Slashdot Mirror
Security Consultants Warn About PROTECT-IP Act
epee1221 writes "Several security professionals released a paper raising objections to the DNS filtering(PDF) mandated by the proposed PROTECT-IP Act. The measure allows courts to require Internet service providers to redirect or block queries for a domain deemed to be infringing on IP laws. ISPs will not be able to improve DNS security using DNSSEC, a system for cryptographically signing DNS records to ensure their authenticity, as the sort of manipulation mandated by PROTECT-IP is the type of interference DNSSEC is meant to prevent. The paper notes that a DNS server which has been compromised by a cracker would be indistinguishable from one operating under a court order to alter its DNS responses. The measure also points to a possible fragmenting of the DNS system, effectively making domain names non-universal, and the DNS manipulation may lead to collateral damage (i.e. filtering an infringing domain may block access to non-infringing content). It is also pointed out that DNS filtering does not actually keep determined users from accessing content, as they can still access non-filtered DNS servers or directly enter the blocked site's IP address if it is known. A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server and that the Internet must not be allowed to 'decay into a lawless Wild West.' Paul Vixie, a coauthor of the paper, elaborates in his blog."
When was the Internet anything other than a "lawless wild west"?
15 years ago, 'typical users' didn't know how to use napster. 6 years ago, 'typical users' didn't know how to bittorrent.
This kind of argument shows how little they've learned.
Greetings and Salutations....
Why does this seem like one of those "feel good" laws that politicians pass to get brownie points with their followers, rather than to actually address and fix a problem?
I am more and more convinced that attempts to regulate the Net are a bad idea, and, any official that attempts to do this should be voted out of office or recalled.
YAB - http://blog.beemandave.com/
The typical users will quickly learn how to set their DNS providers if this comes to pass.
Experts: "they can still access non-filtered DNS servers or directly enter the blocked site's IP address if it is known"
MPAA: "typical users lack the expertise to select a different DNS server"
Dear MPAA,
What about the other half of the expert's statement? Typical users are perfectly capable of typing in four numbers with periods between them. Web links and bookmarks can be IP addresses. etc.
No sig today...
I sent my senator a short message detailing many of these concerns about the PROTECT-IP bill. You might be interested in her response.... WARNING: Don't read any further if you still have hope that senators can understand and address technology issues....
Dear Friend:
Thank you for contacting me regarding the Federal Communications Commission's actions relating to the openness of the Internet. I welcome your thoughts and comments.
The Internet is a valuable tool that facilitates business, education, and recreation for millions of Americans. In 2009, an estimated 198 million Americans had access to the Internet. I am committed to ensuring that consumers continue to benefit from the Internet as an open platform for innovation and commerce.
Instrumental to the success of the Internet is the long-standing policy of keeping the Internet as free as possible from burdensome government regulations. Increased investment in upgrading and expanding America’s communications infrastructure, and, in particular, new broadband networks, will ensure that all Americans have access to affordable high-speed Internet. However, in my judgment, intensified regulation of the Internet, such as government-mandated treatment of data, would stifle competition and would decrease the incentive for network operators to invest in critical infrastructure.
The case for additional broadband regulatory authority, or “net neutrality,” has not effectively been made. Broadband investment began to truly flourish when the Federal Communications Commission (FCC) made a decision in 2002 to remove advanced communications technologies from the antiquated common carrier regulatory framework. However, advocates of a larger regulatory footprint have continued to call for net neutrality since 2006.
Unfortunately, the FCC chose to respond by beginning a new proceeding that would reverse the 2002 decision to treat advanced communications services with a "light touch" regulatory approach. On December 21, 2010, by a 3-2 vote, the FCC adopted new rules meant to impose a net neutrality regime on broadband services. I believe these new regulations represent an unprecedented power grab by the Commission to claim regulatory jurisdiction without Congressional authority. This FCC action threatens investment and innovation in broadband systems, places valuable American jobs at risk, and may subject communications companies to new legal liability in the management of their networks.
In response to the FCC's heavy-handed order, I intend to explore every option available to me to keep the Internet free from such burdensome regulations, including introducing a resolution of disapproval in an effort to repeal the new rules. As the Ranking Member of the Senate Commerce, Science, and Transportation Committee, which has jurisdiction over the FCC, I will continue to work to prohibit further net neutrality-based regulations.
I appreciate hearing from you, and I hope that you will not hesitate to contact me on any issue that is important to you.
Sincerely,
Kay Bailey Hutchison
United States Senator
284 Russell Senate Office Building
Washington, DC 20510
202-224-5922 (tel)
202-224-0776 (fax)
http://hutchison.senate.gov/
PLEASE DO NOT REPLY to this message as this mailbox is only for the delivery of outbound messages, and is not monitored for replies. Due to the volume of mail Senator Hutchison receives, she requests that all email messages be sent through the contact form found on her website at http://hutchison.senate.gov/?p=email_kay .
If you would like more information about issues pending before the Senate, please visit the S
Laundry list of distinguished security researchers: "This is a terrible plan, it won't achieve what you want, and it will set back the state of internet security quite dangerously."
MPAA Flack: "Shut up, nerd, the health and security of the internet is not even a secondary objective here."
Yes! Once they get trains going over 50 MPH on the wild frontier of the Information Superhighway tubes then you have all sorts of stuff going on, like women's uteri being ripped right out of em. We can't have that. It's the internet and we need porn on it. For that we need women with intact uteri.
The eternal struggle of good vs. evil begins within one's self.
Interesting that they mention ISP's would block your ability to use other DNS servers. I don't think that, in the end, there is really anything the ISP could do to completely stop you. The worst they could do is block UDP port 53, but that wouldn't stop you from using any kind of tunneling software, especially if you did that tunneling over a secure socket.
Careful with names containing L slashdot.org/~AiphaWolf_HK slashdot.org/~AlphaWoif_HK slashdot.org/~AiphaWoif_HK
No, their use is not particularly harder to track.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
When was the Internet anything other than a "lawless wild west"?
The internet is the wild west, but it is far from lawless... it just so happens that there are very few laws.
One of those laws is the trustworthiness of DNS. The proposal at hand is actually one that makes the internet MORE lawless, not less, as DNS falls utterly as the (relatively) trustworthy backbone of the internet it has been until today.
Who would knowingly point to a DNS server that might mislead them after this is passed? I sure wouldn't.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
A fork of the DNS system is something that I can't wait to see happening. I believe that the changes that ICANN is doing are precisely mean to obstruct the adoption of additional independent TDLs, and honestly if the DNS is not forked soon, attempting to do it later is going to create fragmentation and confusion, specially when ICANN sell some of the independent TLDs that belong to the alternative DNS systems nowadays. I am also, mmm, I'll go with angry, at the ICE taking away domains of companies that operate legally in their own countries (rojadirecta), and I simply don't think that ICANN or the US can be trusted anymore with the control of this vital component of Internet. The RIAA/MPAA have way so much control over the government, and the government have way so much control over ICANN, and ICANN have complete control of the DNS system.
In particular, because these sorts of things would get asked about and talked about. People would learn "Just enter these numbers under DNS and stuff will work again," and they'd do it. Setting DNS servers is not complex, users can easily be taught how to do it, just nobody bothers because they needn't do so. DHCP hands them out and it makes sense to use the ones your ISP provides as they are usually the fastest for you. However it isn't some major technical feat to enter the numbers in the box. There would be sites out there listing unfiltered DNS servers and people would just copy and paste.
The vast majority of Internet users doesn't know their DNS, they probably don't even know what DNS is. They just open their browser (better known as "the Internet"), enter www.slashdot.org and expect to be able to read News for Nerds, Stuff that matters. Maybe not the best example but I bet you get the point.
typical users lack the expertise to select a different DNS server
is definitely a true statement.
A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server and that the Internet must not be allowed to 'decay into a lawless Wild West.
dns filtering came to turkey 5 years ago.
EVERYONE knows how to bypass it now. and i mean everyone who is using internet - the equivalent of the 'mom in idaho' knows how to bypass it. her son, relatives, someone from neighborhood comes and bypasses it for her. people learned what 'opendns' means here. the term 'proxy' have become an everyday term, even in among the tech illiterate crowd. people ask about 'good proxy' to each other. (people learned about it when the courts started to ban i.p.s).
so, random 'mom in turkey' is able to do that, but the organization that represents all movie producers in america shits about otherwise ?
really. what kind of people are you letting you run your country and corporations and corporations' lackey organizations ? idiots ? morons ? bastards ? i think the last one is more likely. (i am not able to bring myself to say ngo regarding mpaa after that kind of idiocy)
Read radical news here
the point is that will change in about 3 days across the USA if the USA tries this. It's not the first country to try DNS filtering, and perhaps despite what recent history might lead one to believe, americans aren't significantly more stupid than people in other countries, which nowadays routinely route around incompetent government/corporate attempts to censor the net.
typical users lack the expertise to select a different DNS server
is definitely a true statement for the present.
FTFY.
And it is so just because the DNS infrastructure worked by very unsophisticated rules - good enough for everybody - unsophistication which allowed the rules remain hidden. Break them and more people will start looking into how to mend them in their own way - one may not like some ways of mending.
Questions raise, answers kill. Raise questions to stay alive.
Technically it doesn't have to conflict with DNSSEC.
First of all ISPs have to stop lying about the A record when you look up a filtered domain (Seems like an oversight if that practice is even legal). Instead they need to send an error response back to the user. I'd suggest a server error message (since "your government don't want you to see this" wasn't included as an error code when DNS was designed).
What the client will do when getting this error is to use the DNS search path provided by the DHCP server along with the DNS server IP. Since the ISP controls the search path, they can ensure it is a domain under which they can provide valid DNSSEC protected domains. Then they make it so that every filtered domain exists as a subdomain under the DNS search path and other domains don't exist there.
Do you care about the security of your wireless mouse?
typical users lack the expertise to select a different DNS server
is definitely a true statement.
What it is is bullshit. There would be directions floating around everywhere written at a second grade level on how to do it. If they couldn't figure it out from there they'd ask that tech suave friend or relative to do it. Linux would come pre-configured to hit OpenDNS.
Where in the problem lies is that half the instructions floating around would be pointing to compromised servers. Thus by eliminating the trust aspect that is key to DNS working and making DNSSEC essentially illegal they're going to create exactly what they claim to be trying to prevent, turning the internet into a lawless wild west. I find it absolutely amazing that congress is going to pass a law that will make implementing security measures on the internet illegal. Tells you how deep our government representatives are in the pockets of the RIAA/MPAA crowd.
Who is John Galt?
And politicians.
Don't forget the damned politicians.
Politicians, lawyers, and judges.
The Unholy Trinity.
Of course, it was inevitable that a source of such wealth, information, and power available to the unwashed such as the internet would become a target for control for such as they.
It had to happen. They by their very nature are unable to tolerate anything that empowers regular people unless it's been made "safe"..."safe" from use against *them* by the people, and "safe" against regular people using it to communicate information, ideas, and wealth created independently from, and unmonitored by, those in power.
I'm surprised the freedom of the internet hasn't been attacked more intensely and with more determination than it has at this point in the 'net's history.
I guess looting the country and the citizens while trying to turn it into a Third-World hellhole takes most of their attention. It must be really hard work, too, judging by the number of vacations they take on the taxpayer's dime.
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
But everyone has a family member or acquaintance who does have that knowledge, and they won't hesitate to ask "hey can you fix the pirate bay for me".
True statement? Really?
A statement by the MPAA disputes these claims, arguing that typical users lack the expertise to select a different DNS server and that the Internet must not be allowed to 'decay into a lawless Wild West.'
Hmmmmmmm. Let me rephrase that differently.....
An inter-office memo from Microsoft was recently released with a statement by an executive arguing that the typical user lacks the expertise to choose a different browser and that apathy and ignorance will allow the Internet to continue to be dominated by Internet Explorer and that the Internet will not devolve into a Wild West of open source competitors taking away market share and that governments and states will not get involved via lawsuits and legislation to affect Microsoft negatively .
You screw around with DNS too hard and you will find that people will fight back. Of course their warnings about fragmentation will most likely be true very quickly. How much of an excuse does China need to form its own root servers and DNS? It would certainly only help them to create and control DNS resolution and to ban all DNS queries to outside networks period. The EU will probably form its own, and interestingly, will probably pick up well over half the US market.
Seriously? Would you choose a DNS "network" that bypasses due process and exposes you to impossible business risks for you and your customers, or a DNS "network" operated without such risks?
When installing IE9 now I can see options on changing default search engines. You can choose default programs now too. Did you think you would see that 5 years ago?
I am willing to bet that if it gets bad enough, even router manufacturers will start giving choices and that open source browsers themselves will start making it easy to configure a computer to use alternate DNS servers, even if it is just for the browser itself.
So far, they have not affected enough people yet, not all that many in actuality, but how much are we arguing about it right now? All they have done is stare at the hornets nest, just wait till they actually throw a rock.
Typical users lack the expertise, because up until now, they didn't need it. I assure you, they will gain this expertise rather shockingly fast. The only way to motivate "typical [l]users" to learn something new is to block something they want. Years ago typical users didn't know how to download HTTP warez, because they didn't understand ZIP files. Years ago typical users didn't know how to access Napster/Kazaa/whatever. Years ago typical users didn't know what a Bit Torrent client was, or why they needed one. Users learn what they need to in order to get what they want.
wget -O /dev/null "http://216.34.181.45/"
--2011-07-18 17:39:41-- http://216.34.181.45/
Connecting to 216.34.181.45:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://slashdot.org/ [following]
--2011-07-18 17:39:42-- http://slashdot.org/
Resolving slashdot.org (slashdot.org)...
this ip address simply re-directs to "slashdot.org".
so this does not solve the problem.