
What's going on at Mozilla is probably what's going to happen for Linux once Linus is out.
Both these pieces of open source software are way too big to be replicated now by a dude or a bunch of dudes and also way too big to be maintained by people on their free time. They require resources and organization which itself corrupt the original spirit.
Or maybe that whole firefox debacle made me a little gloomy today...
Remember the early days of Firefox? It crashed often, it was slow, but we had great expectations ad supported it. It wasn't easy to use it at all. At some point it made a breakthrough and installing Firefox was the first thing to do on a fresh install of any machine. People don't remember or know these times and take the web browser for granted. But now that Google has long left their original "Don't be evil" mantra and all tech is focused around the web, having an open, neutral browser is more important than ever. I wish people - including the ones at Mozilla - appreciated this fact more.
As long as the most Mozilla's money comes from Google (86% of revenue! [1]) income is a problem. Why is Mozilla and Firefox portrayed as the last bastion of free web technology if they depend on wealth of their biggest and evil-est competitor?
[1]: https://techcrunch.com/2021/12/13/mozilla-expects-to-generat...
> Both these pieces of open source software are way too big to be replicated now by a dude or a bunch of dudes and also way too big to be maintained by people on their free time. They require resources and organization which itself corrupt the original spirit.
I doubt that one. There are a lot of big companies who employ the core developers as well as the Linux Foundation which employs Greg K-H [1]. Unlike Firefox where there isn't much corporate interest behind it, there is an absurd amount of corporate interest behind Linux so in the worst case the Kernel will become a corporate committee joint effort, but definitely it won't go down the hell that Firefox currently is.
[1]: https://thenewstack.io/contributes-linux-kernel/
Software projects do seem to benefit from having firm voices empowered to say "no". Committees are incapable of doing that. Sooner or later they end up stuffed with friendly people who compromise their way to yes. That isn't an unacceptable outcome, but it'll be a different and probably worse project when that happens.
I suppose there are counterexamples - like Debian. But they have some very interesting social traditions and they don't let just anyone in to the club.
The culture around kernel development is strong, at the risk of scaring away newcomers. But a tight knit community also means it probably wouldn't change much even without Linus.
Commitees will be formed, instead of linux for the people, there will be corporate committees, then of course the diversity and quota ones, and in the end, "the one that pleases the sponsors"... The end results? Instead of Linus showing the middle finger to Nvidia (again), they will issue a statement, that "without contributers nvidia, we're unable to... yada yada", and binary blobs (or worse) will become part of the kernel.
Since we are sharing our impressions, mine is that the Mozilla Foundation's current CEO doesn't believe in Firefox. Instead, I think, they are leveraging Firefox' popularity to try and position the Mozilla Foundation as a defender of internet freedom, at which point they won't need Firefox anymore.
What happens to Firefox once they achieve that? No idea. The cynic in me believes they will keep doing whatever Chrome is doing until the project is virtually dead, but I honestly hope I'm wrong.
Given the fact that nobody catched Servo after they threw it, the same fate will probably happen with Quantum.
... from whom they get the money. Its primarily Google who keeps Firefox alive to prevent lawsuits against their market dominance due to missing alternatives.
A clear indication that they are in that area a de-facto a monopoly.
I don't know why people use DOH anyway. It bypasses your hosts file, so you can't block things as easily.
Why?
It doesn't bypass my hosts file... I have a couple of locally hosted websites that I have rules in /etc/hosts for, and Firefox resolves them correctly even with DOH enabled.
Pretty sure they meant Pocket when referring to a “bookmark reader”.
Because it was profitable perhaps? Why not acquire a relevant profitable business (many already like) just for sake of profits? And pre-installing it by default seems the next obvious step to make it even more profitable.
> Might as well acquire a webmail, a feed aggregator and a video host while they were at it.
It's way harder to make these profitable without too much investment and without using severe user-annoying techniques.
Nevertheless it's already been suggested here a number of times that Mozilla should perhaps also re-invent e-mail.
To make it slightly less visible what websites do you visit.
To bypass DNS-based censoring some ISPs deploy as some governments require them.
https://fpn.firefox.com/
Have you any idea how complex a browser needs to be? I hope this team of plucky, idealistic coders can keep up with all the latest and greatest web developments devised by the thousands of engineers at Google et al.
The web as an open, human-sized system is dead.
I think a decent layout or CSS library would be useful outside of a web browser, too.
Then I would also only focus on the subset of websites that are "documents", not "apps". If I could decide, HTML6 would have two profiles: one ultra restricted (maybe no legacy stuff and no cross site scripting) for "documents", and one where you can do all kinds of crazy stuff like "web USB" for "apps". That's not going to happen because Google and Apple like the "open" web as complex and messy as it is, because it gives them total control as you know. But it doesn't stop a browser vendor from building a browser with two engines - your own engine for the majority of documents and chromium for webapps.
Something for regular people would be many more years of work.
We tried to introduce office 365 company wide for collaboration, but we had a whole plant of 150 employees "mutiny" because they refused to use any of the office web apps because they were too slow.
This slowness is not a fundamental problem, but incidental. The layout calculations of even the most complex websites could be solved by a 10 years old computer instantly. The rendering can be done by a GPU without sweat. Look at how many polygons and shaders games had 10 years ago.
And note I'm not talking about "lightly formatted text files", but 90% of all web sites. News sites, Youtube, Reddit, .... What I'm excluding is Gmail, Office365, anything that uses Vibration, NFC, WebMidi, and other boutiqe features (you could probably add those back as libraries if you need them later). I'd argue that not supporting "apps" is a feature - you'd have to explicity allow them and they'd run in a sandboxed tab.
Apple hates web apps. These are pain in their ass on the way to forcing every app to go through their app store with all the dystopian control it implements.
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1749908
What would be the model to get started? Can we start by funding a fork (similar to iceweasel) with the eventual goal of hard forking once the needed resources are available?
I like you would be more than happy to pay $10/month. I pay $20/month for a bike! (relatively cheap in Denmark where taking my good bike to the shop costs me ~$500 every time I fall off). The problem is that there isn't a box on the internet for my CC.
The 'open web' died when Chrome overtook Firefox and are still paying for more than >85% of all their revenues just to be on life support in return for ruining the 'open web'.
> If they don't turn this around then I hope others will step up and reclaim the web!
The web has been reclaimed by Google from Microsoft - exchanging from one behemoth to another. Firefox is always behind Chrome's features and many web developers still continue to place banners on users to 'Switch to Chrome'. So it is already over before it has started.
> it's also a cry to let people explicitly support browser-only development via donations, subscriptions and show our support.
One more thing, even if one was to support via 'donations', they are not funding Firefox, it is funding something totally irrelevant in Mozilla and Google is once again keeping them on life support.
What a magnificent disaster.
Fortunately, you're just one person voicing your opinion in an unrelated corner of the Internet and you seem to be in the minority otherwise Mozilla would have made the changes you want already. Most other people either find those features useful or are indifferent about them. I, personally have no qualms with Mozilla doing what they do even if I might not use those features.
If you really want change, start contributing and bring it about yourself.
Unless you are a billionaire, you can't afford to. Developing a decent browser takes enormous amounts of money, good luck funding that of voluntary donations or monthly fees if in most technical aspects superior free alternatives exist. Firefox is failing badly on a few hundred millions a year; I'm sure you could do better with a CEO who isn't just a parasitical non-entity, but I doubt better enough to make that idea viable.
> This isn't just a rant, it's also a cry to let people explicitly support browser-only development via donations, subscriptions and show our support.
A pipe dream -- the web is a dead end. If you want something that can live off donation support (as opposed to selling off its users as cattle), you need a new set of protocols. The whole web stack is such a clusterfuck of layers upon layers of crap with one dominant player who can always add more of it when it suits them to slow down competitors (including bugs you need to replicate for compatibility purposes) that there is not the slightest chance of some grassroots alternative emerging.