Comment by thebigshane | Hacker News Reader

Comment by thebigshane | Hacker News Reader

Parent Full thread

I've read the bill at least twice now and I still don't see the doomsday scenario described many times here on HN.

I get the slippery-slope argument, that SOPA is just one step closer to true censorship and control over the internet, but I don't think that is enough to get so upset about (its a very small step, with obvious workarounds)

Somebody please point out to me:

1) Where it says that Youtube, Facebook, Google are affected by this bill. -- It looks to me like it only affects sites on foreign domains or foreign servers. They explicitly say that these popular sites are not affected.

2) Where it says that ISP's, hosting companies, domain registrars or even sites focused on user-generated content are required to actively monitor their data and their customers' data for infringing content and are held liable if they fail to monitor. -- It appears to me that the bill specifically says they DON'T have to do this; that they only have to make reasonable attempts at prevention and then are required to take data down when given a take-down request.

3) How tor would be made illegal under this bill. -- It looks like only tools designed or marketed for the primary purpose of circumventing this bill are made illegal. That means DeSOPA and MAFIAAfire, but tor seems to be out of reach.

Back on topic of the article, perhaps there isn't a conspiracy here, perhaps media outlets genuinely don't see what the big deal is.

I agree that the bill is mostly useless and mostly supported by an aging industry, and I don't support it. But I don't see the big deal either. So, somebody please enlighten me because the sensational fog is obstructing my view.

SOPA doesn't require sites to monitor their users. The complaints I've heard:

1. It requires sites to be removed from DNS if a copyright complaint is made against them. Specifically, the removal avoids due process. The copyright holder doesn't need a court order to have the offending site taken down.

2. Sites are held responsible for content their users upload. So e.g. Mediafire would be taken down because of content the users uploaded.

Regarding your #1: My interpretation (which may very well be wrong of course, IANAL), is that the copyright holder DOES need either a court order or Attorney General intervention to remove a site from DNS.

Regarding your #2: Again, my interpretation is that this only applies to foreign sites (either foreign domains or foreign servers)

I wouldn't use "there isn't enough due process" to describe why SOPA is a terrible bill, or any similar legal argument. Besides, many of those problems have been fixed in the Manager's amendment.

DNS blacklisting as a concept is simply unacceptable. The way it is applied in SOPA requires that a certain classification of DNS caching servers must pretend like a website does not exist, which reduces trust in domestic caching servers and stifles DNSSEC.

If people move to foreign DNS (or local caching servers), which is incredibly easy, the entire thing is circumvented. But a tricky side-effect takes place: the system is now balkanized. Servers in the U.S. believe the naming system to resolve to one IP, and servers everywhere else resolve to something completely different.

This balkanizing effect can break the effectiveness of CDNs, can congest Internet traffic, and overall reduces the credibility of the naming system. Passing SOPA would mean other countries would follow in the same footsteps. Once every country believes the delegation chain can resolve to whatever they want to, what is the point in an international naming system?

These are only some of the problems with DNS blacklisting -- nevermind the security problems -- which are not worth it especially considering it is so easily circumvented.

Additional problems with the bill, such as the vague wording which may consider Tor a tool for "circumventing" DNS blacklists and, therefore, illegal, demonstrate a huge lack of forward thinking and an unsustainable approach to copyright enforcement.

The doomsday scenario is that government sticks its foot in Internet policy and communication and pretends it actually has the reasonable capability to prevent piracy. It will never have that capability without large-scale violations of privacy.

There are also a good amount of talks regarding the precedent SOPA may have for general purpose computing and a whole host of other sensitive topics. I don't think it's responsible to just point at provisions in the bill and say "well it seems to add enough oversight".

Besides, the bill encourages preemptive takedowns by providing immunity. The tech industry behaviors that will result would be devastating.

I think you have great points but I don't believe they sufficiently support the doomsday freak-out I'm witnessing.

DNS blacklisting is already happening in the US and all over the world (ICE: http://en.wikipedia.org/wiki/U.S._Immigration_and_Customs_En... and DNSBL: http://en.wikipedia.org/wiki/DNSBL). I admit we are already on a slippery slope here with blacklisting, but I think most of your DNS comments could be attributed to failures in the design of DNS (and CDNs) themselves. If you want trust, security, and prevention from censorship (as I do too), DNS is not your answer. I hope namecoin better address these issues (https://en.bitcoin.it/wiki/Namecoin).

If you are scared of censorship, don't rely on infrastructure that is owned by parties you don't trust.

SOPA supporters must know this will not stop piracy (the bill is contradictorily named, I know), but surely, it would minimize the piracy and counterfeiting that effects the non-tech-savvy American masses. And I truly believe that is their intent.

Personally, I don't think we should be legislating the Internet at all, but we've already started, and although future legislation on this slippery slope could be devastating, this bill seems to be fairly neutered. Good issues are being brought up with the discussion of SOPA, but SOPA itself is not the end of the internet.

Couldn't be more wrong, sorry.

The ICE seizures are perfectly fine because they target the delegation chain directly -- they are actually seizing the domain from a registrar or TLD authority with control over it within the chain. They are not a DNS blacklist and it does not interfere with caching servers.

SOPA attempts to target names which are not within U.S. jurisdiction by asking caching servers maintained by ISPs to refuse resolution of names where the delegation chain does not cede authority to entities within U.S. jurisdiction. This is an unprecedented technique for censoring content online.

DNSBL is absolutely not what you think it is, I'd recommend reading that wikipedia article more carefully. It is a voluntary blacklist which is implemented by IRC servers and mail software, but does not force cache servers to resolve names differently or anything close to what you're suggesting. It's just a list of names "you shouldn't trust" but not a censorship/redirection system.

There are no design flaws in the way CDNs work either, I don't know where you're getting that. SOPA harms CDNs by removing the efficiency achieved through geotargetted name resolution (something provided by caching servers).

The ICE seizures are perfectly fine...

I wouldn't say perfectly fine... They're less objectionable than SOPA because they have some semblance of a claim to legality under current law, but I hardly think they're a model of how the Internet should be policed (or that the Internet as a whole even needs policing). Many, many subdomains were seized by ICE that were completely innocent, and there was still a lack of due process (see the rojadirecta.com case, where a site that is legal in its home country had its domain taken, then returned without explanation a year later).

I didn't realize the process used by ICE was different than what SOPA suggests, but that makes sense now that you've explained it.

I don't understand how DNSBL is different though for the end user. I realize DNSBL is voluntary and SOPA would mandate/force, but I don't see how the effects are different. For a DNS server that uses a DNSBL, does it regard a blacklisted domain name through DNSBL differently than one that blacklisted through SOPA?

Regarding CDNs, for a user initiating request for a non-blacklisted site, why would the CDN be now less efficient in its response?

I have no idea if there is a design flaw in DNS or CDNs. My point is that if DNS and CDNs become drastically inefficient by having to ignore certain names, then it sounds like it could have been designed better to handle such cases.

> I realize DNSBL is voluntary and SOPA would mandate/force, but I don't see how the effects are different. For a DNS server

Bam, stop right there. DNS servers do not use DNSBL. There's your answer.

DNSBL is used in circumstances like this: You're connecting to an IRC server. It does some tests to make sure you're not spoofing your host, like using reverse DNS (PTR records). IRC servers will also try to prevent spammers and flooders by denying access to hosts that are in a DNSBL -- likely open proxies.

Here's some IRC software which does specifically that: http://www.blitzed.org/proxy/

I am running some mail servers which are having trouble delivering mail to gmail right now. gmail is returning back this error:

    The IP you're using to send mail is not authorized to
    send email directly to our servers. Please use the SMTP relay your
    service provider instead.

Turns out, it's because the IPs I've been allocated are in Spamhaus, which is an implementation of DNSBL that specifically targets spammers.

Again, this is an action by the server software itself. It is not a mandate, and is not actually a restriction on DNS. It is nothing like blacklisting cache servers. The name has confused you.

> Regarding CDNs, for a user initiating request for a non-blacklisted site, why would the CDN be now less efficient in its response?

If you're trying to access Google, their nameservers may give your ISP's caching servers a different resolution if you're in California rather than in the UK, usually to resolve to closer servers. This is only effective because nameservers can target cache servers which are specific to geographic areas, and is a great side-effect of the current structure of the naming system and of the Internet.

By forcing people away from domestic nameservers, this targeted effect fails. A foreign cache server will return inefficient resolutions to queries compared to a domestic one operated by an ISP.

Aside from being terrible for the end user, it also begins to put stress and congest different areas of the global Internet unexpectedly. Though arrangements can be made to compensate, it's pretty annoying and will never be as efficient as before.

> My point is that if DNS and CDNs become drastically inefficient by having to ignore certain names, then it sounds like it could have been designed better to handle such cases.

The only real "design flaw" in DNS is the inflated trust in cache servers. DNSSEC tries to resolve this by attaching a chain of authentication alongside the delegation chain which can be verified. SOPA breaks DNSSEC entirely because it cannot return these authenticated messages (it is resolving incorrectly or lying about the delegation chain).

DNS was not designed to be censored in the way proposed by SOPA; it is not a design flaw in SOPA, it's a flaw in the legislation.

This is a fantastic response and I'm glad you took the time to write it. I'm sorry I misinterpreted DNSBL, I guess I read "either as a zone file that can be used by DNS server software" and assumed they meant the main DNS servers really do use them.

Final question for you: Do you believe that if SOPA passes, it would really have drastic effects to the internet functionally? So, besides censorship and liability, do you think there would be a noticeable difference for tech-savvy internet users and website operators in regards to things you mentioned above (or perhaps haven't mentioned yet)?

> Do you believe that if SOPA passes, it would really have drastic effects to the internet functionally?

Yes. Things would have to shift around the compensate, but the real problem begins when SOPA justifies similar legislation in other countries, especially ones being bound by trade agreements which call for this type of stuff.

In the U.S. they claim "oh, but we're just going to target people who violate the law. You know, copyright infringement." Even if that were true, other countries have a long history of applying their laws, which usually suck and go much further to stifle speech.

SOPA legitimizes this method of blacklisting, thus leading to a balkanization of the naming system. People begin to move away from the cache servers, causing slowdowns in resolution and CDNs. Once this proves ineffective, the U.S. will want to censor any DNS server that resolves an IP to something they don't want. Then we have deep packet inspection.

It really will not end unless we force it to end. SOPA takes a drastic step that even the DMCA didn't do. DMCA targeted activities under U.S. jurisdiction. The next chapter in the global censorship game is the attack on websites outside jurisdiction, which is not feasible without immense privacy encroachments.

I don't want to see us going down that path. We need to go the complete opposite direction when it comes to copyright. SOPA also places way too much of a legal and logistical burden on companies within the U.S., which is going to lead a lot of people toward countries with progressive outlooks on copyright, like in some places in Europe.

"Regarding your #2: Again, my interpretation is that this only applies to foreign sites (either foreign domains or foreign servers)"

And foreign sites aren't important?

I didn't mean to imply they weren't.

But I guarantee that the issue wouldn't be making such a splash on tech-savvy sites if everyone knew that only foreign sites (whose primary purpose is infringement) were affected and that the only effects to those sites are that they are removed from US DNS systems and US advertising funding.

> if everyone knew that only foreign sites (whose primary purpose is infringement)

I'm sorry, but this reeks of complete ignorance. I don't think you're qualified to argue for SOPA.

Well, then please point out the flaw(s) in my logic, we're all adults here right?

Useful foreign sites? BBC accepts user comments in some areas, someone posts copyrigh material to one of them and a court order is issued before a BBC mod takes it down? If a DNS block is made then, how long will it last, and how many people would it reach anyway?

Luckily, the BBC would not fall under this definition:

   the site is primarily designed or 
   operated for the purpose of, has only lim-
   ited purpose or use other than, or is mar-
   keted by its operator or another acting in 
   concert with that operator primarily for 
   use in, offering goods or services in viola-
   tion of— [...some existing laws...]

But the problem with SOPA is that the determination of whether a site is "primarily designed" for copyright infringement is subjective, and a determination made entirely by the party alleging copyright infringement. In theory people using DMCA takedown notices now are only supposed to use them for cases that are really copyright infringement, aka aren't subject to Fair Use or such - or has a legal right to use that song. In practice, copyright holders use automated systems that make no attempt to gauge whether or not some YouTube video or whathaveyou is actually infringing, but just issue a take down request for anything their automated systems find matches a pattern in their database closely enough, with sometimes hilarious results.

I expect that at least one major copyright holder will use a similar system with SOPA, since there seems to be even less theoretical penalty for doing so than with the DMCA. So yes, I expect that the BBC might very well be blacklisted just because one used posts a link to infringing material. And then it will stay blacklisted until maybe the slow wheels of human review come to the consensus that it was indeed an error, and fix it.

Imagine if Dropbox were a non-US company. That section you just argued could be easily misused to block that site. After all, you can share your files on as many computers as you want. Clearly it will all be music and movies. People that want Dropbox taken down only need one or ten examples. In a popular enough website, it would be easy to find some example people that have broken the ToS and uploaded copyrighted conent onto it and shared it with their friends. They could even plant those people!

Oh, but they broke the ToS, that means they're not following what the web site's purpose is? Well, now maligned websites just need to have a ToS that says "don't do bad stuff", and they're fine!

See where I'm going with this?

I realize that laws can be twisted by clever lawyers but I still think its quite a stretch to claim that a Dropbox-like site could be said to have its primary purpose be infringing copyrights.

For one thing, those files aren't publicly available by default. If they are publicly available, then the Dropbox team is probably already monitoring those files. If they are not monitoring those files then (this part is controversial...) maybe they should be investigated for copyright infringement, as long as they maintain due process.

> If they are publicly available, then the Dropbox team is probably already monitoring those files.

I doubt that they are. Copyright is a matter of permission. How would any third party know who has permission to do what?

But, should the entire website be taken out of a dns just because one/ten people using the website are using it in an illegal way? That's what SOPA will do, and that's why it's bad.

Due process is good :)

It sounds like it is trying to make laws fuzzy, because you can't make it outright unbalanced to the copyright owners, but the same owners are lobbying for more law in their favour. Laws have been declined or overturned for being fuzzy, I hope this is the true legal kind of fuzzy.

You're justifying it as not having too much of a "splash" because it targets foreign websites which you claim are primarily for copyright infringement. That's just not true at all. Most foreign websites are perfectly legitimate.

Ah I see how you misinterpreted me there: I meant a certain subset of foreign sites that were not legitimate.

I can't speak to your points 2 or 3, but section 103 (which governs ad and payment processors) applies to domestic sites as well. If I've understood correctly, Youtube couldn't be blocked, but could be forbidden to host advertisements - which would kill it just as surely.

Well, it is definitely ambiguous, but it looks like section 103 does apply to domestic sites.

However, they do focus on a particular class of sites:

   U.S.-directed site is primarily designed or operated for 
   the purpose of, has only limited purpose or use other 
   than, or is marketed by its operator or another acting 
   in concert with that operator for use in, offering goods 
   or services in a manner that engages in, enables, or 
   facilitates, a violation of [...some existing laws...]

While, I admit that is also a bit ambiguous, it would be rather easy for a lawyer to claim YouTube has a purpose beyond offering infringing or counterfeit content.

EDIT: The Manager's Amendment further clarifies this section as follows:

   the site is primarily designed or 
   operated for the purpose of, has only lim-
   ited purpose or use other than, or is mar-
   keted by its operator or another acting in 
   concert with that operator primarily for 
   use in, offering goods or services in viola-
   tion of— [...some existing laws...]

But it would be even easier for an opposing lawyer to claim that YouTube "is marketed by its operator … in a manner that engages in, enables, or facilitates, a violation of [...some existing laws...]." Any site that allows users to submit content is predictably enabling a violation of copyright law. This is how the copyright cartel already views things — it seems unlikely that they would become more conservative if SOPA passes.

After re-reading the Manager's Amendment, I think that quote is no longer applicative. It looks like allowing user generated/submitted content is no longer enough under SOPA.

However, it's a good thing that language was removed! So perhaps, this is an example of the benefit of the outrage over this bill. But at what point do we look back and decide that the changes are sufficient and stop the mob?

Decide the changes are sufficient? That seems to assume there's some basic core of SOPA that we agree is good. I'm not sure a lot of people really believe SOPA has a good core. There might be good intentions behind it from some parties, but it seems like if you get rid of all the harmful parts, you still aren't left with anything good. You need to establish that the bill is necessary and beneficial, not just that it isn't completely radioactively harmful.

Also, even if SOPA is defeated or rendered toothless, the AAs will just keep trying to ram their insane demands through Congress. Our representatives need to really understand that the cartel lobbyists don't represent the will of the people, and we won't accomplish that by shrugging and saying, "Eh, good enough."

I think most people believe that their intentions of stopping the real rogue sites (like those russian sites that sell mp3s for 10 cents each and stopping sites that peddle counterfeit, and sometimes dangerous goods) are good.

Personally, I'm not sure what to believe; I think some probably have good intentions but I don't trust the MPAA/RIAA at all and there's enough money moving around to be very skeptical of the rest. I think the parts of the bill that target the "counterfeit goods" sites are probably necessary, but as `dissident` points out, its possible that the consequences to DNS and CDNs outweigh the benefits (but Im not convinced yet :)

Regarding your second point, that is what I was getting at earlier in this thread: that as long as we rely on DNS, there will always be an opportunity for censorship. The tech-savvy need to start looking into `namecoin` and other DNS alternatives if we want to guarantee freedom.

...is marketed by...another acting in concert with that operator...

Without a contrary definition of "in concert," I could see that as covering any site with an affiliate program. For example, Amazon provides automated revenue sharing for inbound affiliate links. Let's say some third-party affiliate site markets Amazon as an ideal venue for "engag[ing] in, enabl[ing], or facilitat[ing], violation of [...some existing laws...]". Under the wording of what you just posted, Amazon would now be subject to DNS blacklisting and termination of payment processing.

"They'd never shut down Amazon," you say? Well, so what? They would shut down some smaller Amazon-like site. History has shown that the RIAA and MPAA (and/or their members) will do whatever they can get away with, and sometimes more (see Megaupload+Universal). AIUI, SOPA gives legal force to mere accusations coming from a major copyright holder.

Reply on news.ycombinator.com