Adguard Letter of Support to Quad9 | Hacker News Reader

Adguard Letter of Support to Quad9

adguard.com

78 pointsNmAmDa24 comments

Quad9 is based in Switzerland, so the German court should only have jurisdiction over whatever servers are in Germany. It seems like the worst case scenario is that Quad9 shuts down their German servers, but still serves German requests from servers in neighboring countries.

That said this is still terrible and I hope the German court reconsiders their decision. The free flow of information is more valuable than protecting copyrights, because the former benefits many more people. Most of the copyright holders who feel threatened by piracy are not even German! The court is protecting big American businesses over individual Germans.

It seems that most of HN doesn't know the Lugano convention (which basically reaches the entire EEA).

> The spendings will only grow as more and more similar court rulings are handed out (which without a doubt will come eventually). It will become near impossible to uphold a DNS service, and all small DNS resolvers will vanish.

I run one such small public DNS (DoH-only) resolver (primarily popular in countries where censorship is low to moderate), and know several other folks who do. Just the other day we were discussing the implications of this ruling, but coming from a country with dismal digital/internet freedom track-record, this made me sit back and contemplate for a bit (unblocking access to censored web properties may soon be a crime as the government here bids to criminalise VPNs):

I believe, the inevitable over-regulation and insurmountable legal threats are going to ruin it for the hobbyists who thrive at the fringes. Internet may soon go the way of the telecom industry. Controlled by a few, regulated to oblivion, with high barriers to entry.

I hope I am wrong.

I do not understand why more people don't switch to a decentralized DNS such as OpenNIC (https://www.opennic.org)

Governments have abused their control of DNS. A distributed system (with trust and safeguards) is the better way.

OpenNIC isn't "decentralized" or "distributed" in any meaningful sense. It's the same architecture as ICANN DNS circa 2000, but run by hobbyists. (And in practice, it's mostly hosted on cheap cloud servers. No anycast IPs, no load balancing -- just few enough users that they haven't had to deal with any serious scaling issues yet.)

Because no one knows about it. But also, looking at their list of servers, the majority is offline. Assuming this is because any person can run one, it's probably the reason.

On top of the above, the likes of Google are enforcing their DNS servers. For example, I run AdGuard Home with it's DHCP functionality. I am unable to rely on the DHCP settings on my Android phone because Google forces the first DNS server to be 8.8.8.8 with (as far as I can tell) no way to disable this.

I think at least for the foreseeable future the solution is to run Unbound and stop relying on DNS resolvers combined with a firewall that redirects all DNS records AdGuard Home/PiHole. This is obviously not a solution to the general public.

Lots of tech giants are forcing DoH so their apps can phone home despite safeguards such as pi-hole. There's not a lot that you can do about that (if they are using certificate pinning, which they probably are). You can however do something about 8.8.8.8 (and 8.8.4.4). Just put a static route in your firewall that points those to your DNS of choice (or to a black hole).

I'm still in the stages of setting up a fullt featured firewall at home, but I wonder what would happen if you block doh/dot addresses completely in such cases. Something to try in the future when I have my home network set up properly I guess.

You can block all outgoing requests to ports 53 and 853 for DNS and DoT respectively. That's the easy part.

For DoH, you either have to block port 443 (bad idea), or block the IPs of all known DoH providers.

Then you can run for example a Pi-Hole and add a firewall rule to allow outgoing DNS traffic only for that.

And of course that will not stop device/app makers from using nonstandard ports or even tunnelling their DNS traffic through other protocols.

> I am unable to rely on the DHCP settings on my Android phone because Google forces the first DNS server to be 8.8.8.8 with (as far as I can tell) no way to disable this.

Which Android version and skin? I'm on an Android 10, MIUI12 device and the DHCP-provided DNS server is the one used ( AdGuard successfully blocks ads on websites, apps when on my phone, until i disable it).

I can't speak to Google forcing DNS, I don't know if this is true. However, it will respect the private DNS option (DNS-over-TLS) which you can point to whatever you want (like NextDNS for filtering).

Interesting to know. I'll have to look into that. AdGuard Home can be set up easily with DoT and DoH so I'll have to try that.

Just keep in mind some mobile carries block DoT so it's not always an option (Android does not natively support DoH).

How was your experience with them? Mine wasn't too great a few years ago - I switched, everything was great, had that nice fuzzy feeling inside that I'm using a pro-freedom/anti-censorship DNS, until a couple of months later when the DNS server just stopped responding. Surely I must've simply been unlucky I thought, so I switched to another instance but the same thing happened a few months later.

I love the idea in principle but it didn't seem to work for me in reality.

If everyone used OpenNIC what would be different about this case?

What would be different is that an individual or organization running a OpenNIC DNS would not necessarily be subject to a court order from Germany.

There's not much that can be done when governments fiddle with the root DNS servers, but methods could be developed to retain historical records, and revert to them in the event of censorship.

> Hamburg Germany court (310 O 99/21) has recently sent a notice to Quad9 (a standard recursive DNS resolver) demanding to stop resolving certain domains for all residents in Germany on request from Sony Music GmbH. According to Sony, those domains in question are infringing on properties that they claim are covered by their copyrights.

This would be like a German court ordering Yellowbook to stop listing the phone number for a DVD store because they were known to sell bootleg copies of Sony movies. What a joke.

Same as ordering the post office to stop processing mail because someone sent a copy of a book in the mail...

GP's comparison seems considerably more accurate. Even if your position is that the only way the Post Office could comply with filtering the mail for the address that's still not the same as an order to stop processing mail. Not to mention "someone sent a" makes it sounds like a single instance which is certainly not what http://uu.canna.to/ regardless if you agree or disagree with pirating content.

The comparison is not the mail or the processing, it's the fact that it's a transporting service and nothing more, just like DNS.

Again, the order wasn't for quad9 to stop delivering DNS as a whole though, it's for the particular address. Much as the GP's example is about a particular entry in the yellowpages.

I don't think anyone here suggests a global delivery stoppage...

Quad9 was co-created by IBM, they will bow the knee to preserve government contracts and big R&D bets in Germany

https://www.forbes.com/sites/moorinsights/2021/06/15/ibm-and...

IBM is one of many donors to Quad9, but they have no seat on its multistakeholder governance board. https://quad9.net/about/foundation-council

Reply on news.ycombinator.com