▲ 268 points
back
116 comments
Re: "Cisco has decided to leave france": (https://web.archive.org/web/20250614052849/https://support.o...)
Effective June 28, 2024: Due to a court order in France issued under Article L.333-10 of the French Sport code and a court order in Portugal issued under Article 210-G(3) of the Portuguese Copyright Code, the OpenDNS service is not currently available to users in France and certain French territories and in Portugal. We apologize for the inconvenience.
July 23, 2024: Cisco's OpenDNS service has been reactivated in Portugal and is currently available following a decision by the Lisbon Court of Appeal.
> Other companies, such as Google and Cloudflare, have the technical means to restrict the blockades to France, but not all providers can do so easily. That includes Quad9, which had no other choice than to apply the French blocking request worldwide.
Just quoting the article, can anyone weigh in on the costs/complexity of a public DNS resolver implementing geo-fencing?
Blocking a growing list of entire countries also sounds like an existential threat.
Hoping the HN DNS savvy reading this can help me understand a Quad9 thing I ran into. I was debugging (as in scratching my head) a bank website login problem and ended up doing some DNS checks against their domain, usual stuff, while using Quad9 as my DNS provider.
While testing, I was using Google and Cloudflare as well, and started noticing something - Quad9 does not return all A records listed for a domain, the same way Google/Cloudflare do.
dig -t A google.com @8.8.8.8 +short (6x IPs)
dig -t A google.com @1.1.1.1 +short (6x IPs)
dig -t A google.com @9.9.9.9 +short (1x IP)
I used quad9 as the primary upstream DNS for my home. about 11 days ago I wasn't able to send any query to quad9, kinda blocking. Their status page was green I suspected my ip was blocked. Now I'm on quad1 :(
I see a single IP for all 3
While I'm here: Google uses edns0 client subnet to geo target your client IP.
Try a dig -t txt o-o.myaddr.l.google.com @8.8.8.8 vs the others to see the src IP of the packet sent to Google's DNS server, and any edns0 info that came along with it.
I really wanted to like Quad9, and used it for a while, but there have been constant issues in the northeast with random SERVFAILs for months now. I had to switch back to Cloudflare.
Have you tested it with a static domain with multiple IPs?
Using google is bad way to test this scenario, since they use EDNS and many other DNS load balancing methods to distribute the load.
interestingly, i only get one IP from each command:
$ dig -t A google.com @8.8.8.8 +short
142.250.184.206
$ dig -t A google.com @1.1.1.1 +short
216.58.206.46
$ dig -t A google.com @9.9.9.9 +short
142.250.185.238
Isn't that because Quad9 does (more) filtering than the other two?
This is also why it is important for Switzerland to not sign the deal with the EU next year. The 8k+ page deal would also require Switzerland to pull the line with EU regulation regarding copyright. The freedom we have right now to download would fall away. Doesn't matter if you are left or right, the deal is bad for all of us.
Many ISPs in Germany have stopped fighting this fight as well and sadly have now even started to self-censor their DNS servers.[1]
In Japan the PM's office once considered to block online piracy websites[1] with DNS in 2018. Japanese tech community fought against it[2][3][4] and it wasn't implemented.
The telco authority currently considers to block online casino websites[5] (gambling is illegal in Japan).
[1] https://www.kantei.go.jp/jp/singi/titeki2/tyousakai/kensho_h... [2] https://www.nic.ad.jp/ja/topics/2018/20180625-01.html [3] https://www.wide.ad.jp/News/2018/20180912.html [4] https://www.nic.ad.jp/ja/materials/iw/2018/proceedings/d3/d3... [5] https://www.soumu.go.jp/main_sosiki/kenkyu/online_casino/ind...
More people should run their own recursive resolvers with unbound. There’s no need to rely on centralized DNS anymore.
> have now even started
This has been the case for a very long time. Back when TBP was popular this was already the case.
Does anyone use Mullvad DNS servers?
https://mullvad.net/en/help/dns-over-https-and-dns-over-tls#...
I found them more acceptable.
Didn't know they have publicly available DNS servers. Thanks.
I've also started using/testing the DNS4EU servers: https://www.joindns4.eu/
I do (as a fallback), but they're extremely slow.
Did you know Wikimedia also runs a public DNS service?
They're pretty slow for me, 350ms on average:
I have had nothing but problems with their DNS service. Outages what feels like a daily basis.
But the VPN itself is great!
Going after DNS resolvers seems like the easy win. If a website was breaking the law so egregiously then take it to ICANN to get the domain name seized. I'd wager that's a much harder thing to prove, hence the strong arming of DNS resolvers.
Seizing a domain name via ICANN has to be global, as I understand it, while a website might have only broken some nations laws.
If the UK government wants to ban porn but loves gambling, while the US wants to ban gambling but loves porn, a blocking mechanism that lets them have different blocklists allows both nations to get the censorship their voters have chosen.
ICANN has no mandate, mechanism, or ability to seize domains. The only tool they have is de-accreditation of registrars (which obviously affects ALL domains registered by that registrar) and that tool is only used when there is clear and non-cured breach of the ICANN Registrar Accreditation Agreement.
Kind of wild that we're approaching a decentralized internet not for the virtue of decentralization, but because of insane authoritarian censorship.
> insane authoritarian censorship
Sanity, liberty, and censorship-resistance are virtues.
(before mental wellness people get up in my grill, by "sanity", I mean the preconditions likely to make sanity widespread)
ironically/appropriately[?] a virtue of decentralization would be combatting insane authoritarian censorship
I consider conser resistance the defining virtue of decentralization.
Does Quad9 run a resolver with DNSSEC but without "malware" blocking? So far I've had multiple instances (twice for a torrent tracker, once for gist.github.com) where they blocked a non-malware domain for a short while, which is really annoying to deal with.
Unfortunately no, they run 9.9.9.10, which is without "malware" blocking and without DNSSEC.
Would the root DNS servers ever get modified or censored as a result of court action?
My thoughts were that DNS-level censorship is essentially a dead end because the root servers are sacrosanct, and there will always be secondary DNS servers to query, who then use the root servers.
Sucks for DNS providers in authoritarian countries though.
I suspect the US would push back on this unless they were the ones doing the censoring. So far the US has not opened that door with DNS; it’s important to make sure that the door stays closed, as this would create chaos and major fragmentation.
In the meantime it might be worthwhile to develop alternatives, like some kind of DNS-over-Tor or DNS-over-DHT scheme, along with normalizing Tor onion services as an alternative access method for clearnet sites.
No. While root servers are NOT sacrosanct, if such a court action were to occur and a root server operator were to carry it out, the change would fail DNSSEC validation in resolvers that have DNSSEC enabled (which varies depending on where you are, see https://stats.labs.apnic.net/dnssec), resulting in a SERVFAIL. In such cases, resolvers generally try another root server, until it gets a non-SERVFAIL answer, so for this to have the desired effect, you'd have to get all the root servers to implement the same change. This would be unlikely.
However, the root server operators merely publish what ICANN (via the IANA functions) produces.
If the US (either federal or perhaps even the states of California or Virginia) were to decide to "censor" a TLD in the root zone, they would simply go to ICANN, PTI (the folks who provide the IANA functions under contract to ICANN) or, more likely, Verisign (who generate and publish the root zone under contract to ICANN) and demand the root zone be modified.
As a sibling comment mentioned, the root servers are unlikely to get such order since they deal with registries and not what I would call end user domain names.
Registries do get block orders. When the Swedish registry got that for piratebay they choose to treat it like a domain dispute and gave ownership of the domain to the police, which the police in turn could treat like any other taken property and auction it out. The trouble is when the police wanted to destroy it, as there isn't a good definition on how to destroy a name so it can never be used again, and the registry was not keen on allowing the concept of a block.
The root DNS servers basically only tell you where the registry servers are, they don't contain records themselves. If someone censored a domain at the registry level then the root servers would be no help
I just run my own name server. DNS blocking is no longer an issue unless they get to the root name servers. With a little domain warming from the top 5000 domains it’s pretty snappy most of the time.
More realistically, DNS blocking is no longer an issue unless "they" get to the registries for the top-level/second-level domains. It's easy to make yourself immune to things injected by the root content DNS servers, with at least two mechanisms for combatting this (the better one being just running your own private root content DNS server) having existed for most of this century.
Or block outbound 53 on residential networks
Are we heading to a place where there will be many DNS resolvers just to get a "full" picture of the internet? Or perhaps topical upstream resolvers?
Easier to run your own uncensored resolver, no?
See RFC 8806
> “At what point does legal compliance become de facto censorship?”
I genuinely agree with this statement a lot. Also another aspect of this is that the bigger companies can somehow "legally" do things which I don't think would work but they have so many resources to strech the court case for a long time.
And the fact is that even after that, even if they are fined for some dollars. They are more than likely to just pay than try to actually fix the core issues which effects everyone harmfully except the company.
All for profit smh. I sometimes wonder if there is a word for this phenomenon for how our system has gotten into such a rotten state from lobbying to this yet at the same time genuine non profits get existential threats for the same behaviour but they simply don't have the funds...
> Also another aspect of this is that the bigger companies can somehow "legally" do things which I don't think would work but they have so many resources to strech the court case for a long time.
A big part of this impression is that people very often very much underestimate what they can get away with, whereas big companies have lawyers to tell them ”oh yeah you can totally do this”.
Of course there are some exceptions. Uber and AirBnB are probably decent ones, in some jurisdictions anyway.
I find it amusing that it's always the governments fault. Or the users fault.
It's never the fault of the trillion dollar industries that are millions of times more powerful than any individual.
Our system get gotten into a rotten state because a tiny number of modern barons have all the power, and none of the civic responsibility. Concentration of money - when money is power, is the same as concentration of power.
I've increasingly taken the attitude that digital media is simply lost to corporate interests and there's nothing we can do about it aside from not spending money or time on the internet.
if (geoip[sourceIp] === "France") {
if (geoblocks["France"][sourceIp]) {
return NOT_FOUND;
}
}
Another side effect of law makers yoloing legislation on things they don’t seem to understand
This all started, in earnest, with Response Policy Zones being added to BIND. RPZ allow DNS resolvers to lie to clients by returning (nxdomain or redirects to other domains) and the client does not know it is being lied to.
https://www.isc.org/docs/BIND_RPZ.pdf
I guess some day, one political party will use it to block the websites of other political parties, etc. That's stupid to say (I know) but that seems to be the slippery slope we are sliding down.