Mikaela
/
shell-things
mirror of https://gitea.blesmrt.net/mikaela/shell-things.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

opt/chromium/policies/managed: update documentation about working preferred over ECH enforced

This commit is contained in:
Aminda Suomalainen 2024-04-25 11:00:40 +03:00
parent 32883d5c73
commit 45cf5ecf61
Signed by: Mikaela
SSH Key Fingerprint: SHA256:CXLULpqNBdUKB6E6fLA1b/4SzG0HvKD19PbIePU175Q
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
etc/opt/chromium/policies/managed/README.md
View File

@ -259,9 +259,11 @@ Sets Cloudflare with malware protection as the forced DNS-over-HTTPS server.
If no DNS over HTTPS policy is used, this unlocks the setting. Enabling managed policies disable it by default. If no DNS over HTTPS policy is used, this unlocks the setting. Enabling managed policies disable it by default.
Incompatible with other `doh-*.json` file, because they set `"DnsOverHttpsMode": "secure",`. My other `doh-*.json` set this as well, because `secure` doesn't allow
downgrade to system resolver and Chromium seems somewhat unreliable with it often reporting
**_This also causes there to not be ECH._** `DNS_PROBE_POSSIBLE` and while this occassionally disables ECH, it works and
my system resolvers are encrypted. I hope they will implement ECH with system
resolver soon to fix this.
## `doh-dns0.json` ## `doh-dns0.json`
@ -297,7 +299,10 @@ their alternative port.
Enables encrypted client hello (ECH) and Online Certificate Status Protocol (OCSP) (or Certificate Revocation List (CRL)?) checks. Enables encrypted client hello (ECH) and Online Certificate Status Protocol (OCSP) (or Certificate Revocation List (CRL)?) checks.
However ECH seems to require `"DnsOverHttpsMode": "secure"` from the `doh-*` files and OCSP seems to bypass that going to the system resolver. However ECH requires `"DnsOverHttpsMode": "secure"` which will break things
(and thus my files don't enable it),
or it will occassionally get disabled (I hope they implement it with system
resolver soon).
## `enable-labs.json` ## `enable-labs.json`