Slashdot Mirror
Security Consultants Warn About PROTECT-IP Act
epee1221 writes "Several security professionals released a paper raising objections to the DNS filtering(PDF) mandated by the proposed PROTECT-IP Act. The measure allows courts to require Internet service providers to redirect or block queries for a domain deemed to be infringing on IP laws. ISPs will not be able to improve DNS security using DNSSEC, a system for cryptographically signing DNS records to ensure their authenticity, as the sort of manipulation mandated by PROTECT-IP is the type of interference DNSSEC is meant to prevent. The paper notes that a DNS server which has been compromised by a cracker would be indistinguishable from one operating under a court order to alter its DNS responses. The measure also points to a possible fragmenting of the DNS system, effectively making domain names non-universal, and the DNS manipulation may lead to collateral damage (i.e. filtering an infringing domain may block access to non-infringing content). It is also pointed out that DNS filtering does not actually keep determined users from accessing content, as they can still access non-filtered DNS servers or directly enter the blocked site's IP address if it is known. A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server and that the Internet must not be allowed to 'decay into a lawless Wild West.' Paul Vixie, a coauthor of the paper, elaborates in his blog."
When was the Internet anything other than a "lawless wild west"?
15 years ago, 'typical users' didn't know how to use napster. 6 years ago, 'typical users' didn't know how to bittorrent.
This kind of argument shows how little they've learned.
Greetings and Salutations....
Why does this seem like one of those "feel good" laws that politicians pass to get brownie points with their followers, rather than to actually address and fix a problem?
I am more and more convinced that attempts to regulate the Net are a bad idea, and, any official that attempts to do this should be voted out of office or recalled.
YAB - http://blog.beemandave.com/
The typical users will quickly learn how to set their DNS providers if this comes to pass.
A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server
I'm going to get rich, starting now to create an innovative program named "DNS-server-changer". Everybody will buy it, I can patent-troll IBM and Microsoft and I also get money from Anonymous to redirect everybody through their network.
Experts: "they can still access non-filtered DNS servers or directly enter the blocked site's IP address if it is known"
MPAA: "typical users lack the expertise to select a different DNS server"
Dear MPAA,
What about the other half of the expert's statement? Typical users are perfectly capable of typing in four numbers with periods between them. Web links and bookmarks can be IP addresses. etc.
No sig today...
I sent my senator a short message detailing many of these concerns about the PROTECT-IP bill. You might be interested in her response.... WARNING: Don't read any further if you still have hope that senators can understand and address technology issues....
Dear Friend:
Thank you for contacting me regarding the Federal Communications Commission's actions relating to the openness of the Internet. I welcome your thoughts and comments.
The Internet is a valuable tool that facilitates business, education, and recreation for millions of Americans. In 2009, an estimated 198 million Americans had access to the Internet. I am committed to ensuring that consumers continue to benefit from the Internet as an open platform for innovation and commerce.
Instrumental to the success of the Internet is the long-standing policy of keeping the Internet as free as possible from burdensome government regulations. Increased investment in upgrading and expanding America’s communications infrastructure, and, in particular, new broadband networks, will ensure that all Americans have access to affordable high-speed Internet. However, in my judgment, intensified regulation of the Internet, such as government-mandated treatment of data, would stifle competition and would decrease the incentive for network operators to invest in critical infrastructure.
The case for additional broadband regulatory authority, or “net neutrality,” has not effectively been made. Broadband investment began to truly flourish when the Federal Communications Commission (FCC) made a decision in 2002 to remove advanced communications technologies from the antiquated common carrier regulatory framework. However, advocates of a larger regulatory footprint have continued to call for net neutrality since 2006.
Unfortunately, the FCC chose to respond by beginning a new proceeding that would reverse the 2002 decision to treat advanced communications services with a "light touch" regulatory approach. On December 21, 2010, by a 3-2 vote, the FCC adopted new rules meant to impose a net neutrality regime on broadband services. I believe these new regulations represent an unprecedented power grab by the Commission to claim regulatory jurisdiction without Congressional authority. This FCC action threatens investment and innovation in broadband systems, places valuable American jobs at risk, and may subject communications companies to new legal liability in the management of their networks.
In response to the FCC's heavy-handed order, I intend to explore every option available to me to keep the Internet free from such burdensome regulations, including introducing a resolution of disapproval in an effort to repeal the new rules. As the Ranking Member of the Senate Commerce, Science, and Transportation Committee, which has jurisdiction over the FCC, I will continue to work to prohibit further net neutrality-based regulations.
I appreciate hearing from you, and I hope that you will not hesitate to contact me on any issue that is important to you.
Sincerely,
Kay Bailey Hutchison
United States Senator
284 Russell Senate Office Building
Washington, DC 20510
202-224-5922 (tel)
202-224-0776 (fax)
http://hutchison.senate.gov/
PLEASE DO NOT REPLY to this message as this mailbox is only for the delivery of outbound messages, and is not monitored for replies. Due to the volume of mail Senator Hutchison receives, she requests that all email messages be sent through the contact form found on her website at http://hutchison.senate.gov/?p=email_kay .
If you would like more information about issues pending before the Senate, please visit the S
Laundry list of distinguished security researchers: "This is a terrible plan, it won't achieve what you want, and it will set back the state of internet security quite dangerously."
MPAA Flack: "Shut up, nerd, the health and security of the internet is not even a secondary objective here."
that we break the internet. Get to it!
Yes! Once they get trains going over 50 MPH on the wild frontier of the Information Superhighway tubes then you have all sorts of stuff going on, like women's uteri being ripped right out of em. We can't have that. It's the internet and we need porn on it. For that we need women with intact uteri.
The eternal struggle of good vs. evil begins within one's self.
Downloading a torrent client is not much more difficult than downloading a small app or browser extension that sets up alternate DNS lookups.
"Typical Users" can learn..
Interesting that they mention ISP's would block your ability to use other DNS servers. I don't think that, in the end, there is really anything the ISP could do to completely stop you. The worst they could do is block UDP port 53, but that wouldn't stop you from using any kind of tunneling software, especially if you did that tunneling over a secure socket.
Careful with names containing L slashdot.org/~AiphaWolf_HK slashdot.org/~AlphaWoif_HK slashdot.org/~AiphaWoif_HK
That is your future. Face it. The global tyranny will prevail.
"A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server and that the Internet must not be allowed to 'decay into a lawless Wild West." if you type in google for example "how to change dns servers" how many tutorials will come back with exactly How to change them? Just cause some people are not smartest people in the world with a computer there is always an article or tutorials out there written in the "how to for dummies" way.
Dear **AA,
I have taught my children how to change to an alternate DNS server.
Game over.
Sincerely,
Think of the Children
No, their use is not particularly harder to track.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Typical users also lack the the knowledge to un-check the default "use [firewall company]'s secure DNS servers" from the install that their son or other relation e-mailed them.
CASE AND POINT
Typical
73 KJ4IPS CL
"A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server"
I would argue that any user who lacks the expertise to change DNS servers also lacks the expertise to configure an FTP or torrent client. I would also argue that the MPAA is full of inbred morons.
FORK DNS!
I can't think of a better thing for the internet at large.. for now
For justice, we must go to Don Corleone
Freedom - I may not agree with what you say, but I respect your right to be punished for it.
Liberty - the price of freedom keeps going up, but the quality keeps deteriorating.
Questions raise, answers kill. Raise questions to stay alive.
I just read /. for the articles. I swear! I have no clue what "Port Forwarding" really does or how it really works, but I can do it. The only reason why I care to know at all is to make my torrents run faster. Thank you, Google! Part of the process of doing this meant learning other crap non-typical user techies take for granted such as what an IP address is and how to use an IP number to access my router, and what a DNS server is and how to manually set one so that I can have a fixed IP that works with my ISP. If all you have to do to circumvent this is to manually set a different DNS server or enter a numerical IP address, that is not going to stop the "typical user" of BT at all! What do they think it is, 1999?
When was the Internet anything other than a "lawless wild west"?
The internet is the wild west, but it is far from lawless... it just so happens that there are very few laws.
One of those laws is the trustworthiness of DNS. The proposal at hand is actually one that makes the internet MORE lawless, not less, as DNS falls utterly as the (relatively) trustworthy backbone of the internet it has been until today.
Who would knowingly point to a DNS server that might mislead them after this is passed? I sure wouldn't.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I think she sent you the wrong form response.
Yes and no.
Yes her staffer misread whatever his complaint was.
But no, she did not send the wrong response. If PROTECT-IP does not pass, how better to advance the same cause than to add it as further regulation under the umbrella of net neutrality? Once you are mandating how an ISP run "Ze Tubes" it's a very short hop away indeed from telling them they also need to obey a blacklist of IP addresses to be provided by the government... indeed that's probably the other prong of a two-part attack, since PROTECT-IP is all about not being able to find something, whereas an IP blacklist would prevent you from visiting it even if you used an alternate DNS.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
A fork of the DNS system is something that I can't wait to see happening. I believe that the changes that ICANN is doing are precisely mean to obstruct the adoption of additional independent TDLs, and honestly if the DNS is not forked soon, attempting to do it later is going to create fragmentation and confusion, specially when ICANN sell some of the independent TLDs that belong to the alternative DNS systems nowadays. I am also, mmm, I'll go with angry, at the ICE taking away domains of companies that operate legally in their own countries (rojadirecta), and I simply don't think that ICANN or the US can be trusted anymore with the control of this vital component of Internet. The RIAA/MPAA have way so much control over the government, and the government have way so much control over ICANN, and ICANN have complete control of the DNS system.
In particular, because these sorts of things would get asked about and talked about. People would learn "Just enter these numbers under DNS and stuff will work again," and they'd do it. Setting DNS servers is not complex, users can easily be taught how to do it, just nobody bothers because they needn't do so. DHCP hands them out and it makes sense to use the ones your ISP provides as they are usually the fastest for you. However it isn't some major technical feat to enter the numbers in the box. There would be sites out there listing unfiltered DNS servers and people would just copy and paste.
The vast majority of Internet users doesn't know their DNS, they probably don't even know what DNS is. They just open their browser (better known as "the Internet"), enter www.slashdot.org and expect to be able to read News for Nerds, Stuff that matters. Maybe not the best example but I bet you get the point.
typical users lack the expertise to select a different DNS server
is definitely a true statement.
A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server and that the Internet must not be allowed to 'decay into a lawless Wild West.
dns filtering came to turkey 5 years ago.
EVERYONE knows how to bypass it now. and i mean everyone who is using internet - the equivalent of the 'mom in idaho' knows how to bypass it. her son, relatives, someone from neighborhood comes and bypasses it for her. people learned what 'opendns' means here. the term 'proxy' have become an everyday term, even in among the tech illiterate crowd. people ask about 'good proxy' to each other. (people learned about it when the courts started to ban i.p.s).
so, random 'mom in turkey' is able to do that, but the organization that represents all movie producers in america shits about otherwise ?
really. what kind of people are you letting you run your country and corporations and corporations' lackey organizations ? idiots ? morons ? bastards ? i think the last one is more likely. (i am not able to bring myself to say ngo regarding mpaa after that kind of idiocy)
Read radical news here
the point is that will change in about 3 days across the USA if the USA tries this. It's not the first country to try DNS filtering, and perhaps despite what recent history might lead one to believe, americans aren't significantly more stupid than people in other countries, which nowadays routinely route around incompetent government/corporate attempts to censor the net.
Rule #1 of the Internet: Don't Break DNS.
Rule #2 of the Internet: Don't Break DNS The Other Way.
(Rule #3 of the Internet: Don't Break BGP - but that's not relevant here)
There may be a few more, but those are the big ones that I can think of. Violating Rules #1 and #2 indicate that you either have no clue how the Internet works, or you know just enough to be dangerous. Either way, Don't Do That.
When was the Internet anything other than a "lawless wild west"?
The internet is the wild west, but it is far from lawless... it just so happens that there are very few laws.
One of those laws is the trustworthiness of DNS. The proposal at hand is actually one that makes the internet MORE lawless...
Indeed. Funny thing, this requires judges and lawyers being woven into the fabric of internet - I don't like the idea.
Questions raise, answers kill. Raise questions to stay alive.
They won't even need to know what a DNS is. They'll just download the 'get your free music' extension for firefox. Which will, of course, require them to download a browser that isn't IE, but their nephew/sister/uncle/cool geek in their dorm knows how to do that stuff so its OK.
Sort of lowers the technical bar for circumventing this crap. It'll also move the fight from DNS to the browser level, which will be fuggin' awesome.
typical users lack the expertise to select a different DNS server
is definitely a true statement for the present.
FTFY.
And it is so just because the DNS infrastructure worked by very unsophisticated rules - good enough for everybody - unsophistication which allowed the rules remain hidden. Break them and more people will start looking into how to mend them in their own way - one may not like some ways of mending.
Questions raise, answers kill. Raise questions to stay alive.
Technically it doesn't have to conflict with DNSSEC.
First of all ISPs have to stop lying about the A record when you look up a filtered domain (Seems like an oversight if that practice is even legal). Instead they need to send an error response back to the user. I'd suggest a server error message (since "your government don't want you to see this" wasn't included as an error code when DNS was designed).
What the client will do when getting this error is to use the DNS search path provided by the DHCP server along with the DNS server IP. Since the ISP controls the search path, they can ensure it is a domain under which they can provide valid DNSSEC protected domains. Then they make it so that every filtered domain exists as a subdomain under the DNS search path and other domains don't exist there.
Do you care about the security of your wireless mouse?
typical users lack the expertise to select a different DNS server
is definitely a true statement.
What it is is bullshit. There would be directions floating around everywhere written at a second grade level on how to do it. If they couldn't figure it out from there they'd ask that tech suave friend or relative to do it. Linux would come pre-configured to hit OpenDNS.
Where in the problem lies is that half the instructions floating around would be pointing to compromised servers. Thus by eliminating the trust aspect that is key to DNS working and making DNSSEC essentially illegal they're going to create exactly what they claim to be trying to prevent, turning the internet into a lawless wild west. I find it absolutely amazing that congress is going to pass a law that will make implementing security measures on the internet illegal. Tells you how deep our government representatives are in the pockets of the RIAA/MPAA crowd.
Who is John Galt?
The vast majority of Internet users doesn't know their DNS, they probably don't even know what DNS is. They just open their browser (better known as "the Internet"), enter www.slashdot.org and expect to be able to read News for Nerds, Stuff that matters. Maybe not the best example but I bet you get the point.
typical users lack the expertise to select a different DNS server
is definitely a true statement.
Not very true at all. Changing DNS to a 3rd party server is trivial, there are all kinds of posts all over the internet especially in gaming and hacking/pirating forums. If they start trying to push this type of system, "how-to" docx and websites will pop up all over the place, and people will start running underground, shady DNS servers.
I'm fairly cynical regarding the average user's ability to tie their shoes, let alone do anything with a computer. But a shitload of people managed to get Kazaa installed and share music and movies, and to be blunt that's more involved than browsing to a local network IP, entering a default password, and typing one IP address into the DNS settings on your router.
funny....maybe 12 years ago they might a got away with it , but not now.....
lol enjoy
And politicians.
Don't forget the damned politicians.
Politicians, lawyers, and judges.
The Unholy Trinity.
Of course, it was inevitable that a source of such wealth, information, and power available to the unwashed such as the internet would become a target for control for such as they.
It had to happen. They by their very nature are unable to tolerate anything that empowers regular people unless it's been made "safe"..."safe" from use against *them* by the people, and "safe" against regular people using it to communicate information, ideas, and wealth created independently from, and unmonitored by, those in power.
I'm surprised the freedom of the internet hasn't been attacked more intensely and with more determination than it has at this point in the 'net's history.
I guess looting the country and the citizens while trying to turn it into a Third-World hellhole takes most of their attention. It must be really hard work, too, judging by the number of vacations they take on the taxpayer's dime.
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
Indeed. Funny thing, this requires judges and lawyers being woven into the fabric of internet - I don't like the idea.
And politicians.
I wasn't forgetting them... just that they seem to be already entangled in/with the internet - ever since the somebody "explained" them the internet is like a series of tubez. To date, on purpose or not, the confusion persists.
The judges and lawyers would be new additions.
Questions raise, answers kill. Raise questions to stay alive.
You're correct, of course. I just didn't want the Unholy Trinity to go unmentioned and possibly be missed by someone not already well aware.
I thought about going for the "series of tubes" thing, but decided the straighter, more philosophical(?) approach might be more effective.
But, who am I really kidding? This is Slashdot, that needs a car analogy for nearly every concept. :)
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
So if they do force Google to de-list, what is to stop Google continuing to list them on it's local sites outside the US? So everyone switches to using Google.co.uk? Or Google could move it's .com servers outside the US like it did with China.
You can be sure Google will be dong it's best to let people find those sites, as not only does this censorship go against the Google creed but it also knows that if people can't find what the want on Google they will switch to another search provider and bang go Google's advertising revenues.
There may be new search providers who appear out of the ether to fill the gap, and while they can ban these too, one thing you can be certain of, they will not be based in the US. One more nail in the coffin of the US as the major internet player.
N.B. this user is far too lazy to write a witty and intelligent sig.
The statement is true, however it does not fit the context, these specific users aren't the type that know where to find warez normally.
People will just move to namecoin, first site admins and then the general populus (just as it happened 35 years ago with ip protocol) and centrally operated DNS will just become obsolete...
DNS is dead
Long live namecoin!
-- no sig today
Typical Users do NOT need to know DNS or how to alter their DNS servers from a hole in the ground.
Google standard HTML links (which have been there the beginning) will guide them to Piratebay or whatever. Of course this means the politicians are making scammers and crooks jobs that much easier...
I'm worried about the 'regular' DNS servers out there, sure, but what scares the crap out of me is the root servers.
If this act will require tampering on the root servers, we're all f*cked.
as to the normal DNS blocking, Denmark has had this for a few years, and it's a travesty, innocent domains land on the filter list all the time, and it's virtually impossible to get off it, and the list isn't public, so you're forced to all kinds of shenanigans to find out if you ARE on there or not.
~men are from earth. women are from earth. deal with it.~
Okay maybe political repression is more evil than crass economic repression. But it does give some China some excuse to say, "Hey, we're only censoring the Internet to give our country peace and stability. You're just censoring it to protect your bottom line."
But everyone has a family member or acquaintance who does have that knowledge, and they won't hesitate to ask "hey can you fix the pirate bay for me".
Meanwhile a typical network admin on their first day at work is perfectly capable of redirecting all DNS traffic to their server even if the user is asking for DNS information from Google at 8.8.8.8. Some internet service providers already do this and use it to insert annoying advertisements instead of the expected error messages when an address is not found.
True statement? Really?
A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server and that the Internet must not be allowed to 'decay into a lawless Wild West.'
Hmmmmmmm. Let me rephrase that differently.....
An inter-office memo from Microsoft was recently released with a statement by an executive arguing that the typical user lacks the expertise to choose a different browser and that apathy and ignorance will allow the Internet to continue to be dominated by Internet Explorer and that the Internet will not devolve into a Wild West of open source competitors taking away market share and that governments and states will not get involved via lawsuits and legislation to affect Microsoft negatively .
You screw around with DNS too hard and you will find that people will fight back. Of course their warnings about fragmentation will most likely be true very quickly. How much of an excuse does China need to form its own root servers and DNS? It would certainly only help them to create and control DNS resolution and to ban all DNS queries to outside networks period. The EU will probably form its own, and interestingly, will probably pick up well over half the US market.
Seriously? Would you choose a DNS "network" that bypasses due process and exposes you to impossible business risks for you and your customers, or a DNS "network" operated without such risks?
When installing IE9 now I can see options on changing default search engines. You can choose default programs now too. Did you think you would see that 5 years ago?
I am willing to bet that if it gets bad enough, even router manufacturers will start giving choices and that open source browsers themselves will start making it easy to configure a computer to use alternate DNS servers, even if it is just for the browser itself.
So far, they have not affected enough people yet, not all that many in actuality, but how much are we arguing about it right now? All they have done is stare at the hornets nest, just wait till they actually throw a rock.
The vast majority of Internet users doesn't know their DNS, they probably don't even know what DNS is. They just open their browser (better known as "the Internet"), enter www.slashdot.org and expect to be able to read News for Nerds, Stuff that matters.
I enter 216.34.181.45, you insensitive clod!
== Jez ==
Do you miss Firefox? Try Pale Moon.
Typical users lack the expertise, because up until now, they didn't need it. I assure you, they will gain this expertise rather shockingly fast. The only way to motivate "typical [l]users" to learn something new is to block something they want. Years ago typical users didn't know how to download HTTP warez, because they didn't understand ZIP files. Years ago typical users didn't know how to access Napster/Kazaa/whatever. Years ago typical users didn't know what a Bit Torrent client was, or why they needed one. Users learn what they need to in order to get what they want.
A pesky thing, a big information network the free people of the world can use, if you are trying to control them all. So why not break it and fragment it with idiot laws? It will not take long to control it completely once it's properly "broken". They aren't as dumb as you think they are.
Take the Red Pill.
Tells you how deep our government representatives are in the pockets of the RIAA/MPAA crowd.
That and that they're clueless when it comes to tech more advanced than a biface
Only terrorists don't want to protect intellectual property.
The best way to protect us from the terrorists, save the children and ensure corporate profits (so we can keep our economy in the good condition it is today) is to get rid of the DNS. Think about all the terrible information that DNS technology facilitates access too. We need some kind of new DNS system that is designed by politicians and outsourced to a trustworthy company like Lockheed Martin to implement.
I also think cars should be banned. Some people use cars for delivering drugs... and drugs are bad. If your not a drug dealer why do you need your own transport? Why not use buses and planes? Is it because you don't want to go through the naked body scanners and have your bombs and drugs revealed?
Really what we need are huge jails for everyone except CEOs and high ranking politicians. That would be safest... think of all the terrible things people can do given the opportunity to freely walk around outside. Surely if you don't plan to do these terrible things then you don't need to leave your assigned jail. Everything you need to live can be safely and lovingly supplied by the politicians and CEOs... direct to your jail. We could also, each have a microchip implanted under our skin with a unique ID stored within it. The government can then figure out exactly what our needs are and care for us even better.
But they don't need that knowledge. Their tool will have it for them. So you cannot access TPB? No problem. Within nanoseconds a tool will spring into existence that uses a non-filtered DNS server for you, provide the IP-Address and feed it to your application. Hell, why not make it a browser plugin? And if that fails, how about wedging it into the DNS request routine?
In short, this will accomplish nothing while being a gapping security hole in the making. First for the already mentioned problem with DNSSEC, rendering this (much needed) service utterly useless. But how about the users that will (have to) install software to bypass this filter? As mentioned above, they do not have the knowledge, but they will outsource this problem to some program. And not having the knowledge to find out how to bypass that DNS filter, they won't have the knowledge to determine whether the tool they use is benign or malicious.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
"It is also pointed out that DNS filtering does not actually keep determined users from accessing content, as they can still access non-filtered DNS servers or directly enter the blocked site's IP address if it is known."
Obviously that's why they call it the "PROTECT-IP" act, because IP addresses will still work fine :-) :-)
Calling such users "determined" is kind of like calling the people who held the shift key down to avoid audio CD DRM elite hackers. But you're not supposed to tell any of this to the fools trying to implement this stuff!
Tenderfoot in the wild west then. They should have chosen their sheriffs more wisely.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
wget -O /dev/null "http://216.34.181.45/"
--2011-07-18 17:39:41-- http://216.34.181.45/
Connecting to 216.34.181.45:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://slashdot.org/ [following]
--2011-07-18 17:39:42-- http://slashdot.org/
Resolving slashdot.org (slashdot.org)...
this ip address simply re-directs to "slashdot.org".
so this does not solve the problem.
If there is dodgy content on the internet, then the courts should get an injunction against the content's uploader and force him to remove it!
We don't close the roads to a shopping centre because there is someone walking around selling pirated dvds.
SURELY NOT!!!!!
e.g. copyright law
Atari rules... ermm... ruled.
Most people won't have to change their DNS settings. They will simply download and install a program that does it for them. Or a browser plugin.
You got drug dealers.
Maybe I can make some sweet money selling "hook-ups" (aka access) to servers with infringing content!
I can be a digital access dealer, a dad!
A few ISPs don't give you the choice (Warner Bros is one that actively does). All ISPs have the means to. If this passes, even if your ISP does not want to they will not have a choice or it will be done upstream. Transparent redirecting/hijacking unencrypted DNS traffic is trivial.
http://www.dnsleaktest.com/what-is-transparent-dns-proxy.php
Having to work for a living is the root of all evil.
won't stay true for long if random websites get blocked.
Wealth is the gift that keeps on giving.
then how do you find out the true ip? this seems scary!
Wealth is the gift that keeps on giving.
90% of public school students between the grades 4-12 actively switch DNS settings on machines when they receive a block page. I know because for the last 8 years my job has been to provide content restriction, content monitoring, and data protection technology and support. The majority of my clients are US school systems. I seriously doubt that schools I haven't worked with vary more than .1%. Encrypted traffic is the ONLY pathway to protecting privacy and even THAT is now compromised by several filtering products actively used by schools, cities, and businesses. Your vast majority numbers must exclude the US.
Having to work for a living is the root of all evil.
You know what, the way to route around this damage is to include a caching resolver with the browser (and peer to peer client, ftp client, etc) so that even users without any technical knowledge can be free of this stupidity. Sure, your DNS times will go up by a few tens of ms but that's better than relying on utterly broken infrastructure.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
It's our job to write small tools that quickly change the DNS settings and provide all sorts of documentation on why.
The users listen to the geeks. The geeks need to make sure they help the users thwart big brother at any cost.
The same way gearheads tell the public which cars were well built and which ones are junk. They warn the public when automakers try to slip in cost cutting changes that make vehicles worse. The company thinks "Oh, no one understands the difference, yank it", but the gearheads make them regret that decision.
Same with hackers.
My secondary school had a generic internet filter on all school machines. It didn't take particularly long for everyone to figure out how to use free proxies to bypass it, and once those too began to be blocked, for a few of us to set up proxies on our home machines.
Yes, if school children set up remote proxies with ease to bypass filtering, your average consumer will have no trouble switching their DNS server if it becomes inconvenient not to do so.
Fixed!
Clearly the government needs to protect the population by blocking those websites too.
Find ip of banned server. edit /etc/hosts to include it. Done. /etc/hosts is far more permanent than having to change
the DNS server several times. Because as sure as shit the Government would
cow most of them into complying.
Whether your in Linux or Windows or Mac OSX /etc/hosts is searched first before
DNS is consulted.
FYI in Windows it's... C:\WIndows\system32\drivers\etc\hosts ... /private/etc/hosts
In Mac OSX its
" typical users lack the expertise to select a different DNS server"
That's amazing. Obviously the users in question are not average. That's like taping a fake lock onto the front of the bank vault and saying as long as no one tries to break in, the money's perfectly safe.
That is the true IP address. After it's told to redirect to slashdot.org, it looks up slashdot.org, which is 216.34.181.45.
No, it's not a circular path.
In the first instance, you're asking for the HTTP server at 216.34.181.45 .
In the second, you're asking the HTTP server at 216.34.181.45 for the virtual site "slashdot.org".
I'm not a lawyer, but I play one on the Internet. Blog
both you and the article point out that it will somehow work via obscurity... that the "typical user" simply doesn't have the knowledge to circumvent such a system. while that maybe true at the moment it will very rapidly change. people learn what they need to learn to do what they want. and the best part is that they don;t even have to "understand" anything - users will follow cookbook how-to's, learn to use apps that happen to accomplish the desired result or even simply have that one computer literate buddy of theirs set them up.....
point being, it will NOT be effective. because regardless of what people know NOW they are capable of adapting.
The elected representatives in my area could certainly be described as "two faced stone tools".
Why do they have the ability to do that? Make them login as an unprivileged user.
Stop blocking at the DNS level, just drop packets at the border router.
DNSSEC fixes that, like you said encryption is the solution.
So does doing all your lookups via an ssh tunnel to a machine with a good dns server to look at.
I'm sure someone will find the relevant Dilbert comic, but are you honestly expecting your filtering to stand against the combined will of people to find p0rn?
>you can rest assured the src and dst IPs on every single one of those packets is recorded and linked to your account.
Really? What kind of storage space would be required to keep track of every single packet, src, dest, + time and size?
Why stop there? Why not record the entire contents of every IP conversation?
I'd think it would be easier to do a usage = usage + x every few packets or so to keep track of usage.
I'm not a lawyer, but I play one on the Internet. Blog
This is the kind of statement that makes me pine for the days when tarring and feathering was considered acceptable behavior. Likewise, senators who support such laws as PROTECT IP remind me that hanging, drawing and quartering was once considered appropriate punishment for those who were guilty of treason.
this ip address simply re-directs to "slashdot.org".
so this does not solve the problem.
wget: you're doing it wrong. Try doing this instead to get the site index:
wget -O - --header="Host: slashdot.org" "http://216.34.181.45"
You need the header because nearly everyone uses name-based virtual host to host multiple sites from a single IP address. (Here's Apache's documentation on it.) The webserver looks at what site the browser requests in the "Host: example.com" section of the HTTP headers and serves content based on that.
A workaround is easy:
echo "order hosts,bind" > /etc/host.conf; echo "216.34.181.45 slashdot.org" >> /etc/hosts
Type in "slashdot.org" into browser and it should use the IP given in the host file, without a DNS lookup, but still have "Host: slashdot.org" in the http header. You could also set up a line pointing the yro, linux, and other subdomains to the right IP (216.34.181.48) and everything should work as expected.
This is pretty basic stuff that hasn't changed in years.
Oh friend you wouldn't even need instructions! Since the vast majority is on Windows and DNS settings can be changed by the registry all one would have to do is post a zipped reg files to mediafire and the like and voila! The majority can bypass the bullshit as easy as "clicky clicky reboot". I'm sure there are plenty of guys like me if they break DNS with this bullshit that will be happy to flood the download hosts with re files set up to switch the clueless to functionality again.
But what do we expect when the government has been whoring itself to big business without pretense for over a decade and a half now. The will of the people is no longer being heard or listened to, only the will and desires of the rich elites. Hell look at how the right wing's answer to everything is "give teh rich more MONIES nom nom nom" when data shows that higher taxes on the rich leads to lower unemployment and increased job growth yet those writing the checks don't want that, so we get the "give teh rich more MONIES nom nom nom" policy.
So it doesn't matter how many of you wrote, sign petitions, all the things one was taught to do to change the system, because all you got was the same form letter I did from my congress whores which was bullshitese for "I don't listen to peasants".
ACs don't waste your time replying, your posts are never seen by me.
Did the EFF thing a while ago, actually wrote my own message but I doubt the response wasn't the usual boilerplate:
Dear (Aphoxema):
Thank you for contacting me to express your concern about the Preventing Real Online Threats to Economic Creativity and Theft of Intellectual Property (PROTECT IP) Act of 2011, S. 968. I appreciate hearing from you on this issue.
The bipartisan PROTECT IP Act, which was based on last year's Combating Online Infringement and Counterfeits Act, which passed unanimously in the Senate Judiciary Committee, would authorize the Department of Justice to pursue court orders to take action against websites that are dedicated to selling pirated and counterfeit goods.
It is important to note that this legislation seeks to address a serious problem without inappropriately restricting Internet freedom. The Justice Department currently lacks tools to effectively enforce anti-piracy and counterfeiting laws against websites that are dedicated to distributing material in violation of these laws.
This legislation seeks to address this problem by enabling the Justice Department to target these websites through court orders, while also providing the websites with the opportunity to petition a court to lift an order. The bill is narrowly tailored so as not to include legitimate websites and it includes important procedural protections to prevent misuse of this authority. For a court order to be issued, the Justice Department must show that the website in question is directed at customers in the United States and that it harms holders of U.S. intellectual property. In addition, the Department is required to promptly serve notice of the action after the filing.
S. 968 provides a narrower definition of a website "dedicated to infringing activities" than the Combating Online Infringement and Counterfeits Act. In addition, while the PROTECT IP Act would authorize the Attorney General and rights holders to bring actions against online infringers operating a rogue website or domain, the remedies are limited to blocking financial gains of the site but not blocking access. Also, this bill ensures that third-parties (e.g. Internet service providers, payment processors, advertising networks) are not overly burdened to comply with an order beyond what is feasible and reasonable.
In May 2011, this bill was approved unanimously by a voice vote in the Senate Judiciary Committee and was reported to the Senate floor for further consideration.
Effective enforcement of intellectual property laws is critical to the encouragement of innovation and the creation of jobs. In recent years, we have seen a proliferation of Internet websites that are devoted to the unauthorized distribution and sale of pirated and counterfeit goods. These websites deprive innovators and businesses of revenue and result in the loss of American jobs. In addition, these websites present a public health concern when they sell counterfeit, adulterated, or misbranded pharmaceutical products.
I will keep your views in mind as the Senate considers this issue in the coming months.
Sincerely,
Richard J. Durbin
United States Senator
RJD/vy
-----
It's not a bad response but it shows a failure to understand the technical impracticality of "DNS blocking". That's the problem; since an individual can't learn everything about everything, it is impossible to elect someone as a lawmaker who knows intimately the details of the laws they may face or even what someone needs to know to be a good counsel.
There should be a third congressional house; The Senate, The House of Representatives and The Rational and Scientific Place of People Who Understand The Technical Ramifications of Stupid Laws.
"Most people, I think, don't even know what a rootkit is, so why should they care about it?"
I wish there was a moderation type called "You're reading my mind."
Who did what now?
"the Internet must not be allowed to 'decay into a lawless Wild West.'"
You mean, like corporate America?
Since the vast majority is on Windows and DNS settings can be changed by the registry all one would have to do is post a zipped reg files to mediafire and the like and voila! The majority can bypass the bullshit as easy as "clicky clicky reboot".
Good point. And once again half such files would point to bogus DNS servers with obvious results.
Who is John Galt?
Norton DNS does http://nortondns.com/ can be a GREAT thing to help stall, or even stop, the malware problem online.
They filter on "malware-in-general" such as KNOWN bad sites/servers/hosts-domains, botnet C&C servers, & even bogus DNS servers by default (and their updates every few minutes for continuously updated protection are here http://safeweb.norton.com/buzz with site-checkers & even a removal appeals process etc./et al... IF a site does "clean up its act" etc. )
Another decent set of these are:
---
ScrubIT DNS -> http://www.scrubit.com/
&
Open DNS -> https://store.opendns.com/get/basic (with built in phishing protection even in the FREE basic model)
---
I use all 3 @ once in my NAT stateful packet inspecting Linksys/CISCO router + my IP stack setup for my Local Area Connection here... in layered security fashion!
* Each as a write up on how they work, why they help, & more... enjoy!
APK
P.S.=> Between the layering of Filtering DNSBL utilizing DNS servers listed above, because I use them ALL in "layered-security fashion" in both my routers & IP stack setup here in Windows, in combination with:
---
1.) A custom HOSTS file ( currently with 1,494,865++ entries of known bad sites/servers/hosts-domains, botnet C&C servers, & even rogue DNS servers blocked in it currently & growing "automagically" from 17 reputable & reliable sources for that type of data for HOSTS as well as DNSBL lists here from a Python script that does so for me),
and
2.) IP addressed threats inserted into my router & software firewalls
3.) And lastly, system security-hardening, in depth -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE
---
?
I haven't caught a "malware of any kind" infection/infestation since, oh, around 1996 or so in fact!
"Layered security", the best thing we have going currently, really WORKS!
... apk
Okay, average user who acquires software or music, anything that infringes on IP may not exactly know how to change their DNS server or figure out right away that they can entire the IP directly.. That's because so far, they've had no reason to learn that information and put it to use. Give them a reason, and just like the knowledge of using a torrent it will spread and common users will know how to do it. "Herpa derp, I can't access this site. Oh hi joe can you access it still? Oh you can? How do you do it? Oh I have to do what? google for dns server? Hmm..let me read that...oh, that's easy, just hit properties and enter in a new dns server manually..oh that was easy..oh hello TPB!" I will herp and I will derp and blow all your computers down!
Ya know you'd think that would be the case, wouldn't you? But I guess since the malware guys have gotten so good at tricking users with "Iz_Not_Viruz_Iz" social engineering stuff like "The new Limewire" (I've seen that one quite a lot lately) and the security tool "ZOMG U Got Viruz!" trick that honestly I haven't seen an infected reg file in awhile.
Most of the reg files are written in human readable format with nice little readmes that you can use to check what it is supposed to do with the description. I've found most of the reg files are written by.....well by guys like me, little repair shop guys that find a niggler of a problem and write a reg file to deal with it and then when they find others on some forum with the same problem they drop it on mediafire. I have one I found that way that is frankly a little lifesaver for fixit guys, it is a little reg file that tosses the Windows Sound Server settings and then replaces them with the default values. If you have ever installed Windows or installed a sound driver only to have "No Device" show up under the Sound CPL applet? This fixes it, no matter which kind of soundchip you have. Just clicky clicky reboot and if anybody needs it feel free to email me.
So while I'm sure you'll probably see one or two assholes, after all what is the Internet without assholes, like Goatse trolls they are just part of the experience, like TPB I'm sure the good reg files will quickly rise to the top through word of mouth and will be written in an easily read format complete with comments. There are just too many little fixit guys like me that hate to see the government fuck up something as fundamental as DNS so the RIAA can show how their little PPT says if they made X last year then they should make X*Y this year, regardless of the economy or whether their product is extra shitty this year or not.
Mark my words, after they pull this shit and their sales don't go through the roof? First they'll claim it is Darknets, that Joe average has hooked into this vast dark web and THAT is how they are keeping from buying the *.AA precious, and then they'll most likely have themselves declared "Too big to fail" and along with perpetual copyrights they'll just take the money straight from your check each month. Isn't capitalism grand?
ACs don't waste your time replying, your posts are never seen by me.
Tells you how deep our government representatives are in the pockets of the RIAA/MPAA crowd.
Or most of them are completely clueless, remember your government classes strong encryption as a munition and thus places restrictions on the export of some encryption software.
N.B. I don't actually know the current status of encryption being classed as a munition in the US or current restrictions, but the point is that shouldn't have happened in the first place.
That's all right, Comodo and other security software already offer to set your DNS to a "secure" DNS server (I can't comment on how true that statement is, but it's a different DNS server anyway) - and I'll bet they'll be advertising DNSSEC or whatever on the DNS serves they're using as another feature pretty quick...
Opera, Proxomitron-Grypen,GPG 0x0A1C6EE3