German State Alters DNS To Censor Web Sites [updated]

Rabenwolf writes: "In the German state of North Rhine-Westphalia, the first ISP (ISIS Multimedia) has given in to pressure from the state government and has started to block foreign websites with supposedly "illegal content" by changing the corresponding DNS entries. ISIS customers trying to access these sites are redirected to the website of the local government. ISPs in North Rhine-Westphalia will have to pay a fine if they continue to provide access to sites with "illegal content" through their DNS servers. It's not as bad as China or Saudi-Arabia, but it makes you think... An article from the heise newsticker is here, and if you don't sprechen Deutsch, Google might help." Update: 11/22 15:23 GMT by T : As sqrt points out, this report is misleading: "A single technican altered the DNS Entries to demonstrate it is possible. His changes were already reversed. Heise already posted a new story about this today."

Comments

Fragmenting the namespace?

[fhwang]

It looks like this has already been retracted. Still, it's interesting to imagine the possible ramifications.

If a country implemented DNS blocking like this as a long-standing policy, it's easy to imagine people trying all sorts of technical fixes to get around it. People would set up their own "All Hate DNS", or maybe they'd distribute .hosts files with lists of blocked domains ...

But once you're doing that, why even use the old domain name? If you had www.killalljews.com resolving through the "All Hate DNS", wouldn't you also want www.killalljews.hate, and www.finalsolution.now, and everything else?

It introduces the possibility of a conflicting, though smaller, namespace, being overlaid on the DNS -- one more step towards fragmenting the namespace. Not that such fragmentation is necessarily a good thing, but it sure would be interesting to watch ...

Re:IP addresses?

[Skapare]

"Virtual host by name" where you have many sites on one IP address (encouraged by the folks who bring you fewer than 4 billion addresses) identified by a "Host:" header in HTTP/1.1 is what is stopping them. It's a whole lot easier to just change the DNS server settings (Settings > Control Panel > Network > TCP/IP (your adapter) > Properties > DNS Configuration) to use a DNS server outside the country. Those with BSD/Linux/Unix/WinNT/Win2K/WinXPpro of course can run their own DNS server.