I created a security bug on Mozilla's BugBounty but I thought it would be good to inform HN users. Here is the copied text from the bug:
I use https://github.com/StevenBlack/hosts to add ads, malware, social media, etc to my hosts file in order to stop the pervasive tracking by adtech and social media companies. With the latest Firefox (stable) 74.0 and the default settings of DNS over HTTP thru cloudflare my hosts file is ignored. Even though facebook.com is supposed to route to 0.0.0.0 I am still able to resolve this in Firefox (but not via ping or any other hosts respecting software). This seems like a major issue and people should be aware of the risks of this default setting being enabled.
So basically Firefox now completely ignores your OS settings, and sets up a proxy by default.
