> That's not a reasonable position. Never before in the history of computing has a regular end-user application actively tried to subvert the operating-system's network defaults. ... Will I need to manually go configure all those tools to do what is the reasonable default, namely following what the OS tells it to do?

For starters, just because the OS provides its own name resolving facilities doesn't mean it's telling applications to use it. It's there to make application development easier, not as a security feature.

> When Firefox fails to resolve a domain, but nslookup resolves it just fine... What should I as an end-user believe?

The end user should believe what the error message says, because we don't design web browsers with the expectation that the user understands how DNS works. And if they do, then I don't see why it's so onerous to ask that they also learn how DoH works, given that having that default is in the best interest of the majority of the product's users.

> Do you really think every application choosing, managing and implementing its own resolver is a scalable way of managing applications and networking? ... So why should browsers get a free pass do things differently?

Yes, I don't really see how that's such a big scalability problem like you're making it out to be. It is obviously necessary that any networked application will manage and implement its own purpose-built network protocol already. That is a significant amount of complexity necessary to any networked application, and name resolution is just a small function in comparison.

Furthermore it actually does make sense for web browsers to have special behaviour here since they are almost never used to connect to LAN resources, just internet resources, which is unlike many other networked applications. They also make up a widely used application platform which has specific security and privacy needs that other networked applications don't have.

> No. But that's not what we're talking about here.

It's what I'm talking about, because I don't see how to make sense of your "Firefox is malware" analogy otherwise. Your ISP picked a default, Mozilla picked a different default.

> What has always been a clear expectation is that if I sign up for an ISP and I use that ISP's default network setup, that I will be using that ISP's DNS. Never in the history of ISPs has there been any other default. ... Unless I explicitly implement something differently, I have no reason to expect anyone besides my ISP (which I do trust, I'm not from the US) is handling my DNS.

I don't think that's a clear expectation to most of the people who are in fact sold internet access without being trained on how DNS works. I also believe that Mozilla very clearly communicated that they were changing this default, through many channels, to Firefox users. So your implication that Mozilla is doing something sneaky here is ridiculous.

I'm sorry that this change broke your PiHole config but you can fix it easily. New software sometimes breaks your old configs. That's life. If you want an ad-blocking solution that isn't so brittle, then try installing uBO on the client rather than abusing DNS for that purpose.