Adguard Letter of Support to Quad9(adguard.com)
adguard.com
Adguard Letter of Support to Quad9
https://adguard.com/en/blog/adguard-quad9-statement.html
24 comments
Same as ordering the post office to stop processing mail because someone sent a copy of a book in the mail...
GP's comparison seems considerably more accurate. Even if your position is that the only way the Post Office could comply with filtering the mail for the address that's still not the same as an order to stop processing mail. Not to mention "someone sent a" makes it sounds like a single instance which is certainly not what http://uu.canna.to/ regardless if you agree or disagree with pirating content.
The comparison is not the mail or the processing, it's the fact that it's a transporting service and nothing more, just like DNS.
I do not understand why more people don't switch to a decentralized DNS such as OpenNIC (https://www.opennic.org)
Governments have abused their control of DNS. A distributed system (with trust and safeguards) is the better way.
Governments have abused their control of DNS. A distributed system (with trust and safeguards) is the better way.
Because no one knows about it. But also, looking at their list of servers, the majority is offline. Assuming this is because any person can run one, it's probably the reason.
On top of the above, the likes of Google are enforcing their DNS servers. For example, I run AdGuard Home with it's DHCP functionality. I am unable to rely on the DHCP settings on my Android phone because Google forces the first DNS server to be 8.8.8.8 with (as far as I can tell) no way to disable this.
I think at least for the foreseeable future the solution is to run Unbound and stop relying on DNS resolvers combined with a firewall that redirects all DNS records AdGuard Home/PiHole. This is obviously not a solution to the general public.
On top of the above, the likes of Google are enforcing their DNS servers. For example, I run AdGuard Home with it's DHCP functionality. I am unable to rely on the DHCP settings on my Android phone because Google forces the first DNS server to be 8.8.8.8 with (as far as I can tell) no way to disable this.
I think at least for the foreseeable future the solution is to run Unbound and stop relying on DNS resolvers combined with a firewall that redirects all DNS records AdGuard Home/PiHole. This is obviously not a solution to the general public.
I can't speak to Google forcing DNS, I don't know if this is true. However, it will respect the private DNS option (DNS-over-TLS) which you can point to whatever you want (like NextDNS for filtering).
Lots of tech giants are forcing DoH so their apps can phone home despite safeguards such as pi-hole. There's not a lot that you can do about that (if they are using certificate pinning, which they probably are). You can however do something about 8.8.8.8 (and 8.8.4.4). Just put a static route in your firewall that points those to your DNS of choice (or to a black hole).
I'm still in the stages of setting up a fullt featured firewall at home, but I wonder what would happen if you block doh/dot addresses completely in such cases. Something to try in the future when I have my home network set up properly I guess.
You can block all outgoing requests to ports 53 and 853 for DNS and DoT respectively. That's the easy part.
For DoH, you either have to block port 443 (bad idea), or block the IPs of all known DoH providers.
Then you can run for example a Pi-Hole and add a firewall rule to allow outgoing DNS traffic only for that.
And of course that will not stop device/app makers from using nonstandard ports or even tunnelling their DNS traffic through other protocols.
For DoH, you either have to block port 443 (bad idea), or block the IPs of all known DoH providers.
Then you can run for example a Pi-Hole and add a firewall rule to allow outgoing DNS traffic only for that.
And of course that will not stop device/app makers from using nonstandard ports or even tunnelling their DNS traffic through other protocols.
> I am unable to rely on the DHCP settings on my Android phone because Google forces the first DNS server to be 8.8.8.8 with (as far as I can tell) no way to disable this.
Which Android version and skin? I'm on an Android 10, MIUI12 device and the DHCP-provided DNS server is the one used ( AdGuard successfully blocks ads on websites, apps when on my phone, until i disable it).
Which Android version and skin? I'm on an Android 10, MIUI12 device and the DHCP-provided DNS server is the one used ( AdGuard successfully blocks ads on websites, apps when on my phone, until i disable it).
If everyone used OpenNIC what would be different about this case?
What would be different is that an individual or organization running a OpenNIC DNS would not necessarily be subject to a court order from Germany.
There's not much that can be done when governments fiddle with the root DNS servers, but methods could be developed to retain historical records, and revert to them in the event of censorship.
There's not much that can be done when governments fiddle with the root DNS servers, but methods could be developed to retain historical records, and revert to them in the event of censorship.
How was your experience with them? Mine wasn't too great a few years ago - I switched, everything was great, had that nice fuzzy feeling inside that I'm using a pro-freedom/anti-censorship DNS, until a couple of months later when the DNS server just stopped responding. Surely I must've simply been unlucky I thought, so I switched to another instance but the same thing happened a few months later.
I love the idea in principle but it didn't seem to work for me in reality.
I love the idea in principle but it didn't seem to work for me in reality.
OpenNIC isn't "decentralized" or "distributed" in any meaningful sense. It's the same architecture as ICANN DNS circa 2000, but run by hobbyists. (And in practice, it's mostly hosted on cheap cloud servers. No anycast IPs, no load balancing -- just few enough users that they haven't had to deal with any serious scaling issues yet.)
Quad9 is based in Switzerland, so the German court should only have jurisdiction over whatever servers are in Germany. It seems like the worst case scenario is that Quad9 shuts down their German servers, but still serves German requests from servers in neighboring countries.
That said this is still terrible and I hope the German court reconsiders their decision. The free flow of information is more valuable than protecting copyrights, because the former benefits many more people. Most of the copyright holders who feel threatened by piracy are not even German! The court is protecting big American businesses over individual Germans.
That said this is still terrible and I hope the German court reconsiders their decision. The free flow of information is more valuable than protecting copyrights, because the former benefits many more people. Most of the copyright holders who feel threatened by piracy are not even German! The court is protecting big American businesses over individual Germans.
It seems that most of HN doesn't know the Lugano convention (which basically reaches the entire EEA).
> The spendings will only grow as more and more similar court rulings are handed out (which without a doubt will come eventually). It will become near impossible to uphold a DNS service, and all small DNS resolvers will vanish.
I run one such small public DNS (DoH-only) resolver (primarily popular in countries where censorship is low to moderate), and know several other folks who do. Just the other day we were discussing the implications of this ruling, but coming from a country with dismal digital/internet freedom track-record, this made me sit back and contemplate for a bit (unblocking access to censored web properties may soon be a crime as the government here bids to criminalise VPNs):
I believe, the inevitable over-regulation and insurmountable legal threats are going to ruin it for the hobbyists who thrive at the fringes. Internet may soon go the way of the telecom industry. Controlled by a few, regulated to oblivion, with high barriers to entry.
I hope I am wrong.
I run one such small public DNS (DoH-only) resolver (primarily popular in countries where censorship is low to moderate), and know several other folks who do. Just the other day we were discussing the implications of this ruling, but coming from a country with dismal digital/internet freedom track-record, this made me sit back and contemplate for a bit (unblocking access to censored web properties may soon be a crime as the government here bids to criminalise VPNs):
I believe, the inevitable over-regulation and insurmountable legal threats are going to ruin it for the hobbyists who thrive at the fringes. Internet may soon go the way of the telecom industry. Controlled by a few, regulated to oblivion, with high barriers to entry.
I hope I am wrong.
Quad9 was co-created by IBM, they will bow the knee to preserve government contracts and big R&D bets in Germany
https://www.forbes.com/sites/moorinsights/2021/06/15/ibm-and...
https://www.forbes.com/sites/moorinsights/2021/06/15/ibm-and...
IBM is one of many donors to Quad9, but they have no seat on its multistakeholder governance board. https://quad9.net/about/foundation-council
This would be like a German court ordering Yellowbook to stop listing the phone number for a DVD store because they were known to sell bootleg copies of Sony movies. What a joke.