Slashdot Mirror
Security Consultants Warn About PROTECT-IP Act
epee1221 writes "Several security professionals released a paper raising objections to the DNS filtering(PDF) mandated by the proposed PROTECT-IP Act. The measure allows courts to require Internet service providers to redirect or block queries for a domain deemed to be infringing on IP laws. ISPs will not be able to improve DNS security using DNSSEC, a system for cryptographically signing DNS records to ensure their authenticity, as the sort of manipulation mandated by PROTECT-IP is the type of interference DNSSEC is meant to prevent. The paper notes that a DNS server which has been compromised by a cracker would be indistinguishable from one operating under a court order to alter its DNS responses. The measure also points to a possible fragmenting of the DNS system, effectively making domain names non-universal, and the DNS manipulation may lead to collateral damage (i.e. filtering an infringing domain may block access to non-infringing content). It is also pointed out that DNS filtering does not actually keep determined users from accessing content, as they can still access non-filtered DNS servers or directly enter the blocked site's IP address if it is known. A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server and that the Internet must not be allowed to 'decay into a lawless Wild West.' Paul Vixie, a coauthor of the paper, elaborates in his blog."
When was the Internet anything other than a "lawless wild west"?
15 years ago, 'typical users' didn't know how to use napster. 6 years ago, 'typical users' didn't know how to bittorrent.
This kind of argument shows how little they've learned.
The typical users will quickly learn how to set their DNS providers if this comes to pass.
Laundry list of distinguished security researchers: "This is a terrible plan, it won't achieve what you want, and it will set back the state of internet security quite dangerously."
MPAA Flack: "Shut up, nerd, the health and security of the internet is not even a secondary objective here."
Interesting that they mention ISP's would block your ability to use other DNS servers. I don't think that, in the end, there is really anything the ISP could do to completely stop you. The worst they could do is block UDP port 53, but that wouldn't stop you from using any kind of tunneling software, especially if you did that tunneling over a secure socket.
Careful with names containing L slashdot.org/~AiphaWolf_HK slashdot.org/~AlphaWoif_HK slashdot.org/~AiphaWoif_HK
That's the intent. To create a law that addresses one political issue while at the same time creating several new problems. THIS IS BY DESIGN. It's the political gift that keeps on giving back to legislatures. It's purely justification to expand the government at the expense of public tax dollars. How in the fuck this is news to anyone proves we still live in a sick, sad world. It should be ingrained into every child from birth that large government = evil!
Life is not for the lazy.
She's a Democrat from California. Did you really anything different from her?
Life is not for the lazy.
The vast majority of Internet users doesn't know their DNS, they probably don't even know what DNS is. They just open their browser (better known as "the Internet"), enter www.slashdot.org and expect to be able to read News for Nerds, Stuff that matters. Maybe not the best example but I bet you get the point.
typical users lack the expertise to select a different DNS server
is definitely a true statement.
the point is that will change in about 3 days across the USA if the USA tries this. It's not the first country to try DNS filtering, and perhaps despite what recent history might lead one to believe, americans aren't significantly more stupid than people in other countries, which nowadays routinely route around incompetent government/corporate attempts to censor the net.
typical users lack the expertise to select a different DNS server
is definitely a true statement for the present.
FTFY.
And it is so just because the DNS infrastructure worked by very unsophisticated rules - good enough for everybody - unsophistication which allowed the rules remain hidden. Break them and more people will start looking into how to mend them in their own way - one may not like some ways of mending.
Questions raise, answers kill. Raise questions to stay alive.
typical users lack the expertise to select a different DNS server
is definitely a true statement.
What it is is bullshit. There would be directions floating around everywhere written at a second grade level on how to do it. If they couldn't figure it out from there they'd ask that tech suave friend or relative to do it. Linux would come pre-configured to hit OpenDNS.
Where in the problem lies is that half the instructions floating around would be pointing to compromised servers. Thus by eliminating the trust aspect that is key to DNS working and making DNSSEC essentially illegal they're going to create exactly what they claim to be trying to prevent, turning the internet into a lawless wild west. I find it absolutely amazing that congress is going to pass a law that will make implementing security measures on the internet illegal. Tells you how deep our government representatives are in the pockets of the RIAA/MPAA crowd.
Who is John Galt?
True statement? Really?
A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server and that the Internet must not be allowed to 'decay into a lawless Wild West.'
Hmmmmmmm. Let me rephrase that differently.....
An inter-office memo from Microsoft was recently released with a statement by an executive arguing that the typical user lacks the expertise to choose a different browser and that apathy and ignorance will allow the Internet to continue to be dominated by Internet Explorer and that the Internet will not devolve into a Wild West of open source competitors taking away market share and that governments and states will not get involved via lawsuits and legislation to affect Microsoft negatively .
You screw around with DNS too hard and you will find that people will fight back. Of course their warnings about fragmentation will most likely be true very quickly. How much of an excuse does China need to form its own root servers and DNS? It would certainly only help them to create and control DNS resolution and to ban all DNS queries to outside networks period. The EU will probably form its own, and interestingly, will probably pick up well over half the US market.
Seriously? Would you choose a DNS "network" that bypasses due process and exposes you to impossible business risks for you and your customers, or a DNS "network" operated without such risks?
When installing IE9 now I can see options on changing default search engines. You can choose default programs now too. Did you think you would see that 5 years ago?
I am willing to bet that if it gets bad enough, even router manufacturers will start giving choices and that open source browsers themselves will start making it easy to configure a computer to use alternate DNS servers, even if it is just for the browser itself.
So far, they have not affected enough people yet, not all that many in actuality, but how much are we arguing about it right now? All they have done is stare at the hornets nest, just wait till they actually throw a rock.
Typical users lack the expertise, because up until now, they didn't need it. I assure you, they will gain this expertise rather shockingly fast. The only way to motivate "typical [l]users" to learn something new is to block something they want. Years ago typical users didn't know how to download HTTP warez, because they didn't understand ZIP files. Years ago typical users didn't know how to access Napster/Kazaa/whatever. Years ago typical users didn't know what a Bit Torrent client was, or why they needed one. Users learn what they need to in order to get what they want.