bwoodcock

That's the assertion Sony makes, but that doesn't actually make it true. Quad9 doesn't do any blocking, Quad9 relies entirely upon third-party expert malware analysts to define the blocks. Quad9 only decides what _not_ to block. Also, Quad9 blocks the same malware and phishing everywhere, because we don't know who or where users are. So Sony asserts that this is possible, but they certainly don't demonstrate how it could be done, much less who would pay for it.

No, that doesn't work. If anybody could say what should happen globally, and nobody would argue about it, then we wouldn't need courts and borders. The whole point of courts and borders and jurisdictions is to resolve disputes. We wouldn't have copyright law if there weren't copyright disputes. So you can't just say "if any court anywhere decides something, it should apply globally." Because the next court over, in the next jurisdiction, can rule the opposite way. What then?

That's not the point here. The music companies all know that they make way more money on music that gets pirated than music that doesn't; lots of studies have borne that out. The point of this ruling is that it lets them extract money from people who DON'T have a relationship with an infringing party. The neighbor of the kid who downloaded the torrent.

No, actually, that was where things stood BEFORE this injunction. The phone company is an intermediary party, with a relationship to at least one of the parties to an alleged infringement. The whole point of this injunction is that it applies to us as a party with NO relationship to the alleged infringing parties. It relies upon a German law that says that uninvolved bystanders are also liable.

This is why we picked Switzerland as our domicile.

https://www.reuters.com/article/swisscom-court-idUSFWN20M0KT

The problem is that we're the only ones with standing to challenge the Hamburg injunction, so if we don't, they can use it against anyone in the EU.

The problem is that this precedent applies not just to DNS operators, but to literally _any_ unrelated bystander. Sony make very clear in their complaint that Quad9 has no relationship with any party to the alleged infringement. That's why their so excited about this, it's a step further than they've ever taken before.

A) You just moved the goalpost.

B) That's a straw-man, as we have not asked for anyone's trust; quite the opposite.

C) We serve the public, everyone. Is your argument that the US and UK governments are excluded from the definition of the whole? Or that because they, like everyone else, are members of the set of the whole, that this somehow reflects upon us?

Quad9 is not sponsored by either the Manhattan DA nor the City of London Police. Both are users of Quad9, neither is a sponsor of Quad9.

We did just turn up a third Zurich location two weeks ago, in Equinix ZRH4, so our presence there is pretty robust; on par with New York, London, Singapore, San Jose, and Los Angeles.

Because that's a combination of features that less than a hundred-thousandth of a percent of users have ever expressed an interest in. And we don't have infinite resources.

If your ISP is sending your queries to the US, perhaps you should ask your ISP why they're doing that?

Did you read the applicable law section of the privacy policy? And you honestly don't think that's better than US law?

Have you sent a traceroute and the results of a chaos query to your ISP, so they can fix whatever routing problem you're encountering? There's nowhere in the continental US that's more than 5-6ms away from a Quad9 server cluster.

Not by chance, no, had to wait for a new block to open, and apply at the beginning of allocation of the new block.

We give you malware blocking if you want malware blocking, and we give you malware if you want malware. It's completely up to each user which way they want it. Somewhat over 99% of users prefer the malware blocking; a few want the malware. How would you prefer it to be?

Nope, SWITCH was engaged after the country decision was made. The country selection process took the better part of five years. SWITCH was engaged in July of 2019. SWITCH has contributed labor, but has put up no money. Quad9 is, as always, a starving non-profit, because when money comes in, it gets spent to provide service, but it's more comfortable now than at any point in the past.

So essentially every single assertion in your post is false, no? Did I miss something?

In what was was today's announcement not exactly what you're saying it should have been? It explained exactly how and why the data isn't being collected, no?

It seems like perhaps you haven't actually looked at what the announcement was about?

The entire point of the relocation was that the laws you're discussing were found not to apply.

https://www.quad9.net/privacy/compliance-and-applicable-law/

The irony being that for us (Quad9) the majority of the tinfoil-hat complaints are that companies donating to a non-profit make it _less_ trustworthy. Can't win either way. :-)

Hi. I'm Bill Woodcock, the eponymous "woody" of "woodynet." And executive director of PCH, and chairman of Quad9's board. They are three separate corporations, which exist for different reasons, and under different tax regulations (PCH and Quad9 are public-benefit not-for-profits, whereas WoodyNet exists to pay taxes on taxable transactions and keep the non-profits' books clean), but they're very closely related.

In this case, you're seeing WoodyNet IPs and IN-ADDRs because WoodyNet is giving transit to the Quad9 anycast instance you're talking to.

I'm happy to answer any questions you may have about how all this works.

I'd also note that round-robining between two different organizations with radically different privacy practices and security services... um... might not make the most sense? Depending what your goal is, of course. Again, happy to talk about any of this, just let me know if I (or any of the Quad9 or PCH folks) can be of help.

         -Bill

Actually, most Quad9 users (in so far as we know, since we only know from those who contact us) are already running their own local caching resolver, and many of them are doing QNAME minimization, which is excellent. They use us to keep their cache misses from going in the clear, and because many of them have small enough user populations that their resolver still exposes individual user behavior.

Well, first of all, you’ve got the same one vote as all other registrants, so you’re neither more nor less represented than any other .ORG registrant.

If you feel that the existing language in the charter, that part of which was largely derived from the original .ORG establishment RFC, and subsequent definitional documents, should be updated in some way, please propose specific edits for debate.

Actually, there are a bunch of large non-profits that register one domain per local chapter, and have thousands of .ORG domains. There aren’t a lot of speculators in .ORG compared to other gTLDs, because there’s a perception, probably correct, that non-profits don’t have deep pockets to buy domains from speculators.

Most countries have minimum citizenship requirements for board members, to avoid scams where a company does something bad and there are no board members within their jurisdiction to be held to account.

The U.S. is no different than most other countries in that regard, and CCOR has to be incorporated somewhere. The US has the strongest laws protecting cooperative members, and consequently hosts more cooperatives than any other country, so it’s a good place to get started, and a majority of the founding board members thus had to be US citizens. That can be changed through election if we succeed.

Exactly.

If any of you want to suggest language that you feel better conveys the goal, please propose it. We’d like to make the charter as clear and unambiguous as possible.

Not at all... .ORG has always been defined the same way, and that’s always included individuals, families, informal projects, just as much as formally-chartered charities, NGOs, and IGOs.

No change is being proposed here. Instead, a formalization and locking-in of existing rights, is being proposed.

You could create a corporation with the rules (and problems) that you’re proposing, but in a cooperative the rules are fixed: one vote per organization. Your family .ORG domain gets the same one vote as Microsoft.ORG, as your kids’ soccer league, as the church down the street, regardless of how many domains they register.

Obviously a bad actor could try to game the system by pretending to be multiple organizations, but it wouldn’t buy them anything, because board members don’t have any rights that non-board-members don’t have, and the rights of the members to their financial interests are also guaranteed under law... the bird couldn’t, for instance, vote to pay themselves.

Actually, the whole point of choosing the cooperative form is to avoid doubt and risk in governance. We don’t have to make the choices you’re positing, because our rights are actually enshrined in law. Cooperatives are one of the oldest forms of collective enterprise, and there’s four hundred years of law governing them. The rights of cooperative members (every .ORG registrant, in the case of CCOR) are much more strongly guaranteed by law than are those of, for instance, shareholders of a corporation.

Every member of a cooperative gets an equal vote in all governance decisions, and it’s not possible for the board to change that, that’s guaranteed by law, not contract or charter or agreement or anything. It’s also not possible to create membership “classes” with different rights. Also, the rights of capital are subordinate. Creditors, for instance, get no say in what happens.

That’s governance. Finances are equally clearly defined, but instead of one-vote-per-member, they’re proportional. If the wholesale price of a .ORG domain remains $9.93/year, and the savings (which are the “profits” in a corporation like ISOC) are $4, those savings are guaranteed by law to be distributed back to the members proportionally with the amount of business they did. Someone with one .ORG domain will get $4 back at the end of the year, someone with ten .ORG domains will get back $40, et cetera.

We don’t have to debate these terms, because they’ve been inalienably guaranteed by law for the past four hundred years.

Which is why we picked a cooperative as the best form for self-representation.

Hi. I’m one of the CCOR board members, and I’ll try to answer any questions I can. No such thing as a dumb question.

Yes, the cooperative is of all .ORG registrants, and exists to protect our collective interests. There’s no way to have absolute unanimity among the better part of ten million individuals and organizations, but so far, we’ve heard from several tens of thousands of .ORG registrants, and only three (including ISOC and PIR) were in favor of having a non-competitive redelegation such as the proposed one from ISOC to Ethos.

So, CCOR has three objectives, one short term, one mid-term, one long-term:

In the short term, to stop this backdoor deal, which bypasses the established, multistakeholder, competitive process.

In the mid-term, to get ICANN to launch the multistakeholder-administered, transparent, open competition to select the next .ORG delegate.

In the long term, for the .ORG registrants ourselves to put forward the best possible proposal for operation of .ORG, in that competitive process. If the process is run fairly and we win, we control our own fate. If the process is run fairly and we lose, we still win, because it means that someone even better prepared to serve us than we are ourselves, will have won.

But this is a very mainstream proposal... it’s the established process for .ORG, and the outcome we’re looking for, self-governance, is exactly how .EDU works. Educause is the non-profit association of universities that runs .EDU by and for the educational community.

Tricky question. I'm the chairman of Quad9's board of directors. So _I_ trust the organization. But I'd urge everyone else not to trust _any_ organization, but instead to do as much to protect yourself as possible, using an external recursive resolver only when you need to.

That means running your own caching resolver, with a local copy of the root zone and QNAME minimization enabled, and then using DNS-over-TLS to forward the minimum necessary query onward.

The next question then becomes whether to perform recursion yourself (by talking directly with authoritative nameservers) or to have Quad9 or another recursive server perform the recursion for you. Authoritative nameservers don't yet support transport encryption, though we're working very hard to support it on the 500 TLDs PCH is authoritative for, and Verisign is working very hard to support it on .COM and .NET. So that means that your traffic is subject to interception, and essentially all authoritative servers either log queries or have people logging queries off the wire in front of them. And if you're handling your own recursion, everything you don't have cached crosses the wire, and none of it is blended together with anyone else's traffic.

To make the decision as to whether it's better to trust a recursive or send queries directly, knowing something about the practices and purpose of the recursive is necessary. Quad9 is the only major recursive that's a public-benefit not-for-profit. There are other small ones which are not-for-profits (like the Taiwanese 101.101.101.101, operated by TWNIC), but all of the others that come near Quad9's scale or traffic are for-profit, operated by companies that monetize data. Quad9 and Cisco's commercial Umbrella service are the only two which are GDPR-compliant and thus legal to provide to European citizens.

Quad9 exists solely so that bad choices won't be the only choices.

              -Bill Woodcock
               Chairman of the Board of Directors
               Quad9