Comment by johnhtodd
13 hours ago
(context: I'm the CTO of Quad9 and am one of the people dealing with the lawyers)
There is an understandable focus on "how are you going to block French users" when we have also claimed that geoIP blocking is insufficient for selectively denying resolution for certain names - we understand this conflict, but we think it is energy spent in the wrong place.
It is probable that we will use geoIP filters to block French users from our services after November 24. We could apply this same geoIP filter list now to selectively block French users from reaching the sites that we've been told to make unavailable. But this would corrupt our core premise, which is that the DNS is not the right place for this to happen, and if we comply within France to meet the requirement then we accept the worst eventual outcome for users and we still do not have legally perfect coverage. We wish to first remain consistent with our core mission, and secondarily we must remain as close to compliance as we can to the legal constraints put upon us. By accepting the demands for blocking, we would admit that such demands are permissible within our mission - that we will act on behalf of companies (or others) to create ineffective and mis-directed regimes of content constraint.
We would be admitting that we think this solves the problem - it does not. We would be admitting that we will do this for an ever-increasing number of names - we will not. We would be permitting these methods to be applied for more areas of filtering such as moral, religious, social, or political reasons - we must not.
So we accept that there is the possibility that we will have errors in our blockade, but in this case (blocking French users) we maintain consistency with our stated mission of integrity of the DNS. We would rather there be a clear distinction made for users of our services: you get the DNS as you (the user) expects, or if Quad9 is forced to pollute the service with unexpected and arbitrary number of fragmentation demands, then we will not offer the services at all.
The underlying issue is not ONLY that geoIP blocking is ineffective, but that the entire premise of any of these demands is inappropriately applied to DNS recursive resolution providers. We would hope that this discussion continues to be on the most fundamental of the disagreement we have with the outcome in this court case, not on the details of the technical implementation which have yet to be entirely decided and which can be tuned over time.
Good to see leaders stand up for what they believe in. Soemtimes I simply do not understand this obsession with controlling the internet by European countries. So ridiculous.
You should make the case of Qatar corruption money having bought this ruling.
Qatar spends a lot of money to bribe european politicians - that is known for a long time now:
https://en.wikipedia.org/wiki/Qatar_corruption_scandal_at_th...
And now we know why Qatar bribes everyone in the EU. They buy legislation. Or at the least rulings.
Keep up the good fight! I'm happy that you take a stand for your beliefs and try to do what's best for all of us.
Thanks for fighting this.
I wonder how much longer the internet will manage to hold out. Governments will continue trying to impose their laws on it, causing the international network to degenerate to numerous national networks with heavy filtering at the borders. It's really sad to watch...
Necessity is the mother of invention. Fortunately what's needed is already invented, but the motivation to push 'normal' people there hasn't. In particularly decentralized techs, TOR, and other technologies are fully robust against these actions.
Our inability to push "normal" people onto these things is precisely what will kill us. Tor needs a massive anonymity set to work properly. If people don't use it, we are all weakened. It also gives the corporations economic leverage: they can just ban Tor exit nodes and take the small loss instead of being forced to connect.
It isn't just governments. Cases like this are started by companies.
If you have no presence in France do you need to care about the ruling or the fines?
I mean, theres probably EU provisions in place to make that kind of local ruling have teeth, n'est-ce que pas?
Ok, but Switzerland is not a part of the EU. They participate only by treaty. So there has to be more to this story (legally-speaking)
2 replies →
Thank you for the explanation! I couldn't agree more with your stance, and I appreciate deeply you fighting to maintain your (correct) principles. You've gained at least one fan and new user today.
One can only hope the tribunal that rendered this ridiculous decision is one of the organizations that lose DNS access on November 24.
Honest question here: why don't they target the operators for the nameservers that own the affected domain, basically the TLDs?
Oh right, the blocked domain is probably not a french TLD...
Well, they might be able to go against the domain registrars and possibly cloud providers that also operate in the french market. But those companies probably have a bigger expensive legal team, while quadnine is just a little non-profit.
Quick question: what would happen if you decided to simply shield yourself from France’s action without applying any change to your dns? Or is blocking french users considered a compliant answer by French courts?
I don’t get why you would still need to block french users if you also need to exit the jurisdiction.
Because continuing to provide the service to French users would mean they have not exited the jurisdiction. You cant provide services in a jurisdiction and at the same time expect not be subject to that jurisdiction. That's just not how any country treats legal jurisdiction.
Yes but if you don’t have any assets in the country you could not liable, that was OP’s point.
But even being based in Switzerland I believe there’s some inter-countries agreements, so it would not be practical.
4 replies →
The problem is that, technically, an IP address doesn't have a country. GeoIP is at best a suggestion, and it is trivial to route your traffic through a "foreign" IP.
It is about as enforceable as "don't read letters written by redheaded people": it'll never be airtight, and it'll always have a huge amount of false positives.
The only possible "solution" is to ban all open devices from the internet, mandate a DRM-style "trust zone", have the device do mTLS, and embed a realtime DNA sequencer in every device.
1 reply →
As a side project I help out with some technical stuff at a hosting company that provides services to a political group that is strongly anti Erdogan. The infrastructure is in the USA.
We do not block IP traffic from known Turkish ISP ranges. The customer (the political group) receives all sorts of dire legal warnings and threats that what they publish is contrary to Turkish law.
None of our other hosting platforms are configured to block any traffic to/from Turkish IP ranges. We have no business presence or financial involvement with anything domestically in Turkey. Am I subject to Turkish jurisdiction? I don't think so.
But by what you wrote, I am providing services in Turkey.
6 replies →
Hence the “shield” part. I guess it’s easier said than done when you’re a Swiss non-profit and not an anonymous sysadmin in Iraq (or whatever jurisdiction would work for this example, idk).
1 reply →
Unrelated but hoping you could answer this:
There was a rumour years ago that Quad9 was connected to UK intelligence, or something like that. I haven't heard anyone discuss there for a long time, but wondering if you (or anyone reading this) can comment on the source of the rumours and whether there is any veracity to them.
The thing about DNS is that you can do your own investigations, rather than rely on rumour and innuendo. You can query their DNS and anyone else you can get at and compare results. You can use a VPN to appear to come from somewhere else or ask a friend to perform a query on your behalf.
You can literally [sigh] be your own journalist in this regard. All you need is a DNS query tool. I recommend dig but you might only have nslookup available out of the box.
Now, this UK intelligence thing. Even if James Bond Q's mates were actually running a DNS system you can still query it and compare it to someone else's view of the internet, say 1.1.1.1 or 8.8.8.8 or whatever.
You can also go to the source, ie root: . and work your own way down to decide on what is what.
Let's have a go at an analogy: DNS is (not really) a bit like a topographical map. You could buy your maps from DodgyRussianMaps'R'us and be surprised that Ukraine has somehow been subsumed by a bunch of murderous wankers. On the other hand you might buy your maps from HonestJonOffOfFaceb00c and note that it isn't. You can, of course, ask for a few other opinions and make up your own mind.
My real point is that DNS is actually quite hard to tamper with, without breaking so many things that everyone can know it is being messed with. When an org resorts to fiddling with DNS they've already lost whatever argument is to be had.
I think you fundamentally misunderstood the potential issue.
Sure, on a reply based approach you can audit a DNS service.
But that doesn't tell you about other things like "is my DNS provider also providing intelligence agencies with my entire DNS query history?". The issue isn't "oh no the MI6 can redirect my PornHub link to anothe site", but "oh no the MI6 knows every single webpage I visited". Which is a valid worry given the current British political climate.
I think the point is more about the intelligence gathering rather than the tampering.
I’m sorry for being so dense, so what do you plan to do?
It sounds like selectivd site blocking is against your mission, so will you then just not offer Quad9 to any person in France instead (total blackout across all sites)?
Sorry if I’m missing the obvious or your stated solution.
Sorry that you guys have to go through this. I use quad9 and it works great!
Better than geoip, y'all could work with the French to have French networks point to a black hole server by having BGP point 9.9.9.9 at said server.
The French might just do that anyway and point it at some government-approved “safe” DNS resolver.
I asked his elsewhere but aren't there like a prepondeance of existing case law or amicus-briefs that would speak to the logical and historical stupidity of arguments by the plaintiffs?
[flagged]
So, basically, you admit you will comply exiting all countries that ask for it; Pushing users to allegedly less safe resolvers in the name of security and integrity; And eventually ending the service in a couple of years because no one will be able to use your service since you'll be blocking most parts of the world and won't work without VPN exit in specific places. The decision is understandable, this really is a dillema I wouldn't want to take part in. You'll die by a thousand cuts of authoritarianism.
I haven't seen your donation to their legal defence fund? Cheque is in the mail?
It's strange that Quad9 openly does malicious domain filtering [1] using what it terms "threat intelligence feeds", but apparently filtering piracy domains is technically impossible and not the right place for this to happen. I think courts rightly are suspicious of this kind of doublespeak from DNS companies. If DNS filtering is effective for protection against malware and ransomware, it will be at least somewhat effective for piracy filtering too.
[1] https://quad9.net/service/threat-blocking/
(context: I am the CTO of Quad9) Using those threat intelligence feeds is optional, as the blog post indicates. 9.9.9.10 & secondaries have no filtering.
The threat feeds we offer are in alignment with what the user expects and intends. Mandatory restriction of DNS resolution by a third party (not the user, not Quad9) is expressly what users do NOT want, regardless of the outcome. Once such restrictions are enacted and treated as normal, the channel for making demands will fill with a flood of "objectionable" names from every corner for every reason. Quad9 has already received demands from the French regulator to block sites which deliver adult content found to be objectionable to minors. We see an extremely slippery slope which has already moved out of piracy as the scoped intent which is this case in particular.
More to the point: prohibiting content via the DNS is a useless exercise when it is done out of alignment with the end users' goals - they will simply use some other recursive resolver (or their own) probably without the benefits of being oriented towards security and privacy. We have no monopoly on DNS resolution - there are thousands of others open to public use, and anyone can set up their own, for free, with no mandatory requirements by governments or regulators. This case (and any others like it) only drives out law-abiding organizations who are trying to promote better cyber hygiene and who want to keep the DNS as a single, un-splintered high-integrity pointer system.
> Using those threat intelligence feeds is optional, as the blog post indicates. 9.9.9.10 & secondaries have no filtering.
TIL that filtering is on by default on the standard resolver (9.9.9.9). That’s certainly a surprise to me; I would have expected the standard resolver to provide “honest” DNS responses and a secondary to provide filtering, rather than the reverse (which is what I think Cloudflare does).
While I think that the ruling is both morally and legally questionable, I do agree with GP that this weakens your original argument quite a bit.
1 reply →
Yeah, it's not the right place for it to happen. One's a service to protect the consumer, and the other is a corporate profit preserving concern. Why should a free DNS service be doing their work for them?
Because a court interpreted the law and ordered them to. And protecting companies from unlawful piracy is just as much a moral good as protecting the consumer from ransomware and threat actors. And if the DNS company can do the one, they can do the other.
7 replies →