← Back to context

Comment by romaniitedomum

12 hours ago

It's strange that Quad9 openly does malicious domain filtering [1] using what it terms "threat intelligence feeds", but apparently filtering piracy domains is technically impossible and not the right place for this to happen. I think courts rightly are suspicious of this kind of doublespeak from DNS companies. If DNS filtering is effective for protection against malware and ransomware, it will be at least somewhat effective for piracy filtering too.

[1] https://quad9.net/service/threat-blocking/

12 comments

romaniitedomum

Reply
johnhtodd  11 hours ago

(context: I am the CTO of Quad9) Using those threat intelligence feeds is optional, as the blog post indicates. 9.9.9.10 & secondaries have no filtering.

The threat feeds we offer are in alignment with what the user expects and intends. Mandatory restriction of DNS resolution by a third party (not the user, not Quad9) is expressly what users do NOT want, regardless of the outcome. Once such restrictions are enacted and treated as normal, the channel for making demands will fill with a flood of "objectionable" names from every corner for every reason. Quad9 has already received demands from the French regulator to block sites which deliver adult content found to be objectionable to minors. We see an extremely slippery slope which has already moved out of piracy as the scoped intent which is this case in particular.

More to the point: prohibiting content via the DNS is a useless exercise when it is done out of alignment with the end users' goals - they will simply use some other recursive resolver (or their own) probably without the benefits of being oriented towards security and privacy. We have no monopoly on DNS resolution - there are thousands of others open to public use, and anyone can set up their own, for free, with no mandatory requirements by governments or regulators. This case (and any others like it) only drives out law-abiding organizations who are trying to promote better cyber hygiene and who want to keep the DNS as a single, un-splintered high-integrity pointer system.

  • p-e-w  9 hours ago

    > Using those threat intelligence feeds is optional, as the blog post indicates. 9.9.9.10 & secondaries have no filtering.

    TIL that filtering is on by default on the standard resolver (9.9.9.9). That’s certainly a surprise to me; I would have expected the standard resolver to provide “honest” DNS responses and a secondary to provide filtering, rather than the reverse (which is what I think Cloudflare does).

    While I think that the ruling is both morally and legally questionable, I do agree with GP that this weakens your original argument quite a bit.

    • possibleworlds  8 hours ago

      > TIL that filtering is on by default on the standard resolver (9.9.9.9).

      Their offering is explained in the first paragraph of the home page, in fact the h1 and page title cover it.

teknologist  11 hours ago

Yeah, it's not the right place for it to happen. One's a service to protect the consumer, and the other is a corporate profit preserving concern. Why should a free DNS service be doing their work for them?

  • romaniitedomum  11 hours ago

    Because a court interpreted the law and ordered them to. And protecting companies from unlawful piracy is just as much a moral good as protecting the consumer from ransomware and threat actors. And if the DNS company can do the one, they can do the other.