Slashdot Mirror
Some DNS Requests Ruled Illegal in North Dakota
jgreco writes "A judge in North Dakota has just ruled that requesting a zone transfer from a public DNS server is criminal activity within the meaning of the North Dakota Computer Crimes Law. A zone transfer is a simple request that a DNS server hand over information in bulk, and a DNS server may be configured to allow or deny such requests. That the owner of a DNS server would configure the server to allow such requests, and then claim such requests were unauthorized, is simply stunning."
So now there is a good chance i can go buy some adwords and advertise my website and then sue anyone who will access it... A good business model.
set your threshold at -1 if you want to see me
This in effect means that you cannot set up a secondary DNS server in North Dakota. Any ISPs in the state should probably relocate!
Most states have computer crime laws that pretty much say this: It is illegal to access a computer that you are not authorized to access.
This basically means that if you don't have written permission to access a computer, you can't access it legally.
So everyone who uses computers breaks the law, and the law is only truly defined by who prosecutors decide to prosecute.
This state of affairs is completely ridiculous, but unless you find a tech savvy Judge, the situation is unlikely to be changed through the courts.
If you had super powers, would you use them for good, or for awesome?
Might want to read the actual court ruling instead of the populistic and alarmist comments surrounding it. As I read it, the defendant already had been told by the court to stop bothering the plaintiff, and he then proceeded to ignore that. In and of itself the ruling doesn't outlaw dns requests, altough the judge's grasp of the technology clearly could stand improvement.
I didn't mean for anyone to read this post on the internet. So it illegal.
BIND 9.x and earlier allow this activity by default. This being the case, a new and/or ignorant system administrator may not realize their zone file is available for the taking.
One more example of the law having to protect the stupid, but I can *sorta* see the point of it. This falls in line with stealing wifi from unprotected networks. Just because it's not secured doesn't mean it OK to break in.
It's a civil case.
The worst that can be said about it is that it's bad precedent and the judgment was wrong.
The judge did not make DNS requests illegal.
Asking a public internet server for public information that it is configured to provide upon demand?
This quote from the article is debatable and the reason why its not a good idea to allow zone transfers. A lot of times, information that you would rather not be public is in zone files. I've seen a some people put processor information in HINFO records. This is bad because there was a cryptographer in the 90s that discovered that its possible to determine random number generation sequences based on your processor model and frequency. So it wouldn't be good for that info to be public.
Its not a good idea to allow zone transfers. Although its useful when an ISP that you are transfering a zone from doesn't want to give you all the zone records.
He can't email them, because clearly that's zomg h4xx0rz1ng their email server.
If you were blocking sigs, you wouldn't have to read this.
Those who can: write code. Those who can't: write laws.
Can you imagine if every politician in the house and senate knew how to program? Granted a good portion of them would still be writing awful spaghetti code... but for the most part at least they would not be able to compile it.
What I find interesting is that "computer systems" i.e. networks, disk drives, files, etc. ae well understood by us computer folk. What is "obvious" to us has come from a lot of experience and learning. More over, in constructing things like the internet, we develop a lot of "rules" that make sense within this context.
In the non-nerd world, a lot of the rules created by us nerds run afoul of what most people expect. DNS is a perfect example. To us, it is MADE to serve data. If you put data into DNS, you've made it public. To the rest of the world, however, that doesn't make sense. Its the same issue with HTTP. We see putting stuff on a web site as making it public, but non-nerds see things like deep linking a violation of their site because it does not promote the interaction they expect (viewing ads etc.) and have invested in. To them, you are circumventing their revenue model.
I'm not 100% sure we're 100% right. I don't think we are wrong in our views, but I see the gray area between the two.
If Ritz had previously been ordered to leave Sierra alone, and hadn't, then that's a basis for the ruling right there, completely ignoring any aspect of DNS. From the court documents, the guy sounds like quite a piehole.
What you're forgetting is that in most court cases, the defendant is there for one of two possible reasons: they really weren't responsible, or they were responsible but are now lying about it. And the plaintiff or complainant is there to make sure something "legal" happens in their favor, and they're not above lying to get their desired outcome, either. Usually there's a lot of both. That means the judges are professionally sitting at the mouth of a never ending river of bullshit, and they have to keep control of the situation.
It's not that judges can't or refuse to understand the technology; it's that the cases are about the people, which is where their focus must remain. The computer didn't act of its own accord. It operated under the direction of its owner. The question of "was there malicious intent?" has nothing to do with DNS or any other logic-based technology and everything to do with the two guys standing in the courtroom.
John
Why the hell aren't we celebrating this, people? Okay, for DNS, it sucks... but look at it this way...
It doesn't matter if you set up your system to 'automaticly' share the files you just downloaded... people who accessed them did so without authorization. It can't be considered 'sharing' if you didn't authorize people to download them from you... could this ruling be a tool agaisnt the MAFIAA?
I can lock my house, but even if I do not do so, you will still be trespassing if you enter my house.
but there is NOTHING ILLEGAL mentioned here. This is a civil trial, not criminal. The acts may be found illegal later in Ritz's later criminal trial, but that remains to be seen. Also, the issue is a question of whether Ritz was authorized to do the DNS request. The DNS request is legal for the administrators without problem. Obviously, the issue of Ritz's requests is worth debating. The article summary is horrible, as is the linked article. But, the linked blog entry has yet another link which gives the whole opinion as well as some more informed commentary. For those that want to be informed before spewing, I would suggest checking it out. (for the the other 99% of slashdotters, please feel free to ignore this at will).
Even if I did leave my doors and windows unlocked anyone that entered without my person would be doing so illegally and subject to my wrath.
--
Just because the door is unlocked does not mean you have permission to enter.
Your DNS server is not your house. It's your store. Yes, it's private and belongs to you, but it has a public interface. People walk into your store when it's unlocked because the door is the public interface, and the lock on the door is how the owner meters or controls access. DNS servers are much the same. They serve up a public interface. Making a DNS request of an open server should be no more illegal than walking into the 7/11. If they don't lock it, how am I supposed to know it's closed?
You know back in the 80s people on usenet notiuced that there were no uucp connections going into North Dakota and therefore Noth Dakota didn't actually exist. Now I think I know why there were no uucp connections going into North Dakota.
I hear the ladies love a Bad Boy. I just did a zone transfer from a North Dakota nameserver. I am SUCH a rebel. Come get me, biotches.
Now if you'll excuse me I'm going to tear the labels off some mattresses and jaywalk. I be bad, yeah I be bad.
Need Mercedes parts ?
As one of the people involved in this, I think I should take a minute to set the record straight.
Sexzilla was once one of the largest porn spammers on usenet. I wrote about them on my web site. The owner, Jerry Reynolds, sued me for defamation. I asked the other spam-fighters for whatever they had on Sexzilla so I could defend myself.
David Ritz responded with something along the lines of "Oh, it's true alright, here's the dns zone information that proves it." He also published his results on-line.
Reynolds then sued David for an "unauthorized zone transfer".
That zone transfer is the entirety of Reynolds' case against David. The rest of the stuff in the judge's decision was all a bunch of bullshit spoon-fed to the judge by Reynolds. Most of it has nothing to do with the case at hand, and most of it is either untrue or gross distortions of the truth. For example, the "hijacked" computer was an open relay that Ritz used to send one message to Verizon security, proving to them that they had an open relay.
You can read the whole sorry saga here.
Potentially it is, it's vigilante justice and legally should be left to the police (not that they will actually be capable of doing so).
http://spamdecoy.net - free throwaway anonymous email - avoid spam!