Slashdot Mirror


GCHQ Planning UK-Wide DNS Firewall (thestack.com)

An anonymous reader writes: UK surveillance agency GCHQ is exploring the use of a national 'firewall' in its fight against cybercrime, according to the organisation's head of cybersecurity. Alongside BT, Talk Talk and Virgin Media, GCHQ will work to filter out websites and email campaigns which are known to contain malicious content. The intelligence organisation believes that the best to way to set up such a blockade would be to build a national domain name system (DNS). In a speech delivered at the Billington Cyber Security Summit in Washington DC, director general for cyber security at GCHQ, Ciaran Martin, said: 'We're exploring a flagship project on scaling up DNS filtering: what better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with known malware and bad addresses?'

194 comments

  1. and then block porn / 3rd party candidates / free by Joe_Dragon · · Score: 5, Insightful

    and then block porn / 3rd party candidates / free press.

  2. Well.... by Anonymous Coward · · Score: 0

    I'm really surprised everyone is worried about the NSA more than GHCQ.

    1. Re:Well.... by Anonymous Coward · · Score: 2, Insightful

      Hmm well if you understood what a DNS was you might feel differently. This would be easily circumvented but would protect the masses from malicious sites and for once it seems like a reasonable idea from a national agency.

    2. Re: Well.... by Anonymous Coward · · Score: 1

      Are they going to just redirect all DNS attempts? Or are people using 8.8.8.8 or other public DNS servers affected?

    3. Re: Well.... by Anonymous Coward · · Score: 0

      Lulzoroffly. I like how you think it could be easily circumvented. Lrn2dns/netwrk.

    4. Re:Well.... by Anonymous Coward · · Score: 0

      Yes, censorship by the government is always grand, especially when it's for the good of the people. /s

    5. Re:Well.... by Anonymous Coward · · Score: 0

      also makes it easier to see who is not following the party line and filter their IP's based on not sanctified dns requests. no different than if you use onion you are in the "interesting" group

    6. Re:Well.... by AHuxley · · Score: 1

      The GCHQ was still trying to get paper files into computers into the 1970's. The US went fully digital via plain text databases thanks to better much hardware funding, staff funding and different collection issues.
      When the UK was able to fully fund the GCHQ again following massive 1960's Skynet satellite https://en.wikipedia.org/wiki/... costs and many other very expensive upgrades and creative cash flow issues, collect it all was again seen as a solution for Ireland and the world.
      The NSA always got the hardware to collect it all domestically and globally. But had to hide the domestic part from the US press and some very smart lawyers who wondered about the real origins of federal and state trials.
      The problem for the UK is the GCHQ/NSA sold US consumer junk encryption too well globally and the UK actually has too much US consumer hardware and software as part of its own sensitive dual use networks. Nobody wanted the secret of all consumer crypto been junk to get out so UK govs just ordered ever more junk US brands in and used junk standards for decades.
      Telling the UK to remove the US consumer junk kind of gives the collect it all game away so a huge new national firewall to try and protect the low quality US code and useless hardware at a national level is now the only solution.
      Filling your own nation with the junk software and weak encryption that allows the NSA and GCHQ to spy on the rest of world without any later issues was unexpected as all the focus was on collection and who to share the product with. Only the NSA and GCHQ had to be kept safe as everyone else was of great interest under collect it all.
      US, EU trade deals and standardization, privatization has come back to haunt once hardened UK networks. The UK is now as wide open as all the other nations it collects all from thanks to having no UK only telco policy.
      Vast, fast, wide open networks now sit on the very edge or coexist with the UK's most sensitive mil and gov networks thanks to decades of fully out sourced contractor design.

      --
      Domestic spying is now "Benign Information Gathering"
  3. Good, Bad And Ugly by alternative_right · · Score: 5, Insightful

    The Good: if there are known threats that can be filtered, this is the most efficient level on which to do them.

    The Bad: this will inevitably be extended to blocking torrent sites, Wikileaks and any web sites I administer.

    The Ugly: it will create a false sense of security, "educating" users to be less educated about their machines.

    1. Re:Good, Bad And Ugly by MatiasKiviniemi · · Score: 1

      The Uglier: It will need to have some real-time aspect to it to be at all effective in quickly blocking threats (not enough to have daily updated lists). This easily becomes a national SPOC for all web traffic, with GCHQ alerted everytime someone accesses a flagged "terrorist" website. That might actually be a good idea, but the fact they spin it as as a "malware defence" does not sound promising.

    2. Re:Good, Bad And Ugly by Anonymous Coward · · Score: 0

      The bit about "protecting you" is a trojan horse -- the advantage for the spy agency is that with such a system they can censor, log and man in the middle just about everyone in the UK with very little effort and no oversight.

    3. Re:Good, Bad And Ugly by freeze128 · · Score: 1

      The Bad: this will inevitably be extended to blocking torrent sites, Wikileaks and any web sites I administer.

      That's OK. You can just run your own DNS server, and add those missing entries. You're welcome!

    4. Re:Good, Bad And Ugly by MightyMartian · · Score: 1

      Well, it's bad no matter how you look at it, primarily because even if you accept that filters are good, by and large they're ineffective, and are very prone to false positives.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    5. Re:Good, Bad And Ugly by smash · · Score: 1

      Except you know... your DNS needs to contact remote DNS servers for lookups which are then redirected to the government DNS on the great firewall of ...

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    6. Re:Good, Bad And Ugly by zlives · · Score: 1

      the idea maybe that the flagged terrorist site is not in the DNS at all. so the rhetoric that could be considered "poisonous" is not accessed. the issue maybe what is considered "poisonous", terrorism today and free speech tomorrow.

      it would be interesting if this was a transparent effort where the logic/decision tree was available for discussion.

      the ugly is if you type in www.theguardian.com are you getting the guardian or just a reasonable facsimile of it with the appropriate malware injected.

    7. Re:Good, Bad And Ugly by zlives · · Score: 1

      just point to the remote DNS hosted by the NSA instead, there is still some freedoms allowed in the US.

    8. Re:Good, Bad And Ugly by zlives · · Score: 1

      also where is the host files guy when you need him

    9. Re:Good, Bad And Ugly by amxcoder · · Score: 3, Insightful

      Not much good in this at all. There are already alternative DNS providers that will block most of this stuff selectively by each user. I use OpenDNS myself for this purpose. This is effectively censoring by the government, and nothing less.

      Yes, it will eventually used to block torrent sites, the Pirate Bay, etc. It will be used to block any of the other downloading sites that are available whether they are torrent trackers or straight downloads or streaming sites.

      Even more, if riots break out, or dissension protests start up, all of a sudden Twitter and FB will be temporarily blocked to prevent coordination by participants. The US has already done similar to this, for instance in bay area BART stations where they shutdown the cell phone repeaters to prevent communication in the stations when Oakland had riots/protests going on. If UK can do it by simply blocking DNS to these sites, the same results will happen.

      Who decides what is considered "MalWare"? What are the criteria? Malware could be the typical kind, but could also include hacking software, keygen apps, apps that the RIAA/MPAA and big-media doesn't like? Everyones idea of what is malware, is probably slightly different. Viruses yes, but not all the others are malware. I know most virus scanners pick up keygen's and other cracking software as a virus even if it's not, but because want to scare away people from using them.

    10. Re:Good, Bad And Ugly by ShaunC · · Score: 1

      Except you know... your DNS needs to contact remote DNS servers for lookups which are then redirected to the government DNS on the great firewall of ...

      If I tell my DNS server it's authoritative for wikileaks.org and thepiratebay.se, it doesn't contact any remote servers to resolve those domains, it answers with whatever IPs I configured. Let it forward the rest of the queries happily along. If this "Great DNS Firewall" idea takes off, I suppose free thinkers in the UK will all be trading bootleg zone files, of all things.

      --
      Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
    11. Re:Good, Bad And Ugly by rubycodez · · Score: 1

      Missing the obvious, good citizen.

      Memory hole! Censorship! It didn't happen, it never happened.

    12. Re:Good, Bad And Ugly by rubycodez · · Score: 1

      OpenDNS is owned by Cisco, talk about having your tongue up the ass of the kind of corporate fascist scum who have governments in their pocket.....

    13. Re:Good, Bad And Ugly by mjwx · · Score: 1

      The Good: if there are known threats that can be filtered, this is the most efficient level on which to do them.

      The Bad: this will inevitably be extended to blocking torrent sites, Wikileaks and any web sites I administer.

      The Ugly: it will create a false sense of security, "educating" users to be less educated about their machines.

      Erm.. the UK already requires ISP's to block torrent sites. It's as effective as an ashtray on a motorbike. Every torrent site can be accessed via a simple google search and they've simply given up on playing whack-a-mole with new URLs. As long as they have "thepiratebay.*" blocked, ISP's have effectively done all they legally have to and stooped caring.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    14. Re:Good, Bad And Ugly by amxcoder · · Score: 1

      My comment about OpenDNS was just an example of a service that does what they are proposing already, and is opt-in only, and is not run by the government, and is customizable by the user (or network admin) to select what gets blocked and what doesn't, rather than some secret hidden list of sites. If you don't like OpenDNS, then pick another provider, or run your own DNS server.

      I've used it for years without issues. If I have problems or don't like what they are doing, I can always point my home router to a different DNS provider and viola, I'm using a different service. You aren't stuck using them, and they aren't forced on you like is the possible implication of what the article is about.

      It is unclear at this point, whether this would be possible to do with the system mentioned. It might be as easy as changing your DNS settings to point to 8.8.8.8 or something... or... they could be checking all outbound DNS requests and even if you are pointing to another provider it will still be blocked. If the worse case scenario, then your only option is to VPN through the blockade to use a different DNS service, which becomes more difficult for average people to do.

    15. Re:Good, Bad And Ugly by F.Ultra · · Score: 1

      So if the threats are well known by organisations with power like the GCHQ, why don't they instead do something about them? Yes the operate from within other countries but since when have that stopped the likes of GCHQ?

    16. Re:Good, Bad And Ugly by grcumb · · Score: 1

      The Good: if there are known threats that can be filtered, this is the most efficient level on which to do them.

      The Bad: this will inevitably be extended to blocking torrent sites, Wikileaks and any web sites I administer.

      The Ugly: it will create a false sense of security, "educating" users to be less educated about their machines.

      The un-fucking-believably stupid: Ignoring the capacity for police state tactics in surveilling the domestic population, this is the same as tacking a bullseye onto the nation's internet and telling every terrorist, rogue nation and hacktivist:

      DO NOT PRESS THIS BUTTON. THIS ONE. RIGHT HERE. IT WOULD BE VERY BAD. SO DON'T PRESS IT.

      --
      Crumb's Corollary: Never bring a knife to a bun fight.
    17. Re:Good, Bad And Ugly by ben_kelley · · Score: 1

      and any web sites I administer

      Dude! Cred!

    18. Re:Good, Bad And Ugly by l0n3s0m3phr34k · · Score: 1

      GCHQ will have to block themselves off from the rest of the UK. Quite ironic.

    19. Re:Good, Bad And Ugly by AmiMoJo · · Score: 1

      At this point, I'm just recommending everyone start using European VPN services. Block your ISPs data collection, block censorship, block IP based tracking and geolocation.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  4. What could go wrong? by Anonymous Coward · · Score: 0

    GCHQ will work to filter out websites and email campaigns which are known to contain malicious or political content.

  5. Won't work. by BarbaraHudson · · Score: 4, Insightful

    You don't need DNS to visit a website. Also, there's nothing preventing you from running your own DNS.

    --
    "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
    1. Re:Won't work. by i.r.id10t · · Score: 1

      Well, with name based virtual hosts you certainly need some sort of name to send the request to, whether provided by DNS or /etc/hosts or whatever.

      And yes, running your own DNS is trivial. IF your provider isn't blocking requests out that aren't headed to their own servers, much like smtp and port 25....

      --
      Don't blame me, I voted for Kodos
    2. Re:Won't work. by Anonymous Coward · · Score: 2, Insightful

      Agreed.

      The Internet was designed to route around disruptions in the network. Censorship one type of disruption.

      If an end user doesn't like what GCHQ is doing, they can:
          1. Install a DNSSEC-enabled nameserver software on their end device or home network to bypass the firewalls and detect man-in-the-middle rewrties.
          2. Utilize another open recursive server - there are millions to choose from.
          3. Utilizea a VPN to get out of the country and utilize Google or OpenDNS or whatever recursive server via their tunnel endpoint.

      All this system would do is make Internet access more difficult/intrusive for UK citizens who don't want to be sheep.

    3. Re:Won't work. by Anonymous Coward · · Score: 0

      Depends how they implement this -- for instance if they enforce usage by blocking Ingres/egress of DNS protocols except for their dns proxy they effectivly ensure you must use their system, including the censorship and man in the middle/logging attacks. The only way around this would be to tunnel (such as vpn) outside their boarder. to another dns service.

      This is a horrible idea and the population should flip the fuck out -- this is the type of thing you would expect from chine/north korea or russia not UK.

    4. Re:Won't work. by The-Ixian · · Score: 1

      I wonder if they plan on proxying DNS requests leaving the country? If so, the only workaround would be to use encryption and/or DNSSEC and a DNS server outside the country... possibly on a non-standard port in case they block 53.

      --
      My eyes reflect the stars and a smile lights up my face.
    5. Re:Won't work. by Anonymous Coward · · Score: 1

      Anedoctal:

      I have a Raspberry Pi running bind. It resolves my internal names (yes, I went to the trouble of this) and also works as my server. It filters well known ad and tracking sites directly.

      I use MVPS HOSTS File (http://mvpshostsnews.blogspot.com.br/) to keep my list.

    6. Re:Won't work. by Anonymous Coward · · Score: 0

      In the context malware delivery, it's going to make the bad guy's job much more difficult. Read up on FastFlux.

    7. Re:Won't work. by myowntrueself · · Score: 2

      You don't need DNS to visit a website. Also, there's nothing preventing you from running your own DNS.

      Hmm intriguing idea. I guess you could run your own DNS root server and maintain your own records for everything on all zones on the Internet. Its going to take some bandwidth to keep all that updated!

      But if you are thinking of just running your own local DNS server then its going to need forwarders and those forwarders are going to either be within the firewall and thus limited or outside the firewall and inaccessible.

      Or you could use an alternative port on a DNS forwarder outside the firewall. Some DNS servers run on 5353 but you could run it on whatever port you wanted. Until they start doing deep packet inspection and block your non-standard port DNS traffic because its obvious DNS traffic.

      I don't see any indications of an SSL-wrapped DNS protocol..?

      --
      In the free world the media isn't government run; the government is media run.
    8. Re:Won't work. by serviscope_minor · · Score: 1

      You don't need DNS to visit a website. Also, there's nothing preventing you from running your own DNS

      So, why don't it work? The plan is apparently to stop malware with DNS filtering. They're not going to stop you running your own DNS and visiting the malware sites if you really want to.

      --
      SJW n. One who posts facts.
    9. Re:Won't work. by MightyMartian · · Score: 1

      It wouldn't be proof against VPNs, so there's already a way around this. As usual, such measures might catch the low hanging fruit, but anyone with even a moderate degree of technical ability could get around it.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    10. Re:Won't work. by Anonymous Coward · · Score: 0

      You don't need DNS to visit a website. Also, there's nothing preventing you from running your own DNS.

      That's why it's so baffling to me that the supposed "experts" picked DNS as the solution.

      If they really were "experts", it seems like they would have at least included IP-address blocking as part of the solution.

    11. Re:Won't work. by SuricouRaven · · Score: 1

      Because if you can stop the 90+% of regular users from getting the malware-of-the-week, that's a win. Most people wouldn't even realise what was going on.

    12. Re:Won't work. by Anonymous Coward · · Score: 0

      I also run my BIND at home. However, pure DNS requests can be intercepted at ISP or country level, and redirected to any DNS server of their choice. Rumor is China does this. Some free public wifi also do that. What you can do against that is talking encrypted DNS, DNSCrypt with OpenDNS being one of the choices.

    13. Re:Won't work. by serviscope_minor · · Score: 1

      I think we're in agreement.

      --
      SJW n. One who posts facts.
    14. Re:Won't work. by The-Ixian · · Score: 1

      Until they block any encrypted traffic at the border...

      --
      My eyes reflect the stars and a smile lights up my face.
    15. Re:Won't work. by brantondaveperson · · Score: 1

      The VPN solution is hard to workaround, but it does require someone to purchase a VPN server somewhere. Blocking access to 'unauthorised' DNS server would be straightforwards if the UK cared to spend the money on the filtering hardware. Hell, they could even require you to apply for some kind of licence before they permit VPN traffic to be allowed out of your home connection. The UK are deadly serious about trying to lock down the internet, and now that they've decided to leave the EU, I don't see how anyone can stop them if they decide to try hard enough.

    16. Re:Won't work. by MightyMartian · · Score: 1

      Which would cause immeasurable damage to a country that right now is trying to sell itself as open for business, seeing as it is preparing to leave the EU.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    17. Re: Won't work. by Anonymous Coward · · Score: 0

      That's all OK unless you are using a smartphone.

    18. Re:Won't work. by l0n3s0m3phr34k · · Score: 1

      That won't happen, the powers-that-be like banks, businesses, etc need that to function. That would clean out London's financial sector faster that Brextit ever could. Might as well just shut the LSE down and turn off the lights on the way out.

    19. Re:Won't work. by AHuxley · · Score: 1

      Just create a staging server within the UK, England and its a trusted local network request :)

      --
      Domestic spying is now "Benign Information Gathering"
    20. Re:Won't work. by BarbaraHudson · · Score: 1
      All web browsers check the local hosts file first, before making a dns request. If it's in hosts, they don't make a DNS request. In the early days, everyone just had a hosts file with a bunch of IPs

      Using a simpler, more memorable name in place of a host's numerical address dates back to the ARPANET era. The Stanford Research Institute (now SRI International) maintained a text file named HOSTS.TXT that mapped host names to the numerical addresses of computers on the ARPANET. Host operators obtained copies of the master file.

      (this uses the term 'host" to mean this

      In Internet protocol specifications, the term "host" means any computer that has full two-way access to other computers on the Internet. A host has a specific "local or host number" that, together with the network number, forms its unique IP address.

      So anyone who just wants to visit their favorite sites doesn't need DNS.

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
    21. Re:Won't work. by BarbaraHudson · · Score: 1

      You don't need to update the zone files all the time - and you could always have a pool, run by different people locally, so you get redundancy and less needed to be stored on each machine. Even just the top 10,000 sites would be enough for most people.

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
  6. ++good by dagrichards · · Score: 1

    This will assist them in their budding mental hygiene program to prevent thought crimes, and of core protect "intellectual" property.

  7. People's Republic of Great Britain by Errol+backfiring · · Score: 5, Insightful

    How many times do we have to say that 1984 was not an instruction manual?

    --
    Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
    1. Re:People's Republic of Great Britain by LichtSpektren · · Score: 1

      That's funny, I re-read Nineteen Eighty-four recently and I didn't see anything about a national DNS being used to restrict Internet access from the proles and Outer Party.

      In all seriousness, I don't think this is that big a deal. >99% of people already blindly trust their DNS to their ISP (generally about as untrustworthy as governments are in any case), and those that don't won't be affected by any regulations the UK wants to impose.

    2. Re:People's Republic of Great Britain by Anonymous Coward · · Score: 0

      That's funny, I re-read Nineteen Eighty-four recently and I didn't see anything about a national DNS being used to restrict Internet access from the proles and Outer Party.

      And Mein Kampf said nothing about trying to eliminate all the Jews and bombing London, yet that was the result all the same.

    3. Re:People's Republic of Great Britain by Anonymous Coward · · Score: 0

      That's because it's an allegory you autistic faggot.

    4. Re:People's Republic of Great Britain by rubycodez · · Score: 1

      There was an internet in *1984*. Pay attention.

      There also were those who controlled what was remembered, and those who architected language with the end goal of non-state approved concepts being impossible to express or even conceived.

    5. Re:People's Republic of Great Britain by AmiMoJo · · Score: 2

      They will never stop pushing, so we must never stop pushing back.

      The price of freedom is eternal vigilance.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    6. Re:People's Republic of Great Britain by LichtSpektren · · Score: 2

      There was an internet in *1984*. Pay attention.

      The Internet existed in real life in the year AD 1984, yes. There was no internet in the novel Nineteen Eighty-Four by George Orwell, which was written in AD 1949.

      There also were those who controlled what was remembered, and those who architected language with the end goal of non-state approved concepts being impossible to express or even conceived.

      You're referring to the Ministry of Truth and Newspeak, respectively. Both of which have nothing to do with a national DNS. Now, it's true that the government could make it annoying to access unapproved websites, and there's nothing wrong with being skeptical of their intentions, but to say it's Orwellian is a massive hyperbole. Governments all throughout time have engaged in censorship and repression, it takes a lot more than that to reach Stalinism.

    7. Re:People's Republic of Great Britain by rubycodez · · Score: 1

      Again, you didn't pay attention, there most certainly was an internet in the novel 1984 which was written in 1949: the TV was two-way

    8. Re:People's Republic of Great Britain by LichtSpektren · · Score: 1

      Now you're just trying to cover your ass because you said something blatantly false. The telescreen was two-day, but it wasn't connected to a network of any sorts. Unless you're going to tell me that every walkie-talkie on earth is its own Internet.

    9. Re:People's Republic of Great Britain by rubycodez · · Score: 1

      Wrong, the TV system had to have networking ability to allow government user ability to selectively view any home.

      By the way I actually designed and built video switching systems in the 1970s. You don't have mind of an engineer, you don't realize the implied infrastructure of such a system

  8. 8.8.8.8 by Anonymous Coward · · Score: 1

    or 4.4.4.4

    1. Re:8.8.8.8 by Anonymous Coward · · Score: 0

      You mean 8.8.4.4. The one you said is some random Level 3 server that doesn't do DNS.

    2. Re:8.8.8.8 by Anonymous Coward · · Score: 0

      I'd imagine they're planning to intercept DNS packets to these (and other non-UK) servers and redirect them to the ones they approve. So knowing that IP wouldn't be sufficient... you'd probably need a VPN or some other method of avoiding their DNS firewall.

    3. Re:8.8.8.8 by The-Ixian · · Score: 1

      I thought that 8.8.8.8 was the "primary" and 8.8.4.4 was the "backup" (both being Google's public DNS servers)

      I could be wrong.

      --
      My eyes reflect the stars and a smile lights up my face.
    4. Re:8.8.8.8 by Anonymous Coward · · Score: 0

      This is already done by Vodafone for their residential ADSL customers - at least here in Italy. Regardless by your DNS configuration, all requests are routed to their local servers to the effect that, for instance, a) you are stuck with them whenever their DNS servers fail and b) you can not access domains declared "illegal" by any court.

    5. Re:8.8.8.8 by Anonymous Coward · · Score: 0

      I have got a BIND at home+DNSCRYPT to OPENDNS on port 443...it works pretty well.

    6. Re:8.8.8.8 by nctritech · · Score: 1

      8.8.8.8 is Google DNS. 4.2.2.3 is Level3 DNS. 4.4.4.4 is a brain fart. *poot*

  9. What is dnssec by Anonymous Coward · · Score: 0

    Trying to control the internet never works.

  10. The Great Firewall of the UK by Anonymous Coward · · Score: 0

    Like China, the UK has decided that its subjects need protection from all the bad things rattling around in the outside world. And who gets to decide which bad things will be banned? Guess.

  11. Re:and then block porn / 3rd party candidates / fr by Buchenskjoll · · Score: 2

    It's England. More than two parties is encouraged.

    --
    -- Make America hate again!
  12. Allow opt-out by Midnight+Thunder · · Score: 1

    If they do this, I hope that they will allow an opt-out. Anything else would feel like an act of censorship, even if that may not be the intent.

    --
    Jumpstart the tartan drive.
    1. Re:Allow opt-out by Zocalo · · Score: 1

      Nothing should *ever* be opt-out. The default should always be to opt-in. If you can't make that enabling process easy to do and successfully sell the idea to your prospective end users (AKA "source of data" - because they are absolutely going to be saving all your DNS queries as "metadata"), then maybe it wasn't such a good idea to start with.

      --
      UNIX? They're not even circumcised! Savages!
    2. Re:Allow opt-out by Midnight+Thunder · · Score: 2

      Nothing should *ever* be opt-out. The default should always be to opt-in. If you can't make that enabling process easy to do and successfully sell the idea to your prospective end users (AKA "source of data" - because they are absolutely going to be saving all your DNS queries as "metadata"), then maybe it wasn't such a good idea to start with.

      I won't argue with that, though I was more thinking about the alternative of not having a choice (opt-in or opt-out), as to having this imposed. I just don't want to see a 'Great Moat of Britain', being imposed. There are enough right wing isolationist attitudes at play, in the country today, that we don't need another one added to the fray.

      --
      Jumpstart the tartan drive.
    3. Re:Allow opt-out by Archtech · · Score: 1

      If they do this, I hope that they will allow an opt-out. Anything else would feel like an act of censorship, even if that may not be the intent.

      Hahahahahahahaha! Of course that's the intent. And of course they won't allow an opt-out. Even if they did, to ask for it would be more or less to hang a big sign round your neck saying, "TERRORIST!"

      --
      I am sure that there are many other solipsists out there.
  13. FTFY GCHQ by Anonymous Coward · · Score: 2, Insightful

    what better way of providing national surveillance

  14. We (the US) should not give control away. by rickb928 · · Score: 1

    Because, if for no other reason, the World will be controlling their Internets anyways.

    Let them.

    --
    deleting the extra space after periods so i can stay relevant, yeah.
  15. Drop List or censored government DNS server? by alanxyzzy · · Score: 1

    If this is just supplying a list of IPs, as Spamhaus, OpenBL and Dshield do, then it's nothing much to be concerned about. OTOH ... https://www.spamhaus.org/drop/ http://www.openbl.org/ https://www.dshield.org/xml.ht...

    1. Re:Drop List or censored government DNS server? by Anonymous Coward · · Score: 1

      DNS is not the best place to implement IP blocklists, even with RPZ-IP. Command and control services can still bypass DNS. It's much better to use DROP and other IP blocklists as intended: to block reportedly-malicious traffic at layer 3.

      The harm from implementing a large-scale DNS firewall to the DNS system exceeds the benefit.
      Let users (and ISPs of those users) protect themselves with IP or DNS firewalls they manage, not the government.
      If the government wants to publish an advisory list of bad domains or IP addresses for their citizens to utilize, great!
      If they want to force them to use them by default, not so great.

    2. Re:Drop List or censored government DNS server? by Archtech · · Score: 1

      The harm from implementing a large-scale DNS firewall to the DNS system exceeds the benefit.

      Once again, of course it does! That's the whole idea. (But it rather depends from whose point of view you are defining "harm" and "benefit").

      --
      I am sure that there are many other solipsists out there.
  16. Once more with spirit! by sjbe · · Score: 1

    How many times do we have to say that 1984 was not an instruction manual?

    Evidently one more time as always.

  17. ICANN Transfer by Maltheus · · Score: 1

    This is a slippery slope and it's one of the reasons we shouldn't try to fix what isn't broken, by giving up control over domain assignments. We have more of a hands off tradition over here that other countries do not necessarily share.

  18. This really isn't needed by Anonymous Coward · · Score: 0

    Email services typically catch a lot of the malware these days. Redirects and web malware are also handled well by private DNS servers and you can even opt to use a DNS service like Open DNS. This is all done in the private sector without any need for government. Typical of the UK to control every aspect of your web experience.

  19. Re:and then block porn / 3rd party candidates / fr by Anonymous Coward · · Score: 0

    I'm presuming 3rd parties, he meant non corporate approved parties

  20. Drawbacks of ways to visit a site without DNS by tepples · · Score: 2

    You don't need DNS to visit a website.

    I can think of two ways to visit a website without DNS, and both have serious drawbacks.

    Add the IP address and name to the hosts file This breaks whenever the site's IP address changes. This file is traditionally editable only by root, and root access is often impractical to gain on any type of device other than a desktop or traditional laptop PC, especially a smartphone or a tablet computer running a smartphone operating system. (Finally, recommending the use of such a file summons him.) Enter the IP address in the URL instead of the hostname This also breaks whenever the site's IP address changes. In addition, it produces a certificate error, as certification authorities issue TLS certificates to operators of hostnames, not IP addresses. If you attempt to work around the certificate error by using legacy cleartext HTTP instead of HTTPS, you lose access to sensitive JavaScript features that browsers have begun to expose only to HTTPS sites, and a man in the middle can easily alter what you see. And either way, you can see only the first site on a given IP address, not other sites hosted on the same address using name-based virtual hosting.

    Also, there's nothing preventing you from running your own DNS.

    Other than border security intercepting all outbound connections or datagrams on port 53.

    1. Re:Drawbacks of ways to visit a site without DNS by MikeDataLink · · Score: 2

      Other than border security intercepting all outbound connections or datagrams on port 53.

      Not necessarily. A VPN to a n external server and they would never know what is inside that tunnel.

      --
      Mike @ The Geek Pub. Let's Make Stuff!
    2. Re:Drawbacks of ways to visit a site without DNS by Anonymous Coward · · Score: 0

      A legitimate website's IP will rarely change.

    3. Re:Drawbacks of ways to visit a site without DNS by darkain · · Score: 2

      This is highly untrue, actually. Larger web sites don't run on a single IP address, they run on a collection of IP addresses using various redundant networks (such as IP load balancing by issuing different addresses from DNS requests). This also allows for easier system maintenance while maintaining 100% uptime. Need a server to go down for a while in the pool? Just remove that server's IP address from the DNS load balancing pool, wait some time for client DNS caching to expire, then take down that particular machine. Effectively, the web site has "a new IP address" for a subset of clients now.

    4. Re:Drawbacks of ways to visit a site without DNS by Anonymous Coward · · Score: 0

      Not necessarily. A VPN to a n external server and they would never know what is inside that tunnel.

      Until it spreads to other countries, until they use it on the DNS roots, until they require registration for any network traffic at all...

      Sure you'll probably always be able to find a way to bypass or hide. But the cost and risk involved will increase too. And pretty soon, complete tyranny.

    5. Re:Drawbacks of ways to visit a site without DNS by rubycodez · · Score: 1

      Nope.

      You also need the desired host name as part of your browser's web request, because most websites share an IP address with other web sites. Than means your going to have to either have a giant-ass hosts file or your own name server that magically gets updated with hundreds of millions of DNS records.

    6. Re:Drawbacks of ways to visit a site without DNS by blindseer · · Score: 1

      Why would they continue to allow a VPN across this nationwide firewall?

      The goal is to protect the Britons from "bad" websites as defined by the government. The first thing they want to try is to hide these sites from Britons by removing any DNS entry to them. When the government realizes that people are circumventing their firewall then I'd fully expect them to do what they can to block that traffic as well.

      This is doomed to fail since, as you predict, people will find a way around it. If they are successful in gaining control of DNS servers within the UK then expect them to follow with greater controls on the internet once circumventing the firewall becomes nearly routine. This will end in one of two ways, either they succeed in killing the internet and something else replaces it, or people get exceedingly upset with the inability to communicate freely on the internet and these idiots that think they can control the internet are removed from government.

      --
      I am armed because I am free. I am free because I am armed.
    7. Re:Drawbacks of ways to visit a site without DNS by l0n3s0m3phr34k · · Score: 1

      At my work, we just do yum -y update on our production servers, or just install 50+ patches in the middle of the day. If that fails, just plug some random switch back into itself and packet storm the whole thing to death.

  21. "contact with known malware and bad addresses" by Anonymous Coward · · Score: 0

    yeah, sure. And Childporn. Or Just Porn. Or Filesharing. Or bad political opinions. Or any form of "bad" content (as defined by the royal court for social cleanliness)...

  22. A journey must begin with a single step by QuietLagoon · · Score: 1
    A journey of a thousand miles must begin with a single step. --- Lao-tzu

    .
    This looks like the first step towards censorship to me. What will be next on the list of Things That Should Be Blocked?

    1. Re:A journey must begin with a single step by Anonymous Coward · · Score: 0

      It wont be blocked unless it's a torrent site, because no one can actively complain about that kind of censorship without being attacked. Instead they would use much more passive measures... it's the GCHQ AKA NSA bro. forcing the whole country to go to the GCHQ for DNS queries is a mass surveillance wet dream. They don't want to stop you visiting things they want to watch you visiting things and then fuck you up afterwards.

  23. Automated defences at scale? by Anonymous Coward · · Score: 0

    Double edged sword -- such a system also makes it trivial to utilize DNS to attack users, deploy spyware and man in the middle for the spy services. Basically this would be equivalent to reducing their effort to own any device in the UK to kindergarten levels of effort.

    Such a bad idea state controlled and managed censorship and exploit in one.

  24. And this shall be named... by xfade551 · · Score: 4, Funny

    Hadrian's Firewall

  25. Re:and then block porn / 3rd party candidates / fr by Anonymous Coward · · Score: 0

    Still encouraged, since FPTP means it's literally throwing your vote away.

  26. Comment by WallyL · · Score: 1

    So am I misunderstanding, or would it be easy enough to avoid this "firewall" by simply changing your DNS server settings?

    1. Re:Comment by rubycodez · · Score: 1

      maybe ISP won't allow udp & tcp 53 to any endpoint but their nameservers, they'll be required to only allow theirs to be accessible. sure, geeks can work around that but a regular joe?

  27. The Great Firewall of Britain! by Archtech · · Score: 5, Insightful

    "[W]hat better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with known malware and bad addresses?"

    What better way of allowing the UK government to censor what British people can see and hear on the Internet, without the huge majority of them having any idea that their Internet access is being censored?

    And for those who have suggested this is no big deal, just wait. This is a case of "First they came for the communists", with a vengeance. Quite apart from the fact that this is exactly what the Chinese government has been doing with its "Great Firewall of China" - and getting it in the neck for alleged tyranny, totalitarianism and censorship.

    Of course, how this policy would work out in practice does depend very much on who decides what constitutes "known malware and bad addresses [sic]". Previous draconian laws passed by the British Parliament were, we were solemnly promised, to be used only in the most serious of terrorist cases. A couple of years later, the powers were in fact being used by town councils to spy on what people put into their rubbish, how they kept their gardens, and other such personal and utterly non-vital matters.

    If a law is passed establishing a "Great Firewall of Britain", we can be quite sure that within a couple of years literally thousands of government employees - from the Prime Minister to town hall clerks - will be contributing "bad addresses" to the cumulative DNS blacklist. Just like the current Homeland Security watch lists in the USA, thousands of items will be added every month, and nothing will ever be removed.

    Indeed, people living in Britain may well find that, one day in the not-too-distant future, they are no longer able to read or contribute to Slashdot. After all, just think of all the contentious issues and worrying statements that are to be found on its pages! Some government functionary - or, perhaps more likely, an instance of that classic responsibility-diffusing mechanism, a committee - will take the view that it would perhaps be for the best if this rather dubious Web site were no longer to be accessible from the UK.

    --
    I am sure that there are many other solipsists out there.
    1. Re:The Great Firewall of Britain! by Anonymous Coward · · Score: 0

      Dialup.

      Innit.

    2. Re:The Great Firewall of Britain! by Anonymous Coward · · Score: 0

      That Second Amendment doesn't sound so barbaric now, does it?
      But never mind the logic, never mind the statistics, never mind the history, keep voting for more government power and patting your British selves on the back about how great you were.

  28. As they're great buddies by Limitless_Potential · · Score: 1

    with the Chinese, I'm sure they'll give you a copy of their firewall.

  29. More Theresa May by Anonymous Coward · · Score: 1

    Browsers already block known attack sites, including GCHQs, so GCHQs list would be smaller (excluding their own malware). It adds nothing, it takes it away.
    It doesn't prevent attack, because a DDNS attacker does not query every time for the DNS address, and there's no reason for malware to reference a known address or even reference it by DNS name.

    So the claimed purpose does not match the technical basis. More likely bulk surveillance of Brits.

    The only reason only a women is made Home Secretary is because men have Porn surfing histories and GCHQ monitors/ can leverage that. So since they started their illegal 'Mastering the Internet' domestic surveillance program, all Home Secs have been women. It was Theresa May, currently it's "Amber Rudd".

    Without surveillance Theresa May would likely not have been Home Secretary, and from that position she magically leveraged her way into the PM slot, shortly after pushing Snoopers Charter through the House of Commons. i.e. she's not elected as PM, and as Home Secretary she had access to surveillance data not available to her rivals. It is implausible that a group acting against British interests (GCHQ), with a ludicrous interpretation of UK laws, didn't help her with all this surveillance data it happened to be collecting on Britains, including all of her rivals.

    She is not our PM, she is their's. Until she faces a fair election without GCHQs bulk surveillance, she is not the PM, she is a puppet. When will she hold an election? Cameron has resigned, she needs to go to the people and get elected.

    1. Re: More Theresa May by Anonymous Coward · · Score: 0

      British PMs are never elected, their party is.

    2. Re: More Theresa May by myowntrueself · · Score: 1

      British PMs are never elected, their party is.

      I think the PM still has to win their seat. Has a PM ever served where their party won FPTP but they didn't win their seat?

      --
      In the free world the media isn't government run; the government is media run.
    3. Re: More Theresa May by psmears · · Score: 1

      British PMs are never elected, their party is.

      I think the PM still has to win their seat. Has a PM ever served where their party won FPTP but they didn't win their seat?

      Yes, but not since 1902. (It used to be acceptable for the PM to come from the House of Lords, which is unelected.)

    4. Re: More Theresa May by TheRaven64 · · Score: 1

      The PM only has to be a member of Parliament, not a member of the House of Commons. It used to be common for the PM to be a member of the House of Lords and it's still possible for a party to gain a majority but its leader to lose the election, then bump them up to the Lords. It's pretty difficult now because Prime Minister's Question Time would have to happen in the Lords. Winston Churchill made it politically impossible to do this in most of the first-half of the 20th century and it hasn't come up since then.

      --
      I am TheRaven on Soylent News
  30. GCHQ by phantomfive · · Score: 1

    Don't they have anything better to do than imitate bad Bond villain plots?.

    --
    "First they came for the slanderers and i said nothing."
  31. "Lady Chatterley's Lover" redivivus by Archtech · · Score: 2

    This proposal reminds me of the 1960 obscenity trial of Penguin Books for the publication of "Lady Chatterley's Lover" by D.H. Lawrence. The chief prosecutor, Mervyn Griffith-Jones, caused some merriment but also revealed his deep prejudices by asking if it were the kind of book "you would wish your wife or servants to read". (If they have time on their hands, readers are encouraged to compile a full list of the ways in which that remark was patronising and bigoted).

    If this proposal is taken up by the UK government, it will means that - more than fifty years after the "Lady Chatterley" trial, in an era that prides itself on its freedom of expression - government officials will be asking themselves, in the privacy of their offices, "Is this the kind of Web site you would wish your wife or servants to read?" As it is so very much easier to be safe than sorry, no doubt the answer will very often be, "Actually, no, old man, it isn't" - and off will go another batch of "bad addresses" to the Black List, never ever again to be seen.

    --
    I am sure that there are many other solipsists out there.
  32. Won't they have to also block other DNS services? by rklrkl · · Score: 1

    Providing a national DNS service with nanny filtering sounds too easy to workaround (just point to Google's DNS, OpenDNS etc. instead - just any non-UK reliable DNS service would do). Wouldn't they also have to have the ISPs blocking those other DNS services as well?

    Like all these blocking services, they'll never publish the full list of what they block, hiding behind the claim that it's either proprietary or will give people clues as where the dodgy sites are. Problem is, this means they can block all sort of sites incorrectly and it's hard to know they've done it until someone has to go and kick up a fuss about it in the media.

  33. We should buy shares... by matbury · · Score: 1

    ...in VPN providers and anyone else who provides secure, private internet access ;) I think aunty GCHQ's values and priorities may differ significantly and substantially from my own and probably many other people's and we'll disagree on what should and shouldn't be blocked.

  34. Fuck off already before you infect the rest of us by Anonymous Coward · · Score: 0

    You voted to leave, now leave.

  35. Re:and then block porn / 3rd party candidates / fr by serviscope_minor · · Score: 1

    and then block porn / 3rd party candidates / free press.

    Which of the remaining 11 parties after the first two currently in the house of commons do you consider to be the third one? And to which party to you count the cross bench peers in the Lords?

    --
    SJW n. One who posts facts.
  36. More like Hadrian's Wall by Anonymous Coward · · Score: 0

    Like China, the UK has decided that its subjects need protection from all the bad things rattling around in the outside world.

    More like Hadrian's Wall, built with the expectation of a lot of people and good traveling through it being observed.

  37. Did someone say "Balkanization"? by pla · · Score: 1

    ...Because this is how you get Balkanization. Why have just one pesky uncontrollable "World Wide" Web, when we could have 196 of them, all slightly different?

    1. Re: Did someone say "Balkanization"? by BarbaraHudson · · Score: 1

      I think you would end up with more. Many US states would probably want to block disturbing sites that deal in such scary stuff like evolution and atheism, and of course the gays, because their children will become gay just by reading about it.

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
  38. Sign of things to come? by Anonymous Coward · · Score: 0

    FTFA "UK surveillance agency GCHQ".

    The editor(s) forgot the hyphen after UK.

  39. Re:and then block porn / 3rd party candidates / fr by Anonymous Coward · · Score: 0

    Thats an implementation detail for the controlling party, obviously.

  40. And thus endeth the internet by Anonymous Coward · · Score: 0

    Mockapetris, what hath though wrought?

    Time for a distributed DNS. Don't depend on your ISP/bigbro

    1. Re:And thus endeth the internet by Anonymous Coward · · Score: 0

      I could swear DNS was already distributed...

  41. Re:and then block porn / 3rd party candidates / fr by TheRaven64 · · Score: 1

    Our third party self destructed a couple of years ago and our second party is in process of self destruction.

    --
    I am TheRaven on Soylent News
  42. Why is 6 scared? by Thud457 · · Score: 1

    1. gee, if there were only a way to find out TL;DC : 8.8.8.8, 8.8.4.4 not 4.4.4.4
    2. you're just trading the NSA for GCHQ, you patriotic American, you.



    --

    the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff

  43. Ttaking a web page from China's censorship manual by Anonymous Coward · · Score: 0

    Just more censorship of and spying on the masses

  44. cannot wait by Anonymous Coward · · Score: 0

    I can't wait until national firewalls are the norm and using aftermarket DNS/VPNs make us seedy terrorists, extremists, or at risk of radicalization, or of suggesting radicalizing thoughts to others.

  45. Minor Issue!! by ramriot · · Score: 1

    OK, so lets say this is done, and ISP's are required to have the DNS servers IP as their DHCP autoconfig response.

    Questions:

    1/ Who will own and operate this DNS service?
    2/ What will their DNS request logging retention look like?
    3/ Who will have access to those records and with what authentication?
    4/ Why are you now thinking this is something from George Orwell's 1984?

  46. Re:and then block porn / 3rd party candidates / fr by Pax681 · · Score: 1

    Our third party self destructed a couple of years ago and our second party is in process of self destruction.

    England's main parties you mean.. in Scotland the Scottish National Party is first by several country miles in terms of both Westminster and Holyrood elected representatives numbers.

  47. Malicious content? by jenningsthecat · · Score: 2

    What could go wrong? I mean really, who the fuck trusts a consortium of GCHQ and several mega-corps to neutrally and impartially protect them from "known malware and bad addresses"? Incidentally, I have to wonder - do those 'bad addresses' include sites that are critical of the government and/or the companies in question? Might they include 'non-approved' IP telephony services? Sites that promote Scottish independence?

    The opportunities for abuse are endless. This is a very bad idea.

    --
    'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
    1. Re:Malicious content? by Anonymous Coward · · Score: 0

      What could go wrong? I mean really, who the fuck trusts a consortium of GCHQ and several mega-corps to neutrally and impartially protect them from "known malware and bad addresses"? Incidentally, I have to wonder - do those 'bad addresses' include sites that are critical of the government and/or the companies in question? Might they include 'non-approved' IP telephony services? Sites that promote Scottish independence?

      The opportunities for abuse are endless. This is a very bad idea.

      Sweet, it's great reading up about this and Russia's responce to DNC breaches in the words of there minister "I don't want to use any four letter words" anyone care to speculate what those words would be? "Bull for one and sh** for the other?"

      Dropping all new *HARDWARE* without a trust-zone that you control sounds like a good idea for the moment, hence why I've gone back to using Pentium II & 512MB of Cache and no strange or alien closed source *ME*. Good to know Open Source has your back all the way.

      ReactOS (core-force firewall with pFsensor) - FreeDOS 1.2 with OpenGEM and lastly Nein! GCHQ & NSA Blow US!

  48. Perhaps.... by SadButResolved · · Score: 1

    Perhaps a family with an R in front of thier name knows more about whats happening in the banks and on the internet than you all. I wonder why? Hmm...

    If the U.N. gets control of the internet DNS service they will need a defense.
    You can't let the MBH's coalition own thier country, just yours.

  49. Distributed DNS via Blockstack by Anonymous Coward · · Score: 0

    F--k censorship. This is evil.

    Thankfully there are solutions.

    https://blockstack.org/

    1. Re:Distributed DNS via Blockstack by Anomalyst · · Score: 1

      Javascript required.

      --
      There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
  50. Re:and then block porn / 3rd party candidates / fr by Coisiche · · Score: 1

    And the reason for the Lib Dem destruction is in propping up a coalition government that nobody liked. The electorate punished them and not the larger partner of the coalition. Strange. Or maybe demonstration of just how much control the right wing media has over a large portion of the electorate.

    The implosion of Labour is hilarious. The party is collapsing because it's got too many MPs who wanted to be in the Conservative Party but somehow joined Labour, presumably by mistake.

    The Conservatives may be divided over Brexit but the upcoming constituency boundary changes mean we're going to have a Conservative government for another 20 years or more. Just have to prepare to get health insurance when they finally get to dismantle the NHS and I should be fine.

  51. Malware? Bullsh*t. by Anonymous Coward · · Score: 0

    I'd be very interested in seeing a comparison of how much money GB citizens lose to malware vs how much it will cost to implement and maintain this (keep in mind this is a government operation so it will be gold plated and cost at least 10x as much as it should). Malware is a pain in the arse but "cybercrime" is moving to more lucrative activities like atm skimming, fake swift transactions, etc.
    I suspect if you compare the numbers you'll quickly come to the conclusion this is just a convenient excuse to get the infrastructure in place.

  52. Malware and terrorists will just use IP addresses by presidenteloco · · Score: 1

    So isil.org would be blocked, but wearenotterroristsnothingtoseehere.org would not be.

    Oh, also, https://142.235.76.22/ would also not be blocked, since it doesn't use DNS

    --

    Where are we going and why are we in a handbasket?
  53. Re:Won't they have to also block other DNS service by Anonymous Coward · · Score: 0

    Providing a national DNS service with nanny filtering sounds too easy to workaround (just point to Google's DNS, OpenDNS etc. instead - just any non-UK reliable DNS service would do). Wouldn't they also have to have the ISPs blocking those other DNS services as well?

    I may come to this eventually, but I don't believe this is how it's marketed; it's supposed to be an opt-in system whereby ISPs route their DNS traffic through GCHQ to screen for malware, and anyone wanting to opt-out simply points their DNS servers elsewhere.

    However this has a problem; not many know how to opt out and those that do, automatically become flagged, possibly.

    This could be a good way of singling out the nerds and geeks for further examination and adding to the possible targets for an attempted remote rooting.

  54. Re:and then block porn / 3rd party candidates / fr by ruir · · Score: 1

    ...and sheep sites in Scotland.

  55. DNS 1.9.8.4 by Bailsoft · · Score: 1

    “We shall meet in the place where there is no darkness.” George Orwell, 1984

  56. Re:and then block porn / 3rd party candidates / fr by Anonymous Coward · · Score: 0

    Yep. They already block things they simply don't like. They block TOR traffic even when much of it is not illegal. Pirate Bay, mega Upload, etc.

    Anybody may decide to retaliate via military action, WHEN they do that.

  57. Copying China by Anonymous Coward · · Score: 1

    So, they're more or less copying China's Great Firewall. Just need to add something to inject RST packets to interfere with connections to banned IPs.

    1. Re: Copying China by Anonymous Coward · · Score: 0

      Yes but it is a Western nation so they are only taking away your freedom to protect it. Only commies take your freedom away just to control you. Silly. Please review your Western education briefings, er, I mean news sites to help you better conform to expectations.

    2. Re: Copying China by BarbaraHudson · · Score: 1

      So this is to protect us? Does that mean blocking Facebook, Twitter, etc., because I could get behind that.

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
  58. Re:and then block porn / 3rd party candidates / fr by amorsen · · Score: 2

    English politics are strange.

    Conservatives and Lib Dems set up a coalition, Conservatives do a lot of bad things and Lib Dems only prevent some of them: Lib Dems collapse.

    Conservatives and Labour jointly try to run a campaign to stay in the EU, to deal with the mess that the Conservatives created: Labour collapse.

    --
    Finally! A year of moderation! Ready for 2019?
  59. ipv4 i guess, then malware go ipv6 by NuclearCat · · Score: 1

    Ok, ipv6, and any malicious website can quickly exhaust hardware capabilities of such "firewalls" on 1G+ speeds. ACL entries are costly on such speeds.

  60. Re:and then block porn / 3rd party candidates / fr by Anonymous Coward · · Score: 0

    Who will decide what sites will be blocked? This will inevitably be abused to block (censor) content that should not be blocked! Bad idea, JUST SAY NO!

  61. Re:and then block porn / 3rd party candidates / fr by Cederic · · Score: 1

    Well, nationally too. The SNP don't make it into fourth place nationally. They're barely ahead of the Green party ffs.

  62. Re:and then block porn / 3rd party candidates / fr by Cederic · · Score: 1

    Well, apply recursion to the process and the simple answer is 'all of them'.

  63. Re:and then block porn / 3rd party candidates / fr by Anonymous Coward · · Score: 0

    Some poeple really like their porn, really, that's the order you choose?

  64. Nobody learns any lessons by WaffleMonster · · Score: 1

    I'm so tired of this crap. If you fuck with DNS people will just use IP literals or invent separate control channels to replace DNS.

    Security strategies that "solve" a current problem while ignoring the fact your adversaries are thinking humans with a mind just like yours only lead to collateral damage while not solving the original problem.

    There is still quite a lot of low hanging fruit still left to be plucked in terms of human factors and system design that would actually be effective beyond screwing with deck chairs of sinking vessels.

    If governments really gave a shit they would pitch in resources to effect positive outcomes rather than their panopticon bullshit to monitor and control information flows. Of course they don't so they won't.

    1. Re:Nobody learns any lessons by rubycodez · · Score: 1

      "IP literals?" Nope, most web sites use an IP address shared with others, you also need the browser to put desired symbolic host name in hosts: field of request which the web server (or proxy) will then make to the appropriate vhost. That makes the problem more difficult to solve

    2. Re:Nobody learns any lessons by WaffleMonster · · Score: 1

      "IP literals?" Nope, most web sites use an IP address shared with others

      What "most websites" do or don't do is irrelevant. IP addresses are cheap and easy for anyone with good or bad intentions to obtain especially in the future as IPv6 adoption increases. Criminal enterprises are not required to share their address space (e.g. throwaway virtual hosts and botnet victims) with others nor are they required to use DNS.

    3. Re:Nobody learns any lessons by rubycodez · · Score: 1

      you speak of an imaginary future

      I spoke of the reality of right now, where most of the world's websites are on shared address, and people in a country with censored DNS will need more than numerical address to get to a site, they'll have to have some mechanism to deal with host: field

  65. Re:and then block porn / 3rd party candidates / fr by Ambient+Sheep · · Score: 1

    And the reason for the Lib Dem destruction is in propping up a coalition government that nobody liked. The electorate punished them and not the larger partner of the coalition. Strange.

    Not really that strange. As far as I can tell, they got delayed punishment for going into a coalition with the Conservatives in the first place, rather than aligning with Labour as most Lib Dem voters would have expected. The fury at that cannot be understated; I believe their membership dropped considerably immediately after that fateful decision. Their rout at the following general election was only to be expected. Clegg destroyed that party.

  66. Re:and then block porn / 3rd party candidates / fr by Pax681 · · Score: 1

    Well, nationally too. The SNP don't make it into fourth place nationally. They're barely ahead of the Green party ffs.

    the changes at Holyrood kinda makes a point that image eh?
    2010 's Westminster seats in Scotland
    and after the 2015 election the electoral map looked like this
    Also... just ahead of the greens?.. quite an achievement considering they only stand for election in Scottish seats and have no need or interest in campaigning in English/Welsh or Irish seats. They have the votes of the vast majority of Scots but i suppose that doesn't count as if it's of any importance eh?

  67. Re:and then block porn / 3rd party candidates / fr by rubycodez · · Score: 4, Insightful

    Thoughtcrime, Winston Smith. It's all doubleplusungood thoughtcrime.

  68. Open source it. Allow skipping. by Anonymous Coward · · Score: 0

    If this was:
    1) Open source project that anyone could contribute to by sending in addresses to known malware and such.
    2) Could be skipped, so that people could verify websites were blocked properly, or were doing research on malware, or whatever else.
    I'd go for it.

    I know, I know, we're supposed to hate the big bad evil spy companies, but let's face it, nobody does fucking shit about malware.
    Blackholing the pricks is the only realistic way. Barely 5% of users on the internet even know how to install firewalls that aren't malware that pretend to be firewalls. Making it opt-in is the only realistic way to do it.
    Even Googles safelist is barely decent. It regularly gets things wrong. The time delay between a site being fixed and being rescanned can be the difference between losing customers and viewership forever, or business as usual. (i've seen it happen to independent artists before)

    I say this when I instantly disabled the stupid porn filter on my connection, but I still support the idea because it is an optional feature and useful feature, especially to stop kids getting distracted or procrastinating on Facebook.
    "b-b-b-but just install this web fi--" fuck off, again, barely 5% of people understand how to install things, never mind know that such software even exists. No, kids aren't going to be going about changing DNS or other stuff, they don't understand anything past emojis and instagram.
    Sure, it does mean there is a list of people that disabled it, who gives a fuck? Stop being a paranoid prick.
    You are not going to get arrested because you watched some tranny porn on Chaturbate. You are not special, get over it.
    The filter (especially on TalkTalk, at least) is as general as possible, you can disable access to social networking, it isn't just a porn filter, so your argument is invalid on that point anyway. (and some ISPs don't have it opt-out anyway, only some force opt-in)

  69. Re:and then block porn / 3rd party candidates / fr by wonkey_monkey · · Score: 1

    It's England.

    Well, the UK. For now.

    --
    systemd is Roko's Basilisk.
  70. Re:and then block porn / 3rd party candidates / fr by ItsJustAPseudonym · · Score: 1

    Aw, c'mon! Now I'm just feeling sad.
    --USA person

  71. Oh no, DNS based you say? by wonkey_monkey · · Score: 1

    Manager: I'm sorry, but if you don't come up with that money by tomorrow, the bank is going to take your house.
    Homer: Well, good luck finding it, because I'm going to take the numbers off tonight!
    Manager: Well, we'll look for the house with no numbers.
    Homer: Then I'll take off the numbers on my neighbor's house.
    Manager: Then we'll look for the house next to the house with no numbers.
    Homer: [...] All right, you'll get your money...

    --
    systemd is Roko's Basilisk.
  72. Re:and then block porn / 3rd party candidates / fr by OrangeTide · · Score: 1

    There is really only one party. They all serve the same masters.

    --
    “Common sense is not so common.” — Voltaire
  73. Brexit is not enough... by Anonymous Coward · · Score: 0

    So we left EU, now we leaving free internet, are we shifting the whole archipelago to the space? Did I missed something?

  74. Re:Malware and terrorists will just use IP address by zlives · · Score: 1

    "wearenotterroristsnothingtoseehere.org" until some one puts it on the list, there are third party vendors that classify websites including "violence or terrorism" and so its not far fetched by any means.
    as to the second part... of course not its an DNS list unless they start filtering by content by providing a content filter and not just DNS filter.

  75. Great Chinese Firewall as inspiration by gweihir · · Score: 1

    Obviously, these people think that the Chinese are handling online free-speech and free access to information just right and want to copy their success-story. Sure, people can still get around this (DNS filtering and blocking is the cheapest, least-secure option), but that can simply be made illegal. In the end, the UK "Internet" will end up as a "walled garden" where only content deemed appropriate by the "authorities" is easy and legal to access. Rogue browsing will be treated according to another success-story, namely the treatment of people that listened to non-German radio stations during the 3rd Reich: Send them to concentration camps.

    Sure, the UK has been unfortunate so far to not have had any direct experience with totalitarianism and fascism, but your intrepid politicians are hard at work to correct that historic oversight.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  76. Leave the EU already! by Anonymous Coward · · Score: 0

    Leave the EU already!
    Srsly, just shut yourself in on your island.
    kkthxbye

  77. Re: and then block porn / 3rd party candidates / f by Anonymous Coward · · Score: 0

    I bet they will ban Stormfront and prisonplanet.com. Those are already banned by mobile phone companies and 3rd party commercial filters.

  78. Re:and then block porn / 3rd party candidates / fr by Anonymous Coward · · Score: 0

    > The electorate punished them and not the larger partner of the coalition. Strange.

    Surely, not so much "strange", as deeply predictable. The Conservatives have a reputation for harsh measures; the Lib Dems are the lovely nice people. Seeing the LDs in any leadership position is going to make that mask slip: government requires a certain firmness of purpose, and all the LD supporters could see was a party that had betrayed its principles. Conservatives never had that problem. Also, the LDs blew the one thing that mattered to them: electoral reform got rejected by public poll - they staked the whole game on that and lost.

    As for Labour: they got hacked. They changed the leadership election rules without considering how it would make them vulnerable to swarming, and they've been taken over by new vocal and mobilized membership which has pushed them back to the joys of Labour-in-the-'80s. Moreover, there's no obvious way out: the system isn't going to vote to change itself. The part of the population that isn't Labour Party membership is pretty skeptical about JC as a leader - it's 1983 all over again! They're screwed.

  79. Re:and then block porn / 3rd party candidates / fr by Anonymous Coward · · Score: 0

    Don't forget, it was the referendum for the alternative vote that really nuked them. They had been trying to change the voting system for YEARS, and the referendum was the big concession they won in exchange for support in the coalition. If they'd have won the referendum, they could have relaxed and started biting the Conservatives hard, and rebuilt their popular support.

    As it was, they lost everything. Silly really - as far as I recall, it wouldn't really have made much difference as far as Lib Dem chances were concerned.

  80. I do it 96++% of the time via hosts files by Anonymous Coward · · Score: 0

    See subject: Hardcoded favorites @ TOP of my custom hosts file = faster vs. remote dns, less complex & resource + power intensive & SAFER (dns has many security issues so I avoid it).

    * Those hardcoded fav sites are correctly reverse dns resolved & daily made current (vs. changes) via APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?...

    I get more speed, security & reliability (+ added anonymity vs. DNS request log tracking too) for less & NO Dns server locally required.

    APK

    P.S.=> My favorite sites resolve from hosts cached in local system RAM (minus buggy local Windows DNScache service in slow usermode breaking on large hosts files saving RAM + CPU wasted on it opting for PURE kernelmode via a diskcaching kernelmode subsystem for caching) - Rest = blocking entries vs. threats & I use OpenDNS free version (which filters threats too) for RARE sub 4% times I do a lookup (rare - I spend most time on favorite sites)... apk

  81. Re:and then block porn / 3rd party candidates / fr by Cederic · · Score: 1

    The SNP have more representation in Westminster per vote than any other party. Maybe more than every other party ever.

    So no, getting more votes in Scotland than everybody else counts for fuck all. It's still not democratic.

    I do also seem to recall them losing the vote they really cared about. No wonder Sturgeon's scared shitless of calling another referendum, for all her bleating about the supposed need for one.

  82. Not via APK Hosts File Engine tepples by Anonymous Coward · · Score: 0

    See subject & this https://yro.slashdot.org/comments.pl?sid=9653397&cid=52889347/ as it updates hardcoded favorites as you build you hosts file w/ it correctly reverse dns resolving them, & placing them @ the TOP of the custom hosts file it creates for fastest possible resolution from local RAM once hosts loads there...

    APK

    P.S.=> Surprised you overlooked that fact tepples... apk

    1. Re:Not via APK Hosts File Engine tepples by tepples · · Score: 1

      I tried to mention tools like yours, but even including your initials in my comment caused it to trip Slashdot's lameness filter.

  83. Re: and then block porn / 3rd party candidates / f by lister+king+of+smeg · · Score: 1

    I bet they will ban Stormfront...

    why would they block the first Dresden files book

    --
    ---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
  84. There's ways around it as you can see by Anonymous Coward · · Score: 0

    See subject: Thanks but I circumvent that by turning off javascript use on /. (which blows away their puny filter per my post proving that much) - as an "AC" poster, I'm not subject to the chains & tracking of scripts + cookies that "registered lusers" are.

    Whipslash, being a webmaster looking for ad profits unfairly tries to stop me (along w/ his advertiser sponsors) & fails always - despite how stupid it makes him look (he even applies 5++ hr. long blocks on me posting limiting me to 1 a day or so he thinks (wrong) - makes me laugh!

    APK

    P.S.=> I'm on topic in my posts on hosts' numerous virtues in added speed, security, reliability & anonymity but webmasters, inferior competitors, advertisers + malware makers do NOT like it (hosts aren't as easily blocked by those same scripts as say, browser addon adblockers are which use more & don't do nearly as much on as many levels for those virtues noted)... apk

  85. The Great Firewall of England by Anonymous Coward · · Score: 0

    Welcome to censorship and information control in the UK.. get ready for a bumpy ride people.. it wont be long before you microchipped!

  86. Outsourced? by Anonymous Coward · · Score: 0

    I'm sure the chinese would be more than willing to be the contractors on that job...

  87. Re:and then block porn / 3rd party candidates / fr by AmiMoJo · · Score: 1

    I voted Lib Dem a few times, but the coalition was a betrayal. Tory policies are so far removed from what the Libs stood for, and they got such a bad deal out of the negotiation... And look where it got us. Out of the EU and likely on the virge of the UK breaking up as Scotland and Gibraltar seek to remain in.

    Labour is having an existential crisis. They want a leader with principals, but need a slimey piece of shit like Cameron to win an election.

    --
    const int one = 65536; (Silvermoon, Texture.cs)
    SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  88. Re:and then block porn / 3rd party candidates / fr by Anonymous Coward · · Score: 0

    Well, how does the headline of a newer /. article go?:

    "Someone Is Learning How To Take Down the Internet..."

    Actually, the 'Internet' is already pretty dead. It just doesn't know yet.

  89. Reminds me of the Great Firewall of China by Anonymous Coward · · Score: 0

    Given the past record of England as a pioneer in becoming a modern Police State, one cannot help to detect ulterior motives for setting up that kind of "filtering".

  90. Re:and then block porn / 3rd party candidates / fr by Pax681 · · Score: 1
    and THERE we have it from Cederic! the unionist bilge and spite pouring out!
    t was just a matter of time before someone came and spaffed over the keyboard with their hate..lol
    As fro Sturgeon being scared? why would that be? are you sure? really sure? because you know... she/they may well be putting together a sound legal case instead of, much like yourself... opening the mouth and letting the belly rumble

    The SNP have more representation in Westminster per vote than any other party. Maybe more than every other party ever. So no, getting more votes in Scotland than everybody else counts for fuck all. It's still not democratic.

    it's not democratic??? Cederic.. I am fairly sure they are the only party, expecially of those with any power in the whole of these islands with a positive approval rating, the won 56 out of 59 seats in West and are the govt.. again.. third term in Scotland with the majority of elected representatives there being SNP.
    Now you can spit and froth and foam but that doesn't change a thing.
    as for losing the vote?.. yup, we did and it was close.. VERY close 45 to 55% BUT.. here the thing.... especially with the fact that ALL the promises made by the note no side(extra powers yadda yadda yadda for Scotland by November 2015) ... well NONE appeared by November 2015 and a lot of people are not very happy about that and they are not due for some time yet.. then there's the DEMOCRATIC deficit which has been shown time and time again..... even though Scotland voted solidly to stay in the EU.. England are dragging us out of it. and that actually does bring us to democratic deficit.. whereby it really doesn't matter what way Scotland votes or Ireland or Wales....the sheer numbers England has compared to Scotland etc means the what England votes happens really...
    Now as for her being scared... really? She appeared on TV and said straight that she and the ministerial team were fully investivating all possibilities including a fresh Independence referendum and .. they legal team especially are still investigating, dotting the I's and crossing the T's as it's a very complex constitutional issue and with their Westminster and Holyrood mandate which you so kindly acknowledge yet dismiss in the same breathe .. however thee plans take time to fully prepare but no... according to you she is crapping herself at the thought.... eh.. hardly....
    It just seems to me you are a bitter little man who just doesn't like or acknowledge the SNP and it's achievements .. such as being the only party EVER to get a majority govt at Holyrood where the system was designed to create coalitions and they actually got a majority. again and again...
    just bitter anyway .. because they are MASSIVELY AHEAD of the greens , and i mean massively .. you claimed that the SNP were behond the greens....... erm.. Greens have 1 ,yes just ONE seat at Westminster... and the SNP..... 56 ... so how are the greens bigger? The greens have 6 MSP's in Scotland and the SNP... oh yeah they are the Scottish Govt and majority party, so without having any candidates sit outside Scotland they are bigger than the greens by a country mile and I mean MILE,. So you see Cederic.. you're just fuull of hatred, blatant hatred for Sturgeon and the SNP and at a guess Scotland too by extension.
    next point please caller!

  91. UK is a facist state by Anonymous Coward · · Score: 0

    North Korea does something, BAD, China does something, BAD---- UK does it- GOOD.
    Excuse me while i bash my head into a brick wall until i lose consciousness.

  92. Re:and then block porn / 3rd party candidates / fr by Cederic · · Score: 1

    You may want to seek assistance from an expert mental health professional.

  93. Re:and then block porn / 3rd party candidates / fr by Pax681 · · Score: 1

    You may want to seek assistance from an expert mental health professional.

    yeah when you cannot refute, resort to ad hominem eh?

  94. Re:and then block porn / 3rd party candidates / fr by Cederic · · Score: 1

    The problem is that the internet has too many idiots, and I have too little time.

    You're one of the idiots.

  95. Re:and then block porn / 3rd party candidates / fr by Pax681 · · Score: 1

    The problem is that the internet has too many idiots, and I have too little time.

    You're one of the idiots.

    are you really THAT stuck for a rebuttal? aaaaaw.. diddums

  96. Re:and then block porn / 3rd party candidates / fr by Cederic · · Score: 1

    You're the cuntface that started throwing words like 'bile' around and using capitals in response to a factual, calm and constructive comment.

    Having firmly established your intellectual credentials at the level of 'dehydrated slug' you really expect me to take your points apart one by one?

    No. Go lick a cow, it's about your level.

  97. Re:and then block porn / 3rd party candidates / fr by Pax681 · · Score: 1

    You're the cuntface that started throwing words like 'bile' around and using capitals in response to a factual, calm and constructive comment.

    Having firmly established your intellectual credentials at the level of 'dehydrated slug' you really expect me to take your points apart one by one?

    No. Go lick a cow, it's about your level.

    and there we have it!
    as for licking cows... only portions when cooked :-)

  98. Just Like The Blacklists Used Now by alternative_right · · Score: 1

    the issue maybe what is considered "poisonous", terrorism today and free speech tomorrow.

    This site was once an anti-government screed and then an Osama bin Ladin fan site before becoming its current incarnation, a New Right/Alt Right blog.

    It is still listed as a hate site for one of those earlier incarnations, meaning that it is blocked in most workplaces, and no amount of petitioning these services leads to it being permanently unblocked.

    That is what we face: either user-reported or bureaucrat-driven censorship.

    1. Re:Just Like The Blacklists Used Now by zlives · · Score: 1

      its called trickle down censorship, Reagan would approve ;)

  99. Monitoring by Anonymous Coward · · Score: 0

    Also increases GCHQ surveillance.

  100. Re:and then block porn / 3rd party candidates / fr by RockDoctor · · Score: 1

    You'll be able to find some good ones at Carstairs. You're going to be real popular with the big boys there.

    --
    Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"