The GP isn't arguing against TLS; he is arguing against random apps ignoring network-wide settings. When such app breaks, he cannot diagnose the problem, he has to diagnose first that the problem is caused by an app that ignores a setting it shouldn't ignore.

> A corp network should set up their own DoH resolver anyway

What good is that is the browser uses their own list? Literally that's what the article is saying. Firefox will force users to use ones that break the top-down approach on how software works. If I set a DHCP option for DoH, and setup my own DoH resolver, Firefox wont care, they will jsut use their list.

This also opens up possibilities for selling positions on the trusted list, because we've seen that happen before (adblock, or the firefox Mr Robot extension.)

Firefox itself, with plays like this are trying to make a decision about the whole, when they are completely forgetting the corporate side.

I am no sysadmin but working closely with some. I have never seen any case where HTTPS-MITM helps. Yes, theoretically it does allow us to scan for malicious content in a secured connection. Brilliant, but that are not the attack vectors they are concerned about.

So what is left is that breaking up TLS just infringes on privacy and allows for tighter control. The security aspect is laughable.

Users are angry that their internet got slower, an it creates an enormous administrative cost, because you need countless exceptions to the rules.

Most developers break out of it in a few days...

Great deflection, but what should network operators do then? And specifically, network security specialists?