Hacker News Reader

Comment by hsbauauvhabzb | Hacker News Reader

I live in a country that has also blocked piracy but at the DNS level (Australia, not Austria).

I suspect that most anti piracy groups are now moving to long game by increasing the difficulty in getting to piracy websites rather than blocking them. I remember significantly more seeds on popular torrents in 2014 compared to now. I think this is a mix of streaming services as well as complexity of piracy.

I do take solice in the fact that piracy will act as a disruptor in unruly markets. Advertisement breaks in streaming platforms, increased cost per service or service fragmentation and other user hostile activities will increase the rate of piracy, creating a balance between good and unscrupulous.

View on HN

> but at the DNS level

Isn't this a bit like taking the phone numbers out of the phone book? Sure, people can't easily look them up, but if you know the right numbers, you don't need that.

Or is there more than that?

Several ISP have appliances that can inspect DNS traffic and redirect to a the ISP DNS. Then, even if you change DNS servers, you will be not able to reach blocked sites. The only way to bypass that, at the moment is to use DoH.

Source: I have been worked for an ISP and I was in charge of that.

My mother's cable provider, Optimum Cable, routes DNS traffic to their own DNS servers.

To make matters worse, they engage in gratuitous blocking; for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...). For example, 192.168.1.1.nip.io won't resolve on my mom's network, but will almost everywhere else.

The solution, as another poster pointed out, was to use DNS-over-TLS.

> for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...)

That's called "DNS rebinding protection", and it's meant to protect against DNS rebind attacks (https://en.wikipedia.org/wiki/DNS_rebinding).

I found the following article to be very helpful when troubleshooting and bypassing that practice:

  https://help.dnsfilter.com/hc/en-us/articles/1500008110182-transparent-proxying

It's also good to know that many newer browsers aren't affected since they've started to enable DoH out of the box (at least that's what firefox has done).

Anyway, other programs on your system may be affected too so addressing the issue at the system level is also important.

Dns over TLS has been a life saver due to this shit. I’ve my modem exposing its own dns server but using a dns over tls upstream instead of my ISP. Works perfectly.

There was some real shit going on with some Indonesian ISPs downright blocking connections to known public DNS resolvers (8.8.8.8, 1.1.1.1, etc). Dangerously close to the China-level firewalls that block known VPNs as well.

> Then, even if you change DNS servers, you will be not able to reach blocked sites.

Is this done simply by intercepting UDP port 53 requests somehow? I've only ever had to intercept https as part of development, but have no idea how this would work for UDP. Any details you can share?

Yep that’s exactly how it works. Not all ISPs actively intercept and reply to your queries, but the rest still monitor all port 53 traffic and log your queries.

Naturally, a lot of HNers hate encrypted DoH which solves both the active MITM and passive monitoring problems. Example: https://news.ycombinator.com/item?id=25344358

It’s 100% not true that all ISPs monitor DNS packets.

I’ve worked for several who didn’t. Of course all have the ability to do just that so as a user you can’t tell. If you’re in the EU they can’t sell that data at least.

We just prefer the small local ISP monitoring our queries to Google and Cloudflare doing so, as the ISP does not learn a lot more than already at hand - they know the IPs I connect to anyway.

Simply direct all outbound DNS traffic to your own DNS server. You could do the same for your LAN by adding a port forward rule in your router (for LAN, not for WAN like you usually would to get incoming traffic around NAT)

Could I not just put the IP address in my url bar? Or do browsers go through DNS with that anyway?

That usually won't work. If a site uses SNI and has many sites behind a single IP (like cloudflare, for example), the server won't know which host's content to respond with.

If it isn't a shared IP, your own browser will block it because of a cert mismatch.

The best way to do this is to update your own /etc/hosts file to point the domain at the correct IP.

Dns blocking is exactly like that. I don't live australia, but if I go to the piratebay for example with my isp dns I get a message it's blocked. If I change to google or cloudflare dns it works just fine

Yeah no one really cares that it's not super effective in Australia though.

the courts order blocks, the ISPs block it at dns because it's cheap and easy and pirates are either scared off by the warning message or just use Google dns

It's good enough and mostly non disruptive

It's supposed to be a measure against technically non-savy people. It might work since a lot of people are not aware of DNS.

Reply on news.ycombinator.com