Equipping backbone networks with DNS resolution infrastructures | Hacker News Reader

Equipping backbone networks with DNS resolution infrastructures

hadea.ec.europa.eu

143 pointsnixass93 comments

Good news (more infrastructure in the critical sphere is always welcome) but the real endgame is buried deep down:

> 12. Lawful filtering: Filtering of URLs leading to illegal content based on legal requirements applicable in the EU or in national jurisdictions (e.g. based on court orders), in full compliance with EU rules.

But yeah, it's the sort of thing that it's better done at EU level rather than in 27 different, weak and uncoordinated ways. Offices and schools would be very happy to use it, I bet.

What about?

> 5. Premium and wholesale services: Provide opt-in paid premium services for enhanced security (e.g. ad hoc filtering, monitoring, 24x7 support), tailored to specific sectorial needs (e.g. cloud, finance, health, transport), as well as wholesale resolution services for other digital service providers, including ISPs and cloud service providers.

5. and 12. are really concerning. IMHO the EU should invest in a DNS Infrastructure that is resilient to censoring (copyright or political) and operate it as non profit.

Edit: to be clear, non profit doesn't mean it can't charge money, profit shouldn't be a concern/target.

Are we talking about the same EU? The EU does this for censoring and monitoring, not against it - and they're totally open about it too. Google "Zensursula"...

I would expect quite a lot of resistance to monitoring efforts, even if they are paid opt-ins (which will mostly be used by schools and employers, the same way they already use similar services that do the same).

Censoring of illegal content is much less controversial, and already happening to various degrees at the ISP provided DNS servers. You can make good arguments for transparency and oversight by the courts, but that's as far as it usually goes. Hard to argue that illegal things should be publicly accessible.

It's not at all hard to argue that illegal things should be publicly accessible. I find it impossible to argue that governments should be able to decide what information is publicly accessible. There is no relationship between legality and morality.

Then the EU shouldn't invest any money. Cause if you can't improve the situation, stop wasting money on it.

From the perspective of public accountability, this is a step forward compared to the current status quo - where some countries implement blacklists and some don't, some are accountable and some aren't, etc etc. The EU dns would then work as public registry of such activities, also clarifying and harmonising the bar for acceptable censorship (i.e. opposition activity in Hungary? Not bannable...).

I don't see a problem with some commercial element in public services, as long as it's reasonable and transparent. As long as the public mission is still satisfied, it's just a good way to reduce reliance on general taxation.

The amount of such services you can provide for DNS is quite limited anyway. Maybe you can guarantee higher QoS on response times where this is critical, but that's about it. Maybe they can make non-EU-based businesses pay to use it.

> But yeah, it's the sort of thing that it's better done at EU level rather than in 27 different, weak and uncoordinated ways. Offices and schools would be very happy to use it, I bet.

No, 27 uncoordinated ways means 27 ways of going around. That's better in this case. No government the size of EU should have control of the internet.

For what it's worth, the EU is not a government. There will still be 27 countries implementing it - like browser vendors implementing a spec - and, again much like browser vendors, they won't be doing it in a well-coordinated fashion. It will be rife with <blink>s.

(Also, just for future reference, it's _the_ EU. Americans have a habit of doing this, also with the UK, and I don't understand it at all because your country is _the_ US.)

You're wrong about the EU, the setup you're talking about is long gone - since the Treaty of Lisbon to be specific, ratified over 10 years ago.

EU regulations are effective even without any mention in the local law. EU directives must be implemented within the time limit or the state will be sued at the EU court (not local court!) and made to pay fines until it's implemented. Thus, the EU quacks just like a government.

> and, again much like browser vendors, they won't be doing it in a well-coordinated fashion. It will be rife with <blink>s

Hopefully, but most definitely not simply because "the EU is not a government". It is enough of a government to avert this issue - e.g. see vaccination passports.

> (Also, just for future reference, it's _the_ EU. Americans have a habit of doing this, also with the UK, and I don't understand it at all because your country is _the_ US.)

I'm Czech, not American. My native language doesn't use "the" or "a" at all. I'll watch my English better.

> You're wrong about the EU, the setup you're talking about is long gone

Sure, the EU might have more authority than you would like, or more than it used to, but 'government' has a specific meaning - and the EU is not that.

The EU doesn't have a monopoly on the use of force. It can make regulations, and countries may follow them for whatever reason, but ultimately their regulations have no more intrinsic force than me saying "I command that everyone wear clogs on the bus".

I can see that your comment tries to trace the EU's regulations back down to some meaningful authority over the sovereign countries, and stops at 'made to pay fines in an EU court'. 'Made' is doing a lot of work here. There is nothing 'making' the countries pay those fines, besides a desire to stay on good terms within the EU.

Again, I too can issue the country of Italy a fine, and they may even choose to pay it if they sufficiently value their relationship with me, but that doesn't represent legal authority. Compare it with what happened to southern states during Reconstruction, or in the 1960s when they tried to refuse the federal government's directive to integrate schools. Indeed, compare Brexit with the American Civil War. Monopoly on the use of force within a certain territory.

This is a fascinating topic, and a very subtle one, but it's more interesting to think about if you go at it without an axe to grind.

> I'm Czech, not American. My native language doesn't use "the" or "a" at all. I'll watch my English better.

Ah, fair enough. It's mostly Americans who do it, and they have no such excuse, haha.

As far as I know, no definition of "government" requires it to have monopoly on force. A "state" as defined by Weber should have it, but Weber's own definition says governments and states are separate things - especially in a multi-layered system like the EU (Wikipedia lists https://en.wikipedia.org/wiki/Iroquois#Iroquois_Confederacy as an example of this situation).

> I'll watch my English better.

I think your english is perfectly fine and that "mistake" wasn't worth nitpicking over. We're an international community and we need to let some things go for the sake of maintaining our sanity.

I don't think every spelling correction has to be taken as an attack, as is implicit in your comment. I'm glad to have people correct me when I'm wrong, since it makes me better at whatever I'm doing. It seems to me what's unhelpful is not correction, but the feeling that one must always be correct, that there's no room for growth.

That being said, I think it's absolutely fair enough for the parent commenter not to know that. Their English is certainly better than my Czech. For Americans - divided by a common language - it's a more bewildering (and bewilderingly common) mistake.

English is defined by usage. If enough people make the same “mistake”, it’s not a mistake.

Haha, yes, we're not nearly at that point yet. It's not quite that common...

Oh I didn't see it as an attack, just not that necessary. Also I'm based in Scotland and english is my first language, but I've learned to relax a bit as I get older, even with Americans and their torturing of the language :)

I think that cat is already out of the bag.

I love DNS based filtering because it is so easy to circumvent. Even nontechie friends I just tell to enable dns-over-https in FireFox. Welcome back TPB (which is DNS blocked in my country).

I am surprised with such sentiments every time I hear them. How do you envision running a server in EU without complying with the EU laws and obeying the court orders?

There's a significant stretch between "running a server [...] complying with the EU laws" and using DNS to do mass censorship.

Censorship is abhorrent, and mass, government-mandated censorship even moreso. End to end encrypted DNS resolution (via DoH) needs to be widely deployed. Using unencrypted, unauthenticated protocols in 2022 is madness. DNS is closer to Telnet than it is to the modern web.

The thing is there's not exactly one unified EU legislation. You would need to abide by the laws and regulations of the country hosting your server, yes. But that country may have regulations that are incompatible with EU laws: for example France's data retention laws are illegal by EU standards (like many other human-rights-infringing laws in France).

Then of course i can see valid reasons not to obey unjust laws whether that's in Europe or elsewhere.

And the next step is that it is mandatory, and they block all other DNS provisioning.

And who do the brown shirts then go after next?

Yes they won't have to depend on private companies to suppress inconvenient content. You will probably never learn about many things in the future.

> But yeah, it's the sort of thing that it's better done at EU level rather than in 27 different, weak and uncoordinated ways.

Sure, let's give Kaczynski and Orban the keys to censoring LGBT content or regime critical media across the entire EU.

Sarcasm aside: any kind of censorship infrastructure will get abused sooner or later. No matter if it's criminals, trolls, religious fundamentalists (particularly where it concerns LGBT matters, sex work or gambling) or plain old wannabe dictators.

I reckon the opposite will happen - no single government will be able to implement unreasonable censorship, because there will be a higher bar for accepting blocks. Or are you arguing that Orban and Kaczynski have more control in Bruxelles than at home? Because that's definitely not the case; if anything, they are more isolated at European level than they are in their own countries.

Yes because countries like France or Germany have such a better record when it comes to censorship! /s

Germany famously hunted down Indymedia and tor supporters a few years ago, and privacy-friendly ISP Freifunk had to fight its way through constitutional court. France had trials against alleged contributors to self-organized media outlets (from reseaumutu.info federation, more specifically iaata.info instance), had many many films censored (such as Afrique 50 or La bataille d'Alger), and has strong regulations outlawing critiques of police and/or president.

Creating a broader power never results in mitigating power abuse. If anything, it helps it foster by piling on layers of abstraction/bureaucracy which diminish accountability in the long run.

That doesn't sound like good news at all. Anything that makes the internet easier to censor and control is very bad news.

The world's largest bureaucracy (EU) will continue with its bullying of everyone with different opinions. In a worst case scenario, this won't be optional, and they will cancel everyone with different opinions, like Hungary and Poland.

If the opinions are homophobic as they are in case of Hungary, I'm very happy that the EU is "bullying". I wish it would also be the case with the ongoing corruption in Hungary.

What “opinions” do Hungary and Poland hold?

"opinion" is probably the wrong word when we are talking about countries but people in Hungary and Poland seem to favour more nationalistic and conservative politics and have a thing for strong leaders.

It's a bit like California v.s. Alabama situation. Also, not limited to Poland and Hungary, it pans along the West v.s. East, so it's like North vs South in the US.

For example, EU says you have right to bring your partner to EU. Then Denmark says that you can register a long term relationship and have the full rights without a formal marriage, Poland will say that you need to marry.

It also goes beyond the social issues as the strong leaders tend to mangle with the judiciary system to make their ways and EU is really not happy about it. When that happens, the countries get fined and their leaders will bash EU in a similar way like some American politician bash the federal government.

You can check for your self in the username of your parent comment, which includes a racial slur. This specific slur is common in Hungary so make of that what you will when judging the amount of bias in that comment.

On a side note I am not sure if that username complies with HN TOS.

hating on gays, muslims and separation of judiciary from executive are definitely opinions

An opinion is something that can be represented as a proposition about the world. It's the non-factive superclass of a fact: i.e. the structure of a fact, but not requiring/entailing the property of truth. Hatred is not an opinion, it's an emotion.

For more information, have a look at this fantastic Buzzfeed article: https://www.buzzfeed.com/ludwigwittgenstein/fantastic-ways-t...

> everyone with different opinions, like Hungary and Poland

The human rights of LGBT people and refugees or the right to freedom of the press or to a fair trial in front of an independent court are valid EU wide, guaranteed by the contracts that Hungary and Poland signed when they joined the EU.

Opposing these human rights is not an "opinion", it's an assault on the core values that make up the European Union - and the rest of the EU (particularly Germany, given that the former Chancellor's party was a sister party of the Fidesz for a long time!) has stayed silent for far too long.

The entire point of the EU is to form consensus for the betterment of Europe. Different opinions are important but create friction. Agreement, yes sometimes against ones own opinion, is necessary to strengthen the EU. Individuals in an alliance that regularly strive against agreements and consensus are hurting the alliance, hurting Europe.

If consensus is apparently not desired we can go back to the European patchwork where the rules change significantly every 100km and doing trade is 10x harder.

Sadly the UK took that hit for the others, making the disadvantages of leaving very clear. So these guys will continue staying in the tent while pissing inside of it, sadly. But sooner or later a reckoning will happen, either in Europe or in their own countries.

Ah yes, opinions like "promotion of homosexuality or other disorders of sexual behavior" should be punished with up to eight years in prison. (A proposed amendment to the Hungarian constitution.)

Or opinions such as the government take-over of all independent broadcasters in Poland.

I mean, hey, SCOTUS decided in Citizens United that political donations were constitutionally protected expressions of opinion, so all bets are off...

Even if the censorship implications are a bit obvious, it's good that:

- we have more alternatives

- we add to the global network for resilience

- we increase our independence from the USA for something so critical

- we get more control over our little part of the internet in case of a digital attack

Provided we can always switch to an alternative DNS server from inside the EU if we need to, it's a net positive.

> - we get more control over our little part of the internet in case of digital attack

I’d love to hear what people think about this. To me it’s notable that Russia and China have taken steps to separate their internet access from the wider, global network. While the West continues to centralise its network access in the hands of a few companies. Presumably this makes Russia and China more protected from attacks on the global network.

Am I correct in thinking in this way? Could Russia and China continue with internal internets even if the global one went down, or are they actually as at risk as anyone else? I’m guessing that China’s censorship systems and firewalls are fairly centralised and so vulnerable in their own way.

> Presumably this makes Russia and China more protected from attacks on the global network.

Of course. And North Korea is probably more protected against terrorist attacks than most of the "free world". That doesn't mean it's a good trade-off in general.

In practical terms, it depends on what you mean "continue with their internal internets". Most of the points of failure for "internet use as understood by the public", are actually just implementation mistakes by private companies - i.e. nobody says you have to host on (and hence go down with) AWS, or rely on (and hence go down with) Facebook/Google Login.

DNS is distributed (it's in the name!); if rootservers went down there would be hiccups for sure, but they could be fixed. Same for the rest of the fundamental network stack; after all, the internet was built to withstand nuclear attack. Whether it would be a good experience (i.e. slow, private services not working, etc), that's something else. If you're based in China and you rely on FB Login, no amount of governmental infrastructure will help you when FB becomes unreachable.

I’m thinking about fairly close to doomsday scenarios.

If/when we reach a point of extreme tension with tit for tat cyber attacks, would Western countries be totally incapacitated for days or weeks while Russia or China were less impacted? Things like food supply, public services etc.

Perhaps such things would escalate so quickly that the internet would be the least of our worries.

There are books on this sort of things, the topic is vast. From energy supply to commercial food operations, there are a lot of very different situations. This said, I reckon that all-out cyberwar on the scale necessary to impact food supply, would see IRL retaliation too quickly for it to matter. The US military has its own network strategy, its own satellites, etc etc, so they will be ready to pounce.

Pardon my ignorance but in what way are EU citizens dependent on US DNS infrastructure prior to the introduction to this? And how does this infrastructure remove that dependence?

All big public DNS Resolvers are US-based. Google, Cloudflare, OpenDNS(Cisco). Quad9 is Swiss-based, so technicaly not EU-based.

All ISPs in my country run their own recursive resolvers (with IPs resolving to my country). How "big" a resolver is does not matter at all - it's not a social network; the resolver either works or it doesn't work.

Some of the root servers are also in the EU, so there is zero dependence on the USA for resolving european ccTLDs.

There is some level of importance in bigness. All the major public resolvers let nameserver operators (well, anyone, really) clear cached records. Which turns out to be a not-uncommon occurrence. I wrote my own DNS server, so I've been paying a ton of attention to this stuff, and I've found several scenarios where website operators (even, for instance, instagram!) seem to have wanted to change some DNS records but weren't happy with the TTLs they'd advertised on them, and instead of waiting them out, just cleared caches with the major resolvers and then gone ahead and turned off the old IPs.

With the end result that I had to go in and remove those records from my cache, too.

> Some of the root servers are also in the EU, so there is zero dependence on the USA for resolving european ccTLDs.

What percentage of the organizations that run the root servers are non-US? There are thirteen logical root servers ([a-m].root-servers.org):

* https://root-servers.org/

Three (i, k, m) are not run by non-US legal entities: Netnod (SE), RIPE (NL), WIDE (JP).

In every way. The US controls the TLDs and many of the core resolvers.

The US doesn't control the national TLDs nor the .eu TLD in any way. The core resolvers can be replaced at a moment's notice in case of problems.

This doesn’t address the tld issue and does it matter if a lot of people use US authoritative resolvers? Each domain can choose and the protocol isn’t biased towards US controlled infrastructure.

I can see the value in dns as public utility (though one I’d be skeptical about using or paying for) but this doesn’t seem to do what the OP suggests on the US independence front because DNS is already independent.

I’d be a lot more understanding of a public email provider than DNS to promote a break with US infrastructure.

Email would be fun. Beyond the rhetoric, a lot of EU governments are actually quite tyrannical when it comes to intercepting or seizing communications, compared to the US.

There is one problem. If the change in question is related to just having an alternate DNS stucture, that's perfectly fine. Because it doesn't mean users are forced to use it: at any moment, I can force my machine to use any DNS server I choose and it will respect that.

However, if they actually implement URL filtering, it might mean something completely different: that IP addresses of SciHub/Libgen will be blocked by the ISPs in the whole of EU no matter DNS server I use. Not all countries would individually agree to that.

Unless they go full on Great Firewall and block VPNs all they'd achieve is to make VPNs go even more mainstream (and while many adults may still not be used to VPNs, they can ask their kids - most of my sons friends all have VPNs set up for everything from evading region blocks for content to ban evasion from game servers)

I don't know where you're getting that IP-level filtering is the only way to "actually implementing URL filtering" - if they're talking about URL filtering as a feature of a new DNS infrastructure, then the most likely assumption is that they're talking about DNS-level filtering.

My assumption is based on the fact that DNS-based filtering ("of URLs leading to illegal content") simply doesn't work and is trivial to circumvent both by the client and the server, so the countries that block Libgen&co. do so at the ISP level using IP filtering.

It is trivial to circumvent.

And countries and ISPs still do it all the time, because most consumers are not capable of even the trivial step of changing DNS servers. e.g. in the UK blocking is usually just implemented by DNS filter.

The way I read it, the proposal is that ISPs and other providers of recursive resolvers MAY implement "value-added" filtering services. I didn't see anything about some central filtering agency that had the power to force some filter-package into every recursive resolver in the EU.

> Provided we can always switch to an alternative DNS servers from inside the EU if we need too, it's a net positive.

After the past decade why would you think they will allow that?

Why would I think they would not?

No matter how many bad things the EU does (and I'm not blind to them), after traveling all around the world, working in the US, Asia and Africa, it's still the place where I feel the most free.

I trust them much more to not go complete bonkers than Russia, the USA or China.

In fact, the GPRD, the right for repair and the various attacks at tracking are quite to my liking.

I'm not ruling out the possibility they mess it up, but I stay optimist.

Pleasantly surprised to see this degree of nuance in top level comments.

I do find it very alarming that they want to bake in "lawful filtering" and especially alarming that they want to bring in "premium and wholesale services."

In the best case scenario, if EU had a record of reasonable enforcement or ahead-of-the-curve thinking this might be okay, I don't think there's anything suggesting that the EU is thinking ahead or capable of imagining unintended downstream consequences.

I think more DNS is better, which is good, but its balanced with some concern.

> Even if the censorship implications are a bit obvious, it's good that:

LOL, sure, we better at the mercy of the american censorship and 'tracking' system

As long as they remain alternatives, it is okay. But given that this is the EU, it won't be optional for very long.

I don't think there is much prospect of the EU banning me from using my own recursive resolver. And I find it hard to see how they might try to enforce it.

The idea of the internet as public infrastructure is great, but maybe we can keep the decentralization of today? This would put enormous (censoring) power in the hands of government entities.

English version https://hadea.ec.europa.eu/calls-proposals/equipping-backbon...

Good news, except for one thing:

Don't get me wrong, I am a supporter of the EU in general, BUT... The heavy bureaucracy is the main reason for it's slow pace with just about everything. With this in mind, point 12 might put a lot of people in a long deadlock.

I don't necessarily see a problem with it. What it says is "this thing has to follow the law", because such censorship laws already exist across the EU, for better or for worse.

It depends on how this is structured though, this might just as well be an attempt by the entertainment industry to extend their reach in blocking torrent sites. Perhaps that take is a little cynical, but I wouldn't be surprised.

We'll have to see how this develops to be sure. I, for one, welcome a public European DNS resolver, because it allows the resolver to just focus on being a good resolver without relying on some kind of (usually shady) business model.

yep and we are not going to use them because thats how censorship aparatus are getting started.

At some point you accept that the NSA is snooping through my internet history, just because im reminded what the "privacy centered" alternative means.

Let sum this up:

- dont trust the DNS of your ISP - dont trust the ones from google or microsoft either - same goes for other telecom companies - quad9 has been instructed by law to change their dns servers for some entries

which finally lets me have my doubts about cloudflare and co too...

IMHO DNS can not be saved. But hey we might finally have a use case for the blockchain ;)

> blockchain

I agree - DNS is the second best use case for blockchain [1] to money.

[1] https://handshake.org/

The EU is on a roll today with some really drastic changes in such a short span.

what were the others?

Apparently banning Google Analytics (though it seems like keeping data in the US was the problem, not the analytics itself)

That wasn't a change, it was already illegal. Back in 2020 the data exchange with the US was considered illegal, and only recently did a judge speak out against Google Analytics specifically.

This ban also wasn't even by "the EU", it was an Austrian judge following existing EU regulation to rule on a court case.

From Biedermann und die Brandstifter (German) [1] (The Fire Raisers) [2]

   - ... [you gave them] matches?!!
   - why not? Don't you think, if they were really fire raisers, that they would have brought their own matches?
   (laughter)

[1]: https://www.youtube.com/watch?v=jrGmNXjjDNk

[2]: https://en.wikipedia.org/wiki/The_Fire_Raisers_(play)

I am not sure what you want to imply...but isn't it just a governmental alternative? I would guess that the current dns resolvers are in the hands of a few huge, monopolistic companies like google or cloudflare.

Cough. The Great Firewall. Cough.

My knee-jerk reaction is "cookie banners"

Every cookie banner is a middle finger to your privacy. The law says "don't track people without consent" and the data hoarders decided to respond by making your life as difficult as possible.

Most websites don't need cookie banners. They choose to make you suffer through them. Take your anger out on those websites, not on sensible legislation.

The intention was that sites would rather ease up on the cookies than force everyone to agree to them. Didn't really pan out that way

Cookie banners or GDPR consent banners are the embodiment of malicious compliance.

Will this lead to non-US/ICANN managed .com/.net etc TLDs? Or a new TLDs?

It's a DNS resolver, not an authoritative DNS server. So it's similiar to Google's 8.8.8.8, Cloudflare's DNS resolver, or the DNS resolver that is provided to you by your ISP.

Or like the Unbound recursive resolver that I run here. Unless there are moves to mandate the use of the EU resolver network, then there's nothing to freak out about.

Nope, what is described is addition of new DNS servers for EU users with some extra things on top for monitoring and premium services. It's not the intention to create a new parallel/separate internet where new TLDs will exist. Good move from network point of view, good for most users but with a few caveats for more experienced users ;-)

No thanks

The EU got us cookie popups all over the web that you can't even simply answer no to. No thanks.

It got you knowledge and consent. Cookie popups are malicious compliance by shady sites and vendors, especially those that "you can't even simply answer no to". Blame them, not the EU for bringing them to light ( like you'd blame Coca-Cola for the amount of sugar in their sugary drinks and not the regulator that made them show it front and center).

This is correct; the cookie banners are an attempt to annoy the EU into abandoning GDPR. Ain't gonna work - we like GDPR.

Just use a cookie-blocker (e.g. the one built into your browser), along with some kind of popup-dismisser (e.g. Super Agent, https://www.super-agent.com/). If your browser is configured to block cookies (third-party, or whatever kind you don't want), then it doesn't matter if the popup-dismisser auto-clicks "Accept".

The thing that annoys me more is those US local news-services that outright block access from IPs that they think are within the EU. They aren't pitching their content at a EU audience, so they don't care. But if they're already checking where the visitor's IP is, couldn't they just decline to serve cookies? I think they're just ignorant about GDPR.

It's not hard to grok GDPR and comply with it, unless you have a business built around collecting PII.

[Edit] Incidentally, I'm not in the EU, since Brexit. That was two years ago - but I'm still blocked from e.g. LA Times.

Reply on news.ycombinator.com