Hacker News Reader

Hacker News

Comment by BiteCode_dev | Hacker News Reader

Parent Full thread

BiteCode_dev

Even if the censorship implications are a bit obvious, it's good that:

- we have more alternatives

- we add to the global network for resilience

- we increase our independence from the USA for something so critical

- we get more control over our little part of the internet in case of a digital attack

Provided we can always switch to an alternative DNS server from inside the EU if we need to, it's a net positive.

View on HN

> - we get more control over our little part of the internet in case of digital attack

I’d love to hear what people think about this. To me it’s notable that Russia and China have taken steps to separate their internet access from the wider, global network. While the West continues to centralise its network access in the hands of a few companies. Presumably this makes Russia and China more protected from attacks on the global network.

Am I correct in thinking in this way? Could Russia and China continue with internal internets even if the global one went down, or are they actually as at risk as anyone else? I’m guessing that China’s censorship systems and firewalls are fairly centralised and so vulnerable in their own way.

> Presumably this makes Russia and China more protected from attacks on the global network.

Of course. And North Korea is probably more protected against terrorist attacks than most of the "free world". That doesn't mean it's a good trade-off in general.

In practical terms, it depends on what you mean "continue with their internal internets". Most of the points of failure for "internet use as understood by the public", are actually just implementation mistakes by private companies - i.e. nobody says you have to host on (and hence go down with) AWS, or rely on (and hence go down with) Facebook/Google Login.

DNS is distributed (it's in the name!); if rootservers went down there would be hiccups for sure, but they could be fixed. Same for the rest of the fundamental network stack; after all, the internet was built to withstand nuclear attack. Whether it would be a good experience (i.e. slow, private services not working, etc), that's something else. If you're based in China and you rely on FB Login, no amount of governmental infrastructure will help you when FB becomes unreachable.

I’m thinking about fairly close to doomsday scenarios.

If/when we reach a point of extreme tension with tit for tat cyber attacks, would Western countries be totally incapacitated for days or weeks while Russia or China were less impacted? Things like food supply, public services etc.

Perhaps such things would escalate so quickly that the internet would be the least of our worries.

There are books on this sort of things, the topic is vast. From energy supply to commercial food operations, there are a lot of very different situations. This said, I reckon that all-out cyberwar on the scale necessary to impact food supply, would see IRL retaliation too quickly for it to matter. The US military has its own network strategy, its own satellites, etc etc, so they will be ready to pounce.

Pardon my ignorance but in what way are EU citizens dependent on US DNS infrastructure prior to the introduction to this? And how does this infrastructure remove that dependence?

All big public DNS Resolvers are US-based. Google, Cloudflare, OpenDNS(Cisco). Quad9 is Swiss-based, so technicaly not EU-based.

All ISPs in my country run their own recursive resolvers (with IPs resolving to my country). How "big" a resolver is does not matter at all - it's not a social network; the resolver either works or it doesn't work.

Some of the root servers are also in the EU, so there is zero dependence on the USA for resolving european ccTLDs.

There is some level of importance in bigness. All the major public resolvers let nameserver operators (well, anyone, really) clear cached records. Which turns out to be a not-uncommon occurrence. I wrote my own DNS server, so I've been paying a ton of attention to this stuff, and I've found several scenarios where website operators (even, for instance, instagram!) seem to have wanted to change some DNS records but weren't happy with the TTLs they'd advertised on them, and instead of waiting them out, just cleared caches with the major resolvers and then gone ahead and turned off the old IPs.

With the end result that I had to go in and remove those records from my cache, too.

> Some of the root servers are also in the EU, so there is zero dependence on the USA for resolving european ccTLDs.

What percentage of the organizations that run the root servers are non-US? There are thirteen logical root servers ([a-m].root-servers.org):

* https://root-servers.org/

Three (i, k, m) are not run by non-US legal entities: Netnod (SE), RIPE (NL), WIDE (JP).

In every way. The US controls the TLDs and many of the core resolvers.

The US doesn't control the national TLDs nor the .eu TLD in any way. The core resolvers can be replaced at a moment's notice in case of problems.

This doesn’t address the tld issue and does it matter if a lot of people use US authoritative resolvers? Each domain can choose and the protocol isn’t biased towards US controlled infrastructure.

I can see the value in dns as public utility (though one I’d be skeptical about using or paying for) but this doesn’t seem to do what the OP suggests on the US independence front because DNS is already independent.

I’d be a lot more understanding of a public email provider than DNS to promote a break with US infrastructure.

Email would be fun. Beyond the rhetoric, a lot of EU governments are actually quite tyrannical when it comes to intercepting or seizing communications, compared to the US.

There is one problem. If the change in question is related to just having an alternate DNS stucture, that's perfectly fine. Because it doesn't mean users are forced to use it: at any moment, I can force my machine to use any DNS server I choose and it will respect that.

However, if they actually implement URL filtering, it might mean something completely different: that IP addresses of SciHub/Libgen will be blocked by the ISPs in the whole of EU no matter DNS server I use. Not all countries would individually agree to that.

Unless they go full on Great Firewall and block VPNs all they'd achieve is to make VPNs go even more mainstream (and while many adults may still not be used to VPNs, they can ask their kids - most of my sons friends all have VPNs set up for everything from evading region blocks for content to ban evasion from game servers)

I don't know where you're getting that IP-level filtering is the only way to "actually implementing URL filtering" - if they're talking about URL filtering as a feature of a new DNS infrastructure, then the most likely assumption is that they're talking about DNS-level filtering.

My assumption is based on the fact that DNS-based filtering ("of URLs leading to illegal content") simply doesn't work and is trivial to circumvent both by the client and the server, so the countries that block Libgen&co. do so at the ISP level using IP filtering.

It is trivial to circumvent.

And countries and ISPs still do it all the time, because most consumers are not capable of even the trivial step of changing DNS servers. e.g. in the UK blocking is usually just implemented by DNS filter.

The way I read it, the proposal is that ISPs and other providers of recursive resolvers MAY implement "value-added" filtering services. I didn't see anything about some central filtering agency that had the power to force some filter-package into every recursive resolver in the EU.

> Provided we can always switch to an alternative DNS servers from inside the EU if we need too, it's a net positive.

After the past decade why would you think they will allow that?

Why would I think they would not?

No matter how many bad things the EU does (and I'm not blind to them), after traveling all around the world, working in the US, Asia and Africa, it's still the place where I feel the most free.

I trust them much more to not go complete bonkers than Russia, the USA or China.

In fact, the GPRD, the right for repair and the various attacks at tracking are quite to my liking.

I'm not ruling out the possibility they mess it up, but I stay optimist.

Pleasantly surprised to see this degree of nuance in top level comments.

I do find it very alarming that they want to bake in "lawful filtering" and especially alarming that they want to bring in "premium and wholesale services."

In the best case scenario, if EU had a record of reasonable enforcement or ahead-of-the-curve thinking this might be okay, I don't think there's anything suggesting that the EU is thinking ahead or capable of imagining unintended downstream consequences.

I think more DNS is better, which is good, but its balanced with some concern.

> Even if the censorship implications are a bit obvious, it's good that:

LOL, sure, we better at the mercy of the american censorship and 'tracking' system

As long as they remain alternatives, it is okay. But given that this is the EU, it won't be optional for very long.

I don't think there is much prospect of the EU banning me from using my own recursive resolver. And I find it hard to see how they might try to enforce it.

Reply on news.ycombinator.com