Hacker News Reader

Comment by rodolphoarruda | Hacker News Reader

Oppressive governments must be thankful to all BigTechs able to consolidate userbase and services around a handful of apps. It makes it really easy to switch things on/off when needed. The original purpose of the Internet as being a resilient p2p network for the people has been completely defeated in some nations.

View on HN

You drastically underestimate power that those oppressive governments have in real world that some fancy decentralized solution would solve. They just take down the internet.

> They just take down the internet.

Or kill a lot of people if they rebel. Which is what Iran did just before the pandemic, and which the media only briefly covered. They machine-gunned people in the streets by the thousands and the West barely batted an eye.

It was as bad as Tiananmen Square in 1989, but you'd never know it going by the media coverage then or since.

The only way to win is the point when police and army joins your side. That's only how those are won.

Of course, Iran has parallel structures with IRGC specifically made for those situation.

Building a resilient p2p service on the internet doesn't just require not using big name SaaS, it means building that service to not need the WebCAs or even DNS, two core services that are anything but p2p. I honestly don't know of any applications that require neither.

You can distribute DNS data over any transport, p2p or not. Ans with DNSSEC, you can trust the contents you get from any transport.

Are you concerned with countries forcefully removing entries? Because there are a lot of other country TLDs where you can add your entries if you want.

Virtually everyone relies on ISP DNS servers, which can trivially bypass DNSSEC (DNSSEC collapses down to a single bit in the header on the last hop from server to stub resolver). If all you're trying to do is resist DNS censorship, you can get almost everything you need from using an out-of-country name and DoH, which is universally available, very much unlike DNSSEC.

DNS without DNSSEC is pretty much vulnerable to the kind of censorship that won't even let you know you are being censored... Any name system without something equivalent to DNSSEC is.

With DNSSEC it is still vulnerable, but only to the kinds that you will know you are being censored, so you can try to get it from another country or another channel.

If your ISP denies DNSSEC for you, you already know you are being attacked, and can get it through some other channel. DoH is a cool channel, just make sure it has DNSSEC.

For the vast majority of DNSSEC-enabled end user systems, the user's device is not doing its own DNSSEC validations. It's using a DNSSEC-enabled resolver and trusting the bit set on the DNS query response where the recursive resolver says "yup, I confirm that DNSSEC is good here". Given that these resolvers are generally provided by the user's ISP, if the ISP wants to lie about DNSSEC, they can just fudge the results and set that bit to "yup, we're good".

The only way around this is for local systems to do their own recursive resolution, which isn't the default configuration on any OS or distribution that I'm aware of.

Honestly, this is something I shouldn't have to say. But getting a DNS response with a flag saying "yep, trust me, it's valid" is not DNSSEC.

What is it with DNSSEC that people have to pollute discussions saying that stupid stuff that isn't DNSSEC isn't secure?

Are there any operating systems or distributions that actually ship with DNSSEC validation via local recursive resolution?

The reason I'm describing local stub resolvers that check the dnssec bit of their upstream recursive resolver is because that's how DNSSEC is implemented in every OS/distro I'm aware of. So that configuration is what actually matters when we talk about users being protected (or not) by DNSSEC.

It's an interesting flavor of "No True Scotsman" when you've managed to argue that every resolver on every OS in the world is "stupid stuff that isn't DNSSEC". If DNSSEC only works if you're using a custom fully-recursing resolver, not present on any mainstream operating system or built into a single piece of software you install on your machine, what exactly is the point of signing a zone? So far as you're concerned, nothing is doing DNSSEC validation in the first place.

DNSSEC has a very clear specification a few widespread implementations. What you are talking about fit to those?

Are you really making FUD about it, by claiming unrelated logical fallacies in a non-boolean discussion? How does a "no true Scotsman" even applies to something that has a published standard?

I know you don't like it, yet, I have never seen any proposal that brings you the assurances DNSSEC brings. AFAIK, your favorites all wither solve different problems (relevant problems, yes, but not the same) or have strictly lower assurances (AKA, they are subject to the exact same flaws, and are either worse or not better of for each one of them).

It feels like you're not as familiar with the spec as you think you are.

DNSSEC defines stub resolvers, both validating and non-validating. Validating stub resolvers do their own supplemental recursive lookups to confirm DNSSEC validation. Non-validating stub resolvers do not: they strictly determine DNSSEC trust by checking for the "ad" header bit in the response from their upstream recursive resolver.

Every operating system, Linux distribution, and application that I'm aware of defaults to having a non-validating stub resolver (if it enables DNSSEC validation at all). This renders DNSSEC validation as performed by the overwhelming majority of systems vulnerable to the risk we're flagging here.

Until the ISP or government just blocks all the popular DNS servers by IP.....

That's pretty tough to do, since any IP can run a DoH cache.

True but in practice developers are not that creative (yet) and there are even people who are regularly creating and updating lists with all of these IPs. I manually entered them but you can also run a firewall on your mobile devices (android) as well and combined with a opnsense / pfsense at home you are pretty much set. There may come a day when a provider starts to generate tons of different DoH providers on the fly but I do not think we have seen that yet.

Probably I should figure out a way to have my pfsense box though dynamically generate the blocked IP's based on one of these dynamically updated lists...

Jami and Tox should mostly qualify, I believe. The hard part is bootstrapping the discovery network, I don't know if there is a true p2p way for that.

You have to make a connection to something to get anywhere, that's how the net works

Wouldnt any service that could be used by just manually entering IP addresses be workable? No DNS involved.

It's not like ordinary people were running their own mail servers or other p2p tech in the pre-Big-Tech days, nor would it have been considerably harder for the government to disrupt email traffic than it is for them to block Facebook/etc. This isn't a pro-Big-Tech or pro-centralization message, only that we never actually lived in a golden age of ubiquitous decentralized communication that was robust against state actor censorship.

this just sounds like whataboutism and is skirting the issue. there is an enormous amount of censorship power within BigTech right now. given the “value” their core businesses provide, which is funded by manipulating your attention to get ad impressions, they should be broken up. why does facebook get to run whatsapp when it’s an ad business?

Not really that distributed given that everything is controlled by 'hubs/isps' which are within arms reach for any government within their borders.

The internet was built for fail-over to maintain communicatoin during a nuclear event.

The internet is less concerned about being a p2p network, which it clearly is not. A totally ad-hoc p2p network would be interesting, and more resiliant in some ways and lossy in others. It probably makes sense to entertain such a model. They aren't mutually exclusive.

Totally agree with you though. It's a big problem with the _increased amount of centralization_ in traffic flow / routing. That and BGP is wack.

To me, the idea of shutting down Internet via ISPs or international backbones is similar to blowing up your own house with TNT when a robber breaks into it. You stop the robbery, but your family pays the price as well.

Shutting down the Internet will disrupt not only people's communications but also systems' communications at various levels, including the systems of interest of the oppressive, of his/her family or political allies.

It would be so much easier and safer to the group in power to just "maneuver" bigtech instead. I remember when Facebook's general manager in the country I live was arrested[1], then blackmailed, to provide authorities means for them to access WhatsApp messages without confiscating the actual phones. Fast forward today, they are confiscating phones whenever they feel like reading private messages from anyone[2].

I liked how other folks reacted to my original comment posting their technical view. I didn't know DNS was such a weak link and a clear point of failure to the Internet. I wonder if protocols like BitTorrent could survive DNS restrictions, allowing people to communicate via shared text files thrown within a folder. My guess is that since it has survived the copyright crisis back then, it could be used for other crisis as well. Frankly, I'm just suspecting.

[1] https://jornaldebrasilia.com.br/noticias/brasil/executivo-do... [2] https://jc.ne10.uol.com.br/colunas/jamildo/2022/08/15065135-...

Yeah. People love the convenience of Big Tech and never think about the abuses their enable. Even if someone built a perfectly resilient uncensorable mesh network and E2E encrypted messaging service, what is the point if nobody uses it?

That includes our own government in US. If you have not noticed, there has been a constant pestering from Congress to censor big tech and “severe consequences” otherwise. And not to say the clear as daylight funding they provide to people in power as part of the lobbying effort. Oh and the same people in media and big tech then decide what is misinformation and not.

Reply on news.ycombinator.com