Yet another Hacker News

243 points farrokhi 2 hours ago 80 comments

babarock 1 hour ago | parent

Punishing the DNS resolver is weird. Would you punish the phone book company for having the number of a criminal listed?

pixl97 1 hour ago | parent

Because they can.

Attacking the people doing the actual bad things is hard, attacking a single unified organization is easy.

teroshan 1 hour ago | parent

Same reason copyright abusers threaten people that help remove the DRM from their Amazon-bought e-book so it can be read on their non-Amazon bought e-reader with a $250,000 fine and five years in prison for circumventing a digital lock using DMCA, because it's what the legal API allows them to achieve their end goal.

It's not about if it makes sense from a moral point of view.

mitxela 1 hour ago | parent

You would if you could and it'd probably work.

I believe the position of the French government is that anyone in the path of a crime can be ordered to block the part of the crime that relates to them, without having any liability for the crime. So quad9 are not criminals for not blocking pirate sites, but still have to block specific sites when ordered.

iamnothere 36 minutes ago | parent

Where does this line of reasoning end though? Shouldn’t the browser makers be blocking the sites too? What about curl? What about the OS and local DNS resolvers (unbound etc)? Maybe Ethernet and wifi cards should contain blocking logic? At some point you have to draw a line!

JoshTriplett 59 minutes ago | parent

The most likely answer is that they didn't think about it or didn't understand or didn't care. But on the off chance they did, perhaps they thought the DNS provider would enforce the ruling worldwide.

rdtsc 32 minutes ago | parent

It shows maliciousness (we can bully this smaller player for a win) and/or total incompetence (we don't even understand how internet works, but we'll issue rulings anyway).

crote 1 minute ago | parent

Sue the government for providing the road that criminals walk on!

Onavo 1 hour ago | parent

Another user commented on

> €580,000 to €1,000 per day. But deleted his/her comment.

To put this into perspective, €365K a year is roughly the fully loaded total comp cost of a high-senior to low staff level software engineer or a mid level ML engineer at a frontier lab in Cali.

jubilanti 1 hour ago | parent

Per each infraction. They said they currently have 20 other cases pending. And who knows how many would be to come.

nadermx 1 hour ago | parent

"The plaintiff (Sony Music Entertainment GmbH) then used a VPN to access the blocked content from Germany in circumvention of the geoIP blocking. The court agreed with Sony in their assertions of noncompliance, and we were fined for contempt of court."

Imagine doing everything possible to stop something. They then circumvent your protections with yet another service, and you get fined.

I wish I could even suggest what someone could do against these trolls.

This is like saying "we put a lock requested by court and where found guilty because plantif hacked us after"

bitpush 1 hour ago | parent

> Imagine doing everything possible to stop something. They then circumvent your protections with yet another service, and you get fined.

Isnt this what gets all tech companies into trouble all the time. Something objectionable happens (ChatGPT helping someone bulid a bomb for instance) and we go like "Do better".

matheusmoreira 22 minutes ago | parent

As we should. These corporations are rent seeking monopolists. Like many Japanese companies, Sony is an intellectual property absolutist. PlayStation creator Ken Kutaragi called our objections to the "you'll own nothing" future a "mentality issue".

I have sympathy for my fellow man. There isn't enough liability in the world for these corporations.

warkdarrior 8 minutes ago | parent

> These corporations are rent seeking monopolists. Like many Japanese companies, Sony is an intellectual property absolutist.

The whole intellectual property space is pure rent seeking. Everybody wants name recognition and/or money whenever some text, code, image, or video they produced is used or remixed. It is pure rent seeking, from FSF to Sony to Metallica.

zamadatix 16 minutes ago | parent

I think, usually, in those cases it's that people believe the company did not really do anywhere near everything it could - it did the bare minimum it thought it could get away with then seemed shocked it wasn't enough to matter.

Here, if any pair of countries have conflicting rules then you simply can't expose your service to both because it's plain impossible for you to block all means of VPN/proxy regardless of how perfect your service tries to detect it. There's no payment, there's no account, there's no anything - you're just serving DNS to an IP that reports to be out of Germany according to German law. At some point it stops being a mistake/malintent of the company and one of the user. Where that transitions probably depends on the person though.

warkdarrior 11 minutes ago | parent

> I think, usually, in those cases it's that people believe the company did not really do anywhere near everything it could - it did the bare minimum it thought it could get away with then seemed shocked it wasn't enough to matter.

Yes, and Quad9 could have done better in the German court case. At a minimum they could have asked users to register and provide proof of residency, and then could have ensured that their DNS service is offered only to registered users.

crote 3 minutes ago | parent

> At a minimum they could have asked users to register and provide proof of residency

This would have been a massive burden to them, and (as we have seen from the ongoing data leaks) a gigantic privacy risk to its users. It would have also been a big overreach, as the German ruling would have mostly impacted non-German users.

mitxela 1 hour ago | parent

And for contempt of court nonetheless. That's meant for when you blatantly don't do the thing the court told you to do, not when you did it but it didn't work how the court wanted.

irusensei 31 minutes ago | parent

Lately Sony Corpos have been really getting into their supervillain arc aren’t they?

sunaookami 24 minutes ago | parent

Lately? Did you forget the rootkit they installed on everyone of their customers PCs?

nubinetwork 4 minutes ago | parent

That was 20 years ago

artooro 1 hour ago | parent

Quad9 is getting picked on because they do not have a large financial backing. Not because it makes any logical sense. France is shooting themselves in the foot.

martinjc 1 hour ago | parent

Sony being sleazy again. You start to wonder why they pick on the wrong people.

coldfloor 25 minutes ago | parent

What's with all the Sony comments? This has nothing to do with Sony.

gumby 1 hour ago | parent

Why does it matter that it’s a recursive resolver? They mention this a lot but it seems like the decision would just as much apply to a non-recursive resolver.

I didn’t attempt find the ruling; perhaps the lawsuit was written in an odd way.

ButlerianJihad 1 hour ago | parent

It is difficult to envision a "non-recursive DNS resolver" in public service. Recursion is the usual and customary way that DNS names are resolved by the leaf servers, because they are not authoritative for much of anything.

The most common configuration for non-recursive DNS servers is with forwarders. The DNS server accepts queries and simply forwards all of them upstream to another resolver, which... makes its own recursive queries.

It is simply not feasible to avoid having recursive resolvers in the chain of lookups. That's how things work with DNS.

gumby 1 hour ago | parent

We used to just leave that responsibility to the querying host’s own resolver. I don’t fetishize the end-to-end principle (though I come close) so I suppose a recursive resolver service could be a sort of optimization (plenty of ppl look up, say, gmail.google.com so why not cache it).

In any case, if all resolvers these days are recursive why mention it?

I know this is far from the most important question on the topic of this thread!

toast0 59 minutes ago | parent

> We used to just leave that responsibility to the querying host’s own resolver.

When? I didn't get online until the 90s, but resolv.conf delegating recursion to some other node was the way of the world back then. And still is. Some people do run a recursive resolver locally, but it's not so common afaik.

> In any case, if all resolvers these days are recursive why mention it?

Quad9 is named as a recursive resolver in contrast to being an authoritative server. Quad9 and the server I run for my domain are both DNS servers, both provide name resolution, but one is recursive and the other isn't. Used to be, you might run one server for both jobs, but that fell out of fashion for good reasons.

lokar 24 minutes ago | parent

Back then most computing was done in office, lab, university settings. Running recursive resolvers for the local network was part of the standard IT setup.

Felger 1 hour ago | parent

"There are more important reasons geoIP blocking will not work."

Okay, now waiting to see how they will technically block those french users from the 24th nov onward...

burnte 1 hour ago | parent

They don't have to. Despite Europe's best efforts, national laws are not enforceable outside the borders without lots of cooperation, and tech regulation is not an area where people are collaborating.

JokerDan 1 hour ago | parent

DNS resolvers getting sued should stop resolving domains/properties of the companies suing them too when they are forced to take these kinds of actions/steps off the back of a legal decision like this.

drdexebtjl 1 hour ago | parent

Keep resolving, but instead of resolving multiple A records, resolve just one. Fuck that one server in particular.

Delay updates by 1 week.

Answer randomly with the up-to-date or the out-of-date records.

raverbashing 54 minutes ago | parent

Obviously

The problem is that these types of companies are started by naive idealistic techs who only know how to play by the rules and can't figure out why people would misuse their products

They were very well described by the "rubber hose crypto" XKCD

(Not that I don't think a DNS company stays at the same level of complexity - both legal and technological - as a VPN company, but still)

anonymous908213 31 minutes ago | parent

Or, get this, anything that is useful can be misused, so maybe we should go after the people misusing things rather than locking all of society in a cage to pre-emptively prevent misuse.

"The problem is that these types of companies [kitchen knife manufacturers] are started by naive idealistic [craftsmen] who only know how to play by the rules and can't figure out why people would misuse their products [by stabbing people]."

AspireOne 28 minutes ago | parent

What "types" of companies do you mean exactly?

raverbashing 8 minutes ago | parent

Tomato sauce companies?

Or companies that sit between tricky legal and technical questions without having f-you money but especially lacking on f-you legal advice

(One thing about these founders is that they also have a hard time understanding context and follow-up questions)

WhyNotHugo 5 minutes ago | parent

While I agree in spirit, this also makes the resolver away from being able to claim they're just a neutral service which just delivers existing records without being opinionated

trentor 1 hour ago | parent

Crazy. A company that actually exits the market they threatened to leave. Meta and Twitter should take note.

declan_roberts 1 hour ago | parent

Europe needs to strengthen its free speech protections. It turns out, even though the US founders had no idea what DNS was, they still created the right framework to protect it.

AndroTux 55 minutes ago | parent

As long as you don’t say Artificial Intelligence instead of Super Intelligence, you’re all good.

DemiGuru 1 hour ago | parent

I mentioned not too long ago that Mullvad was handing its resolver users over to Quad9. Sadly, I didn’t realize how accurate my concerns would be. Quad9 is a good operator, they actually fought Sony in a German court instead of quietly complying. Yet, they were still ordered to block the content. That’s the core problem. A blocking order is only as damaging as the resolver it impacts. Every time an operator shuts down and redirects its users to Quad9, it pools more users into one place. This makes the next blocking order even more valuable and effective for whoever files it. And now we're seeing Quad9 backing out of a market.

alberth 22 minutes ago | parent

HN thread: https://news.ycombinator.com/item?id=49568579

nish__ 1 hour ago | parent

How have our democracies not abolished copyright law yet? These laws only serve the 1%. I have no idea why we still put up with them.

cyanmagenta 1 hour ago | parent

> How have our democracies not abolished copyright law yet? These laws only serve the 1%

Yeah, fuck those billionaire authors and artists in coffee shops not wanting people to rip off the books and art they create without compensation.

nish__ 59 minutes ago | parent

AndroTux 54 minutes ago | parent

The 1% just copied all available data without consequence. Yet, Quad9 gets sued and loses.

surgical_fire 45 minutes ago | parent

AI companies already ripped those things off.

I am back to piracy, now on a moral imperative. I can pay for stuff, but I think the morally superior thing to do is to pirate away.

roblabla 40 minutes ago | parent

I find it extra funny that you think copyright protect small time authors and artists, when we have _very clear_ examples of it not protecting them for shit, even before the entire IA saga. Remember the Disney/Star Wars saga where they refused to pay the Star Wars author for the books they were selling?

https://archive.bookstr.com/article/royalty-wars-over-star-w...

Copyright doesn't protect small-time authors - because small-time authors don't have the means to harness the legal system to their advantage the way that big corpos that take advantage of them do.

cyanmagenta 32 minutes ago | parent

I don’t necessarily disagree, but by that same logic we shouldn’t have any civil laws because regular people can’t afford to hire lawyers to sue people.

But still, if someone posts a copy of your book or painting online, you can pretty cheaply file a DMCA request that it be taken down, and most large players will comply. If you throw out copyright law altogether, you get rid of that too.

sham1 40 minutes ago | parent

While your point is valid enough -- although it could have been made without this kind of snarky and sarcastic snide -- it seems clear that global copyright legislation is a lot more beneficial to the wealthy capital owners rather than the artists that you were alluding towards. Now, this is no insurmountable obstacle at least in theory. The laws could be modified in a way that lets small artists etc focus on following their passions without starving, without allowing capital to do what is essentially the intellectual equivalent of enclosure of the Commons.

Of course, one thing needed for this is the political will as well as getting rid of the idea of defending exploitation by the billionaire class by conflating their needs with the needs of starving artists because one can technically argue that copyright helps both, despite everyone knowing that one party is benefiting a lot more from it than the other.

numpad0 47 minutes ago | parent

FOSS depends on copyright laws. Oldest versions of Linux and UNIX are more than 20 years old, so early versions of both would be hypothetically now in public domain in the absence of Disney-lobbied maximalist versions of copyright laws, or in the total absence of one.

nish__ 16 minutes ago | parent

No it doesn't. Most projects are MIT or some other permissive liscense.

dist-epoch 45 minutes ago | parent

How do you feel about OpenAI training on all of the books in the world.

christophilus 41 minutes ago | parent

Fine, as long as they aren't the only ones who get to do it. Having the world's knowledge at everyone's fingertips is a goal I think we should aim for.

sham1 28 minutes ago | parent

The irony with these AI corpos is that they're okay with scraping all of human creative endeavours yet they get annoyed at others doing distillation on their models.

Compensating authors would be a moral thing to do, but morals aren't really a thing for corpos, so whatever. However the fact that they then turn around and get annoyed at other actors for scraping their stuff is very hilarious and shows how much they care about the social contract :)

nish__ 15 minutes ago | parent

It makes me feel like the rules are "for thee, not for me." Like it proves that the rich can just do whatever they want.

_imnothere 1 hour ago | parent

Time to boycott Sony, they deserve no money from anyone, and I meant anyone.

They're just f*ing with people without getting anyone good stuff.

Suppose they're doing this for copyright, it's not like the pirates would be stopped by a mere DNS block rule set anyway.

antiframe 45 minutes ago | parent

> Time to boycott Sony, they deserve no money from anyone, and I meant anyone.

Because when they installed rootkits on user's machines wasn't that time?

Because when they removed content users purchased from their machines wasn't that time?

Because when they spy on what users watch on their TVs in the privacy of their home wasn't that time?

Sony is like a tree. The best time to boycott Sony was decades ago. The second best time is today.

raquuk 38 minutes ago | parent

Yes, but in this case the plaintiff is beIN SPORTS France.

0x0000000 1 hour ago | parent

Maybe i missed it in the post, but how are they going to implement it? They mentioned geoIP is insufficient for complying with the block, so if they dont have a way to block only these domains for users in France, how will they block all requests for users in France?

To be clear I dont think they should comply with the block, but i didn't grasp how they're going to block everything if they dont have a way to only block some things.

eloisant 41 minutes ago | parent

They're removing all presence they have in France, their servers mostly.

They want to be out of reach of French courts basically.

keoneflick 18 minutes ago | parent

Do you think they will geoblock in addition to physically leaving?

disiplus 27 minutes ago | parent

You stop serving anything for french ips. Its like you dont exist.

djha-skin 13 minutes ago | parent

...That's just geoIP blocking, which he covered in his comment.

hk__2 13 minutes ago | parent

"french ips" don’t mean anything as the post said; see their case in Germany.

rafram 57 minutes ago | parent

They are in a difficult position because the entire point of their DNS resolver is that it blocks malicious sites (malware, phishing, etc.). Very easy for Sony to say, why can't they add piracy to the list? They "refuse to alter or lie to you" in their DNS responses - how would a malware block be lying if those other blocks are not?

dmantis 29 minutes ago | parent

I guess the issue is that they are ordered to block it for all users, not only those particular users who picked some particular lists.

And nobody would pick a piracy list, why'd you do it as a user.

Jepacor 55 minutes ago | parent

Welp, I've been using quad9 and I'm French, does anyone have an alternative I can switch to?

capitol_ 41 minutes ago | parent

I recommend Norway, they have lovely fjords.

drcongo 13 minutes ago | parent

This comment made my day, beautiful.

Bender 48 minutes ago | parent

I am curious if a large number of people stood up their own DoH/DoT servers:

- Would France go after each one, even if they were not operating servers physically in France? It only takes a few minutes to configure Unbound+LetsEncrypt to accept DoH+DoT internet traffic. A few minutes longer to compile support for DoQ.

- Could they realistically expect individual operators of small DoH/DoT/DoQ open servers to block domains at their behest?

this_user 31 minutes ago | parent

Whenever people talk about why you should host in the EU, this is just the most recent example for why should shouldn't.

nairboon 27 minutes ago | parent

Host in Switzerland, that's where Quad9 operates from.

greatgib 28 minutes ago | parent

Sadly no-one responsible from this situation will care.

French authorities and network operator will in fact prefer that you don't have alternative than using the dns servers that they are providing.

So it sucks that Quad9 is closing their resolver to french IPs. If they stand by their values, they should continue to accept the requests, just leave all office and business ties with France.

Similar to ofcom things against 4chan.

jeroenhd 15 minutes ago | parent

Sports broadcasters truly are the bane of society. May they get DDoS'd during important matches until they're bankrupt.

intrasight 8 minutes ago | parent

Sports is the only thing left of value in broadcasting. I can totally understand why they're gonna fight tooth and nail to protect it.

whh 11 minutes ago | parent

> The plaintiff (Sony Music Entertainment GmbH) then used a VPN to access the blocked content from Germany in circumvention of the geoIP blocking. The court agreed with Sony in their assertions of noncompliance, and we were fined for contempt of court.

I knew courts were dumb, but didn't think they were this dumb.

"The neighbour's dog bit me, so they put up a fence. I climbed over it and got bitten again. The fence doesn't count."

euio757 4 minutes ago | parent

Seems they're following Cisco similar move 2y ago of exiting the market

> Canal+ has been busy getting web-blocking injunctions in France against sports piracy sites which stream sporting events for which it has the exclusive broadcast rights within the French market. It previously targeted DNS resolvers operated by Google, Cloudflare and Cisco.

> All three unsuccessfully opposed the web-blocking orders. Google and Cloudflare, therefore, have been forced to instigate them. However, Cisco just pulled its OpenDNS service out of the French market entirely.

(Per https://completemusicupdate.com/quad9-vows-to-fight-absurd-w..., https://completemusicupdate.com/opendns-pulls-plug-on-france...)

egorfine 1 minute ago | parent

Why stopping serving french IPs though? Remove your legal presence in France, sure. But block IP ranges from reaching your servers.. just why?